On 5 December 2025 the European Commission fined X 120 million euros for non-compliance with the Digital Services Act. One of the three grounds was the ad repository. It lacked "the legal entity paying for" each ad.

TikTok, facing preliminary findings on the same obligation, avoided a fine by giving the Commission binding commitments.

Meta's repository has the field. It is called beneficiary_payers, it carries a payer and a beneficiary on every ad delivered in the EU, and anyone can query it at graph.facebook.com/v25.0/ads_archive. This is the DSA field, not the "Paid for by" disclaimer on political ads, which is a separate mechanism.

On 148 ad entries for Dua Lipa's Live From Mexico, the payer field says Madonna.

No label, distributor, promoter or artist named below is alleged to have breached anything. Nothing in this data would support that.

The control

Madonna's own official page carries 251 ad entries. The disclosed payers: WARNER MUSIC GROUP (149 entries), Warner Music Germany (24), Warner Music France SAS (8), Warner Music Spain (6). Another 64 entries ran UK-only and carry no payer field at all.

The string "Madonna" appears as payer on zero of them.

Real Madonna advertising discloses Warner corporate entities, not the artist's name. So the "Madonna" on Dua Lipa's account cannot be a trace of genuine Madonna spend that wandered. It is a stale free-text entry.

We know what a correct disclosure looks like on that same campaign. The same Live From Mexico push ran 66 other entries under "Warner Music International Services Ltd." All 148 wrong ones read:

payer: Madonna
beneficiary: Madonna
current: true

The 66 correct ones read Warner Music International Services Ltd in both.

The payer and beneficiary sub-fields do diverge across the corpus: 26,291 entries where they match, 5,489 where they don't. The ordinary divergence is legitimate, a payer of "Warner Music Germany" against a beneficiary of "David Bowie." They have to be read separately.

Nobody typed the wrong thing on purpose

Payer and beneficiary are set at the ad-set level. There is an account-level default that new ad sets inherit silently. If your entity is not in Meta's verified-business dropdown, you can type free-form text. The picker offers your ten most recently used entries.

Set it once during a campaign and everything built afterwards carries it.

Nobody re-reads a field that doesn't affect delivery, cost, or review. The field does not say who paid. It says what an ad account was registered as when that ad set was built.

This is not an accusation. Every artist named here as a payer string did nothing wrong. These are people whose names ended up in somebody else's settings field.

Twelve cases, checked by reading the ads

We pulled roughly 39,000 ad entries across about 186 advertiser pages, EU and UK delivery. String mismatch alone proves nothing, so every case was adjudicated by opening the creative and asking what the ad sold.

Universal Music Portugal discloses "KaRoL G" on 541 entries across 123 creatives, over fourteen months. The ads sold uDiscover Portugal, Spotify, the Universal shop, a Universal competition, Olivia Dean, Ariana Grande, KPop Demon Hunters. That set carried zero Karol G ads.

Interscope Records discloses "Billie Eilish" on 62 entries across 9 creatives. The ads sold Karol G x Bruno Mars and Karol G. None sold a Billie Eilish product.

The two names traded places between two Universal accounts, which is harder to write off as a typo.

Topsify Eastern Europe discloses "ROXEN" on 588 entries across 49 creatives. Topsify is Warner's playlist brand. What the page sells is Spotify playlists, Warner singles by Kehlani and Oliver Tree, brand pushes. Roxen is a Romanian singer who represented Romania at Eurovision in 2020, signed to Warner's licensee in Romania. She has nothing to do with these campaigns. The string flipped from WARNER MUSIC GROUP to ROXEN on a single day in March 2026 and stayed.

Little Simz's page discloses "JVKE" on 26 entries for her Sugar Girl EP. The campaign ran one creative in one duplicated ad set. JVKE is an American artist. What he shares with her is a distributor, AWAL.

That last one is one keystroke from correct.

Nothing here crossed a corporate boundary. Madonna and Dua Lipa are both Warner. Karol G and Billie Eilish are both Universal. Nemzzz and Maisie Peters are both Atlantic. Little Simz and JVKE share a distributor.

In all twelve the wrong name and the account sit inside the same corporate family. No money moved between companies. That is the rebuttal any press officer would give and it is correct. What it does not answer is how a field the DSA requires carried a wrong string for fourteen months with nothing in the system to catch it.

The failure follows the account

What predicts stale strings is how many artists share one ad account, not whether the label is major or independent.

RAYE's marketing runs through The Orchard, and all 712 disclosing entries say "ORCHARD ENTERPRISES, INC., THE." A corporate legal name cannot drift onto the wrong artist, because it never named one to begin with. The artist-name convention can drift, and does.

The stale strings sit on shared multi-artist infrastructure, the territorial label accounts and distributor orbits that run dozens of artists through one dashboard. Live Nation Germany discloses "Little Simz" correctly on her ticket ad and carries the stale "Tate McRae" on RAYE's.

Across the whole corpus, adjudicated wrong strings account for 1,585 of 31,753 disclosing entries (5.0 percent) and 247 of 6,532 disclosing creatives (3.8 percent). They sit on 23 of the 169 pages that disclose anything.

That 5 percent is a floor. It counts only what somebody adjudicated by opening the ads. On the independent and distributor pages we read end to end, the rate was 8 wrong entries out of 1,668 (0.48 percent) and 5 of 299 creatives (1.7 percent). The two are not comparable, because the indie pages were read exhaustively and the major pages were not.

The bigger problem is ambiguity

Warner Music Finland discloses 38 distinct payer strings across 122 entries. They are Finnish artist names. Käärijä, SANNI, Erika Vikman, Kaija Koo. The field tracks the campaign. That is how Meta describes it.

Warner Music Denmark carries 51 entries, two of them UK-delivered and blind. Of the 49 that disclose, all name one payer, Warner Music Denmark. The ads run to nine smart-link destinations, seven of them individual artists.

Finland and Denmark sit inside the same company and read the same rule opposite ways. Neither is breaking a rule.

You cannot aggregate a field that different advertisers use to mean different things. Aggregation is the entire purpose of a public ad repository.

The field accepts anything

That the field takes unverified free text was already documented in DSA enforcement research. Austria's KommAustria and AI Forensics found random digit strings, character sequences, and "facebook" sitting in the payer slot on scam ads. What nobody had measured was the scale of it in legitimate advertising.

A payer of literally "B," on four entries from an American independent label. "Girikaman," matching no company anyone can find, on five entries reporting 1.6 million EU reach. "www.aegpresents.co.uk" as a payer name, on fifteen entries. A string that looks like a CRM record ID, on seven.

Leonard Cohen's estate page carries 73 entries, all one creative filed 73 times, for the 55th anniversary of Songs of Love and Hate. On 49 of the 73 the payer and beneficiary both read n/a, flagged current, on a live and entirely legitimate catalog campaign.

And one merch page's payer disclosure reads, in order: billi, bill, bilil, billili, billie, biili, billil. The page carried seven misspellings of one short string. That page is 217 archive rows, 186 of them Meta enforcement placeholders. Only three of the seven spellings and 30 entries survive the exclusions.

Most of the industry gets it right

This matters, because it is what makes the exceptions hard to spot.

Sony Music Austria discloses itself on 118 of 118 entries. Universal Music Ireland, 176 of 177. Warner Music Sweden, Warner Music Denmark, BMG and RHINO all at 100 percent.

Pages that come in under 100 are mostly a company writing its own name two ways. Universal Music Polska is 239 of 240 on the exact string and 240 of 240 as a company, the one difference being its registered name in capitals. Columbia Records Italy is 300 of 309 and 305 of 309 the same way.

And the field sometimes does work nothing else can. Sony Music Greece discloses COBALT MUSIC-HELLADISC S.A., its Greek licensee. BMG Italy discloses 3V Agency SRL. Those tell you a licensee or an agency is doing the buying.

Nobody here is lying. A default nobody owns goes stale in a handful of accounts, in a system with no verification step.

Why this reaches past music

The state of the art on DSA ad-repository auditing is Benzaamia, El Fraihi, Abdelaziz and Goga, published in PoPETs 2026. It covers 48,511 ad explanations across Facebook, Instagram, YouTube and X, and finds targeting data to be incomplete and misattributed.

That paper audits targeting disclosure. To match a user-facing ad to its repository entry, the authors join on advertiser identity, which is the Page. That is a different field from the one that drifts here. The Dua Lipa page is correctly identified as the advertiser on all 148 entries. Anyone joining on Page would get the right answer every time.

What our data reaches is any analysis that reads the payer or beneficiary string as an entity-resolution key: market-concentration studies, campaign-funding traces, compliance checks on the field itself. All three treat the string as a legal entity name. On at least 5 percent of the disclosing entries here, it is not one.

We could not find any audit, academic or journalistic, of whether the payer field itself is accurate. That is not proof one does not exist, but we looked.

X was fined partly for not carrying the paying entity at all. Carrying a field that nobody verifies is a different failure. The X decision is under appeal, filed at the General Court in February 2026.

Notes

All figures from beneficiary_payers on Meta's public Ad Library API, pulled through 21 August 2026. About 39,000 ad entries across 186 pages. Ad entries and distinct creatives counted separately, because the same creative gets filed dozens of times.

The DSA fields are EU-only. UK-delivered ads carry no payer. 7,145 entries here are payer-blind, and 7,045 of the 7,046 recording a location are UK-only. A US-only campaign is invisible entirely.

The field is self-declared and Meta does not verify it. Every wrong-name case was adjudicated by reading what the ad sold. No merch or impersonation page is named.