Spanish fact-checking organisation Maldita.es today published an analysis of 21 Facebook groups used to organise irregular crossings into the Spanish enclave of Ceuta on July 30 and 31, 2026, documenting how recruitment posts on the social network preceded a migration of logistical planning to encrypted WhatsApp groups from July 27. The research counted more than 5,600 posts across six of those groups in a single week and identified 20 WhatsApp groups, as of August 6, organising a further attempt for August 15.

The finding sits on a fault line that European platform regulation has not yet resolved. Facebook is a designated Very Large Online Platform under the Digital Services Act, carrying obligations to assess and mitigate systemic risks including the dissemination of illegal content. WhatsApp private groups are not. When coordination moves from one to the other, as Maldita.es documents it doing across five days in late July, it crosses from a supervised environment into an explicitly excluded one.

From requests for favours to recruitment posts

The groups themselves are not new. According to Maldita.es, the oldest of the 21 analysed was created on October 25, 2014, and only one was opened during the events in question, on July 30, 2026. Every other group predated the late-July crossing.

The largest, named "Ceuta Castillejos", was created in March 2025 and has more than 190,000 members. Its description, quoted by Maldita.es, reads: "Emigration is a dream, and dreams are made to be fulfilled. Dare or leave."

For the first half of July, according to the analysis, crossing attempts were not the dominant subject. Maldita.es characterises the period from July 1 to 17 as one of ordinary requests: a user who said she had entered with her three-year-old daughter looking for a room, another asking across three separate groups whether anyone travelling to Ceuta could bring an ointment from Tangier.

Between July 17 and 19 the register changed. Maldita.es records the first direct references, including an anonymous post in the "Ceuta Castillejos" group addressed to Algerian users in Castillejos, and another asking simply for ideas on how to get into Ceuta.

Recruitment posts followed. On July 21, according to the analysis, a user posted in the same group seeking two people with experience crossing fences. That profile continued posting across several groups over subsequent days and published a personal telephone number on July 25. Other users, located by their own profile settings in Agadir, Tangier and near Rabat, posted looking for travel companions from specific towns. Maldita.es states it could not independently verify the locations users declared, noting that a profile displaying a location may not be in the place it claims.

On July 26 an anonymous user asked a question that Maldita.es placed in its headline: "What is the reason people have been connecting so much lately?" Another user replied: "It can all be seen clearly."

The same day, according to the research, a separate user posted an identical message five times in the same group within minutes, looking for someone able to swim who would attempt the crossing from Castillejos.

July 27: the jump to WhatsApp

The first link to a WhatsApp group referencing the Ceuta crossing appeared on July 27, according to Maldita.es. It was posted in "Ceuta Castillejos", a group the analysis describes as having nearly 200,000 members, by a user who said he was from Algeria. The accompanying text read: "WhatsApp group to try to enter/cross toward Ceuta." Maldita.es notes that it could not verify the user's stated nationality, that the profile photograph was an Algerian flag taken from the internet, and that the account supplied no further identifying information.

That link travelled. On July 29 an anonymous user shared it in a second Facebook group, "Castillejos Puerta de Ceuta". On July 30 the original profile posted it there again, this time without text, and another anonymous account shared it the same day. Maldita.es states it cannot confirm whether the anonymous shares came from the same account.

The pattern held across the network. Between late July and the first days of August, according to the analysis, at least 19 distinct WhatsApp group links were distributed at least 36 times across Facebook groups connected to Ceuta, Castillejos and harraga communities. The term harraga, which Maldita.es glosses as "those who burn", refers to clandestine migrants who cross the sea by small boat or attempt border fences. July 30 and 31 were the days on which those links were shared most.

The division of labour is the operative detail. Facebook functioned as the recruitment surface, visible and searchable, while the logistical conversation relocated to end-to-end encrypted groups where no external observer, including Meta, reads the contents.

By the afternoon of July 30, according to Maldita.es, posts in the Facebook groups were signalling that the maritime fence separating Ceuta from Morocco was open. On August 1, users began naming August 15 as the next date. One post cited by the analysis reads: "We go up on the 14th and enter on 15/8 (guys from Marrakech)." Another names both the 15th and the 25th.

Not everyone in the groups believed it. "Will there really be something in Castillejos on the 15th?", one user asked, in a post Maldita.es includes among examples of scepticism circulating alongside the coordination.

The analysis also documents an offer of payment. Some users asked whether anyone could get them into Ceuta for 10,000 dirhams, which Maldita.es converts to roughly 930 euros.

Volume, and what the counts do not settle

Maldita.es published a chart headlined "More than 5,600 posts in seven days", covering total posts and posts specifically concerning victims or missing people across six Facebook groups between July 30 and August 5, 2026. The organisation states the underlying data was collected from Facebook between August 4 and 6, 2026.

The daily series in the published chart is not fully legible in the document supplied, and the per-day breakdown cannot be reconstructed with confidence from it. What the chart does establish is the aggregate, that the highest single-day total exceeded 900 posts, and that posts about victims and missing persons formed a distinct and much smaller series running underneath the total.

After the crossing, the subject matter shifted. According to Maldita.es, conversation in early August divided into three types: users coordinating a further attempt, users searching for relatives or mourning the dead, and users circulating Spanish, Moroccan and international press coverage. August 2 stood out as a day on which families posted photographs of missing relatives. In subsequent days, groups circulated an email address opened by Spain's Guardia Civil to gather information on the victims, whose number Maldita.es puts at 141 dead so far.

Some posts came from people who said they had arrived. One, quoted by the analysis, reads: "Brothers, I am in Ceuta, lost in the forest. I have gone two days without eating and I have no clothes."

A political narrative also circulated in the groups, according to the research, describing Ceuta as an occupied Moroccan city.

Where the Digital Services Act stops

The regulatory geometry here is unusually sharp, and it matters beyond this case.

Facebook has been a designated Very Large Online Platform since April 2023, one of the original 17 named by the European Commission. That designation triggers obligations under Articles 34 and 35 to assess systemic risks, including the dissemination of illegal content and effects on public security, and to put mitigation measures in place. The threshold for designation is 45 million average monthly active users in the European Union, a figure PPC Land has previously set against Meta's own reported EU user base of 529.7 million and its deployment of more than 1,000 staff on DSA compliance.

WhatsApp reached the same threshold by a different route. The Commission formally designated WhatsApp a Very Large Online Platform on January 26, 2026, on the basis that its Channels feature recorded 51.7 million average monthly active users in the EU during the first half of 2025, giving Meta until mid-May 2026 to comply with the additional obligations. The designation decision drew an explicit line: WhatsApp's private messaging service, covering text, voice notes, photographs, documents and calls between users, remains outside the definition of an online platform under the regulation.

Groups are private messaging. The 19 links Maldita.es counted pointed into a space the DSA does not reach, shared from a space it does.

That asymmetry produces a specific enforcement problem. The publicly visible artefact - a link, posted in a group of 190,000 people, with text stating its purpose - sits on the supervised side. The conversation it opens does not. Any mitigation measure has to act on the link, because after the click there is nothing to act on.

A moderation record already under scrutiny

Meta's content moderation capacity in Spanish is documented. The company's 2024 DSA transparency report disclosed 2,325 Spanish-language content reviewers, more than for any other language listed, and a median response time of 25.8 hours for authority orders on Facebook.

The policy framework around those reviewers has changed since. On January 7, 2025, Meta announced it would end third-party fact-checking and move to a Community Notes model, stating at the time that automated detection would concentrate on illegal content and high-severity violations while less severe categories would require user reports before action. The programme formally ended in the United States on April 7, 2025. Maldita.es itself operates as a fact-checking organisation in the Spanish market, and the research published today was produced with the Arab Fact-Checking Network, part of Arab Reporters for Investigative Journalism.

Enforcement pressure has been building in parallel. The Commission preliminarily found Meta in breach of DSA transparency obligations on October 24, 2025, covering researcher access to public platform data and the mechanisms users rely on to report illegal content. On July 10, 2026, it issued preliminary findings on addictive design across Instagram and Facebook, an action carrying potential fines of up to 6% of global annual turnover.

The researcher-access point connects directly to this story. Maldita.es assembled its dataset by observing public groups, not through any privileged data channel. Article 40 of the DSA was written to make exactly this kind of work systematic rather than manual.

What the finding means for buyers

Facebook Groups are not a standalone ad placement, but they are inventory-adjacent, and they are inside the surface Meta monetises. The company reported $59.36 billion in second-quarter advertising revenue on July 29, 2026, with ad impressions across its Family of Apps up 14% and average price per ad up 12%. Growth on that scale comes from expanding delivery across surfaces, and Groups activity feeds the recommendation and engagement signals underneath it.

Brand safety tooling is poorly positioned for this category. Verification vendors have built content-level analysis for Feed and Reels, and the Media Rating Council tightened its definition in October 2025 to require analysis of images, video and audio rather than text alone. None of that addresses a public group whose individual posts are unremarkable in isolation and whose meaning is established by volume and sequence.

There is also a direct commercial vector. Meta began placing advertisements on WhatsApp Status on June 16, 2025, targeting the roughly 1.5 billion people who open the Updates tab daily, and its third DMA compliance report filed on March 6, 2026 confirmed that Channels and Status advertising was being prepared for the European Union. WhatsApp is becoming a paid media environment in the same market where its private groups fall outside platform content rules. The two facts are unrelated in law and adjacent in practice.

The wider pattern is familiar from other enforcement files. A consumer class action filed in April 2026 drew on internal documents alleging Meta's platforms expose users to an estimated 15 billion higher-risk scam advertisements daily. Meta researchers, for their part, published work in December 2025 claiming 10-fold to 100-fold data efficiency gains from reinforcement learning applied to moderation. Detection capability and detection outcome are not the same measurement.

Methodology and stated limits

Maldita.es sets out the boundaries of its own claim. The analysis covers 21 Facebook groups over the period July 30 to August 5, 2026. The organisation states that its conclusions apply only to those groups, rest on its own analysis, and are not to be read as absolute or as applicable to every group concerning crossings from Morocco to Ceuta.

One wording inconsistency is worth noting. The published text describes the 21 groups as ones in which crossing "from Ceuta to Morocco" was promoted, while every other element of the research, including the quoted posts and the described events of July 30 and 31, concerns movement in the opposite direction, into Ceuta. The remainder of the article resolves the direction unambiguously.

The organisation also does not claim a causal link between the WhatsApp links it counted and the 141 deaths recorded. It documents sequence, volume and platform, and stops there.

Timeline

Summary

Who: Maldita.es, a non-profit Spanish fact-checking foundation, working with the Arab Fact-Checking Network, part of Arab Reporters for Investigative Journalism. The platforms concerned are Meta's Facebook and WhatsApp.

What: An analysis of 21 Facebook groups in which irregular crossings into Ceuta were organised. The research documents at least 19 distinct WhatsApp group links shared at least 36 times across those groups, more than 5,600 posts in six groups over seven days, a largest group exceeding 190,000 members, 20 WhatsApp groups organising a further attempt as of August 6, and 141 deaths recorded so far.

When: Published August 7, 2026. The monitored period runs from July 30 to August 5, 2026, with quoted posts dating from July 1 onward and post-volume data collected between August 4 and 6, 2026.

Where: Facebook groups linked to Ceuta, Castillejos and harraga communities, and encrypted WhatsApp groups reached through links shared in them. Ceuta is a Spanish enclave on the North African coast, inside the European Union.

Why: The case marks the boundary of the Digital Services Act. Facebook has carried Very Large Online Platform obligations since April 2023 and WhatsApp since January 26, 2026, but the WhatsApp designation expressly excludes private messaging, which is where the coordination documented here relocated. For advertisers, the sequence describes a category of platform risk that sits inside a monetised surface, is invisible to content-level verification tooling, and hands off to an environment that regulation does not reach.