Meta has spent two decades proving that advertising at scale can outrun almost any cost. On Wednesday, the company tested that proposition in a single afternoon. A judge in Santa Fe ordered it to pay $25 billion for misleading New Mexicans about privacy, with interest running at 15% a year. Hours later, Meta reported that its advertising revenue had grown 26% in the third quarter, even after a $9.89 billion charge to settle claims over harm to teenagers. Around those two numbers, the day's news filled in the rest of the picture: platforms switching on automation by default, a PHP flaw that threatened about 70% of websites, a flood of AI agents that nobody can yet identify, and an industry still arguing over how to measure any of it.
The fine and the earnings
PPC Land reported on October 21 that a New Mexico judge fines Meta $25bn over Facebook privacy claims. Judge Francis J. Mathew of the First Judicial District in Santa Fe set the penalty after a jury found in September that Meta had misled the public about privacy and content moderation, including over Cambridge Analytica. Randi McGinn, a lawyer for the state, had urged the court to "speak to Meta in the only language it understands, which is money." Attorney General Raúl Torrez, who says the money will go to schools, told reporters: "We may have paid for the construction of schools for the next 100 years." Meta will appeal. Matt Nicholson, its attorney, argued that "The jury didn't make findings that any New Mexican heard or saw these statements, or was harmed by them."
The judgment itself, PPC Land found in a second report, is harsher than the headline figure. Meta faces 15% yearly interest on its $25bn New Mexico penalty. The 20-page order counts 43,899,720 violations at $5,000 each, a statutory maximum of $219,498,600,000, then reduces it to $25 billion without stating a method. It adds: "Interest on the penalty shall accrue at the rate of fifteen percent (15%) per annum until paid in full." By PPC Land's arithmetic, that is about $3.75 billion a year, or roughly $10.3 million a day. The state had asked for $35 billion to $40 billion; Meta had proposed about $3.4 billion. The order does not say whether interest is simple or compound, or when it starts.
That evening, Meta reported its quarter. PPC Land reported that Meta takes a $9.89bn teen settlement charge as ad revenue gains 26%. Revenue reached $64.6 billion and advertising revenue $63.06 billion, both up 26%. The settlement charge, covering payments of up to about $18.59 billion with state attorneys general, cut operating income 37% to $12.99 billion and halved the operating margin from 40% to 20%. Free cash flow was negative $2.12 billion after $34.91 billion of capital spending in the quarter. Price per ad rose 23% in the US and Canada. "Our investments are paying off, the core business is strong, and we're seeing velocity across the board," said Mark Zuckerberg. PPC Land notes that Meta's documents do not mention the New Mexico judgment, and that court filings total about $17.21 billion against Meta's own $18.59 billion figure.
On the earnings call, the fastest-growing line belonged to creators. PPC Land reported that Meta's ads with creators gain 97% to a $15bn annual run rate. "Our partnership ads product grew over 97% year-over-year and surpassed $15 billion in annual revenue run rate," said Susan Li, the chief financial officer. Nearly 10 million advertisers used Meta's AI creative tools. Muse, the personal assistant launched in September, has more than 10 million agent set-ups in the US and Canada, with about a quarter using it daily, and Meta plans a transaction fee with no level or date. "We do not have specific numbers to share around the cost structure of Muse today," Li said.
Other publications put the cost in the foreground. AdExchanger's Joanna Gerber wrote that Meta grows revenue 26% despite massive Muse operating costs, quoting Zuckerberg describing the assistant as "very compute intensive to run." Adweek reported that Meta beat Q3 expectations, with Li saying: "Our AI investments are already delivering substantial incremental advertising revenue."
Muse also had a privacy problem of its own. PPC Land reported that Meta halts Muse share links after 6,800 turn up in public DNS records. Claroc, a security vendor, found that share links placed chat titles in subdomains that passive DNS services recorded. "It took one query," Claroc wrote. It sampled a few hundred and found loan, revenue, fraud-alert and HR content, though "We have no evidence that anyone has misused these shares." Meta paused sharing on October 20. And PPC Land reported that Meta's Muse gains 10 million US downloads in 40 days, based on Sensor Tower estimates: ChatGPT took about four months to reach the same mark and Claude nearly two years. Sensor Tower cautions that Muse "is potentially experiencing outsized gains due to the advertising push by Meta."
Meta's advertising business sells the same promise to smaller clients. PPC Land reported that a Meta case study credits Nest's AI ads with 20% higher conversion rates across seven UK brands. "That makes creative variety a direct performance lever," Meta writes. The data is the agency's own, with no control group.
Luis Rijo
Switched on by default
Tuesday's edition covered OpenAI's decision to rewrite ChatGPT ads unless advertisers opt out. PPC Land added detail on October 21: OpenAI will rewrite ChatGPT ads by default as advertisers get days to opt out. OpenAI's email gives Friday, October 30 as the start date, while its help page says Thursday, October 29. The email says the change covers self-serve campaigns; the help page drops that word. One toggle covers all four types of change, with no control at ad or ad group level and no reporting on which version ran. "Variations may be prepared in advance or created in real time based on the conversation," OpenAI's help text says.
OpenAI is selling those ads in far more places. PPC Land reported that advertisers in 26 more countries gain ChatGPT ads, bringing the total to 89. OpenAI says more than 100,000 advertisers have run campaigns. "Ads will appear only on the Free and Go plans. Plus, Pro, and Enterprise subscriptions will remain ad-free," it says. AdExchanger's Gerber reported that ChatGPT Ads is expanding to new markets and exploring new ad formats, including a more visual format tested in the US. She noted that about 60,000 advertisers were active in early October and that the $1 billion annualised run rate falls short of a $2.4 billion forecast. "People shouldn't have to guess whether something is an ad," an OpenAI spokesperson said.
Google moved the same way. PPC Land reported that Google turns on PMax image extraction by default from December 4. New Performance Max campaigns will pull images from advertisers' landing pages for use across Search, YouTube, Display, Discover, Gmail and Maps. "Crucially, this new campaign-level default applies even if Dynamic Image Extensions are disabled at the account level," wrote Dora Sun of Google's Ads API team. PPC News Feed reported that Performance Max sourced videos become opt-out, spotted by Hana Kobzová: "Previously, the use of sourced videos was an opt-in feature, turned off by default."
Search Engine Roundtable reported that Google Ads can now save and test asset group changes as an A/B test in some accounts, spotted by Joey Bidner, and that Google updated its Smart Bidding learning document with a 7-day limit: "the Learning status never lasts more than 7 days." The rewritten document also advises: "Avoid making multiple target changes within a single conversion cycle unless there is a clear business need."
Google's channel controls, launched on October 14, are spreading. PPC News Feed reported that channel prioritization and budget caps are live in Google Ads for Performance Max, Shopping and Search, including outside the US, and that "Google shared that it plans to make this available for Demand Gen campaigns in the future as well." It also reported that seasonality adjustments are now available for Demand Gen, for short events lasting one to seven days, and that Google published a commerce media partner directory listing retailers in India, Brazil and Romania, "marking the first European inclusion." Search Engine Roundtable added that Merchant Center now specifies fast shipping days by country, from one day in Japan and New Zealand to four in Brazil.
Bing tested new formats too. PPC News Feed reported that Bing tests a CTA button in Copilot ads, a "Learn more" button spotted by Sachin Patel.
Google also extended its checks on financial advertisers. The story, first covered in Tuesday's edition, gained detail in PPC Land's report that Google forces US and Canadian financial advertisers to prove licences in 2027. Keerat Sharma, Google's vice president of ads privacy and safety, named no Canadian registry, no start date and no penalties. "Because regulations differ across borders, we're adapting our approach for each country," Google says. PPC Land notes that the American and Canadian bankers' associations are industry bodies, not regulators.
A flaw in the web's plumbing
The day's most urgent technical story reached far beyond advertising. PPC Land reported that PHP servers face two 9.2-rated flaws that let attackers run code, CVE-2026-109618 and CVE-2026-109619, both allowing remote code execution without authentication. Fixed releases shipped at 13:30 UTC on October 21. "Every PHP installation that serves web requests is at risk," CERT-EU warned. The NSA recommended "that organizations take the system offline until it can be fully mitigated." Search Engine Roundtable cited Reuters reporting that "Several government, school and hospital websites in Europe were taken offline on Wednesday." PHP runs on almost 70% of websites.
Cloudflare moved first. PPC Land reported that Cloudflare blocks php2shell exploits 9 hours before the PHP flaws went public, with protection live from 03:02 UTC. PPC Land calculates the lead at 10 hours and 28 minutes against CERT-EU's release time. Cloudflare says the flaw leaked early and attackers were already changing their payloads. OpenAI claimed a share of the discovery. PPC Land reported that OpenAI says GPT-5.6 Sol found a PHP flaw before attackers did, through the security firm Calif. "To our knowledge, frontier AI found these vulnerabilities before attackers did," OpenAI wrote. PPC Land notes that OpenAI's account omits the leak and attacks Cloudflare described.
Google's search team had advice for sites going offline. PPC Land reported that Google tells sites patching PHP to serve 503, not 404, to keep pages indexed. "Friendly reminder for everyone running emergency PHP patches or taking servers offline today: Don't forget the 503!" Google Search Central posted. Search Engine Roundtable reported John Mueller's advice on taking sites down while fixing the PHP2Shell exploit: "use HTTP 503 instead of letting responses time out / 404 / 500."
What robots.txt can and cannot do
Google spent the same day clarifying how site owners can keep content away from its systems. PPC Land reported that Google says robots.txt limits AI crawling, not what bots do with data, from the second episode of its "Non-Canonical Cabinet" video series. "It doesn't dictate what a system does with the data after it has already crawled it," said Gary Illyes. Search Engine Roundtable also covered Google's video on robots.txt rules for AI crawlers, including Illyes's plea: "Let's keep it boring. Beautifully boring." The episode does not mention Google-Extended.
PPC Land reported that Google lists 7 ways to keep content out of Search, AI opt-out included, up from five, adding the robots meta tag and the Search Console "Search generative AI control." Search Engine Roundtable also covered the update. Google says the change is "to keep the page fresh and reflect the current set of options available to site owners." The AI control excludes training, and PPC Land links the update to UK Competition and Markets Authority obligations that take force on December 3, 2026. Search Engine Roundtable also reported that Google updated its URL structure guidance on hyphens, and that ranking volatility heated up on October 20 and 21. "Either way, a core update is coming soon and maybe this is Google testing the waters," Schwartz wrote.
The W3C, which writes the web's standards, proposed principles for the agents now crawling it. PPC Land reported that the W3C drafts a 9-point declaration putting people ahead of AI agents, in a discussion paper by Philippe Le Hegaret to be presented on October 29. It notes, with unusual candour, that "this report was developed with AI assistance, its human editor takes full responsibility for its content."
Agents nobody can identify
The case for such principles came from the data. PPC Land reported that 97.7% of legitimate AI agent sessions carry no verified ID, Arkose finds. Only 2.3% presented a verified Web Bot Auth signature, though ChatGPT's agent signed 78.4% of its sessions. "The real question is, what did the agent come to do? What is its intent?" said Mitchell Davies, Arkose's lead researcher.
Regulators are asking the same question. PPC Land reported that the UK ICO gives AI agent firms until November 20 to submit evidence, in a 37-page call covering security, transparency, accountability and lawful basis. "Organisations must design transparency into agentic AI systems from the beginning," the ICO writes. PPC Land also reported that 47% of enterprise AI chats run on personal accounts, an Akamai report says, though the data is recycled from LayerX, which Akamai acquired.
Businesses are deploying agents regardless. Adweek's Mitchell Parton reported that Walmart embraces AI agents that shop on behalf of customers, opening its site to them with purchase approvals and spending limits, a month after Amazon blocked Muse. PPC Land reported that Yelp charges $30 a month for an AI agent that answers and qualifies leads, part of a release of more than 30 features. Yelp calls Smart Lead Reply "a new agentic product that responds to customers, vets leads, and helps service professionals win more business." And PPC Land reported that Invoca AI agents book patient appointments in Epic and four other EHRs, sending de-identified booking outcomes to ad platforms. "Our Invoca AI agent recovered 25 appointments on its first night, and it also knew its limits," said Matt Eaves of University Hospitals.
Commerce is preparing for agentic shoppers with mixed evidence. PPC Land reported that DaVinci Commerce claims a 30% AI discoverability lift but gives no method. "I don't believe GEO alone solves this problem," said Diaz Nesamoney, its chief executive. And Adweek's Mark Stenberg interviewed an AI performer on stage at the ANA conference in Orlando. In Tilly Norwood tells all, the Particle6 creation advised: "Stop worrying about the tools and start focusing on the stories." Bob Lord, chief executive of Horizon Media, added: "Years ago, marketers had to learn the funnel. Now they have to learn the models."
Apple's block, argued
The Safari identity block, the lead of Tuesday's edition, drew two new arguments. PPC Land reported that the IAB Tech Lab CEO says Apple's domain block hurts publishers more than ad tech. Anthony Katsur's essay asks Apple for clear policies, transition periods and review processes. "Ad tech can adapt, and I expect it will," he wrote, while conceding: "Hiring does not establish that those rules were designed to disadvantage competitors." PPC Land notes that the essay offers no revenue loss figures or named publishers.
PPC Land also reported that Safari blocks identity firms as eMarketer puts Apple's US ad sales at $8.85bn for 2026, rising to $11.06 billion in 2030. Apple Maps ads went live in the US and Canada on August 21. The WebKit post itself states: "First party personalization is not tracking, and is not what our technologies seek to prevent." PPC Land found that the timing of the blocks and the growth of Apple Ads overlap, but that no public data links them; Apple does not disclose ad revenue.
Apple's other news was industrial. PPC Land reported that Apple commits up to $100m to Perryman for iPhone Duo titanium, with at least 80% recycled content. "American ingenuity is vital to all our products," said Sabih Khan, Apple's chief operating officer.
Measurement under strain
Measurement was the subject of the day's research releases, most of them produced by companies selling a method. PPC Land reported that the IAB gives marketers 15 days to comment on its ad measurement conflict guide, a draft on what to do when marketing mix models, incrementality tests and attribution disagree. "Measurement only works if the industry trusts the answers it produces," said David Cohen, the IAB's chief executive. Comments close on November 4. "We built this to be used, not just read," said Matt Shapo.
Television measurement shifted from viewing to ads. PPC Land reported that streaming gains 6.2 points of US TV ad exposure in a year, Comscore finds: streaming took 22.3% of ad exposure time in August, broadcast 43.2% and cable 34.5%. Digiday's Tim Peterson, in his October 21 Future of TV Briefing, reported that YouTube and Tubi top streamers' share of ad exposure time, with YouTube at 44% of streaming ad time. "We like to think of ourselves as the scorekeeper and not a commentator in the booth," said Kevin Burns, Comscore's interim chief revenue officer.
The advocacy groups had their own numbers. PPC Land reported that a VAB infographic puts premium video co-viewing 33% above YouTube on CTV, without stating its source or method. PPC Land reported that Kochava says CTV comes before search in 96% of installs that touch both. "CTV shouldn't be measured in a silo," said Jason Hicks. And Magnite ads top Cint's ad recall lift benchmark by 136%, Magnite says, with no campaign count or sample size. "What stands out in these findings is the consistency of performance across the funnel," said Regan Kelly of Cint.
Fraud estimates were contested too. PPC Land reported that Fou says the $63bn invalid traffic estimate undercounts fraud on CPM ads. "Bots didn't need to click through to the site in order to make money on CPM campaigns," wrote Dr. Augustine Fou. Out of home is adding verification: PPC Land reported that UniLED wins verification of every Talon US digital out-of-home campaign. "Verification is about far more than confirming that a campaign played as planned," said Ben Zloof, UniLED's chief executive. Reddit offered a score of its own: PPC Land reported that Reddit links 80% optimization scores to 19.6% lower CPA for advertisers, a correlation rather than a test.
Identity in retail moved in the other direction from Safari. PPC Land reported that TransUnion and Fiserv tie tap-to-pay and new cards to one shopper profile, with Red Lobster as the first named user. "Transaction Matching helps merchants recognize more of the customers they already serve," said Brian Silver of TransUnion. Consent and opt-out are not mentioned.
PPC Land also dug into supply fees. It reported that PubMatic cut its excess inventory fee 80% in April, page history shows, from $0.005 to $0.001 CPM, while the Inventory Quality Fee stayed at $0.02. The policy warns: "Exceeding the Max Cap can result in suspended monetization until resolved." The Max Cap itself has never been published.
Independent agencies want better terms from the platforms they buy through. Digiday's Kimeko McCoy reported that indie agencies want The Trade Desk and Amazon DSP to acknowledge their buying power. One 15-person agency clears The Trade Desk's $100,000 monthly bar but still pays 17% to the platform plus 12% to a reseller. "They won't let us go direct and they won't change the fees," one executive said. Retail media is consolidating: AdExchanger's Allison Schiff reported that retail media platform Kevel raises $52 million with M&A on the brain. "Consolidation is going to happen," said James Avery, its chief executive.
Netflix, Braze and the data deals
Two stories from Tuesday's edition returned with new detail. PPC Land reported that Netflix's ad revenue forecast drops to $2.7B as partner integrations slip. Netflix did not say which integrations slipped; earlier commitments included Amazon's buying platform in all countries by June 1 and clean rooms with Snowflake and AWS. "It's just not growing as fast as it could or as fast as we'd like," said Ted Sarandos. PPC Land also reported that Trade Desk buyers gain 4 million data segments for Netflix ads in November, from more than 300 providers, and that the ad plan reaches 11 more countries in March 2027. "Netflix Ads keeps growing, and our approach hasn't changed," said Nicolle Pangis.
PPC Land reported that Salesforce agrees to buy Braze for $5.66bn in cash, about 7.7 times Braze's trailing revenue of $738.2 million and about 27% below its 2021 IPO price. The deal is expected to close in Salesforce's fiscal 2028. "Salesforce's platform will help us innovate faster," said Bill Magnuson, Braze's chief executive.
Regulators and courts
Europe's regulators were busy. PPC Land reported that Booking.com faces an EU probe over scams and paid listings not labelled as ads. "Users should be able to clearly recognise that these 'boosted listings' are in fact advertisements," the Commission says. "Europeans should be able to book their holidays without fear of being scammed," said Henna Virkkunen. PPC Land also reported that the European Commission readies a study on 5 DSA dispute settlement challenges.
In Germany, PPC Land reported that Berlin finds the CDU, SPD, Greens and Left broke GDPR with Facebook targeting in the 2021 campaign. "Any data on a person's political views is protected particularly strictly by the GDPR," said Felix Mikolasch of noyb. The outcome was reprimands, not fines. And PPC Land reported that SCHUFA wins four appeals over credit score disclosure at Germany's top court, though the court eased the burden of proof for consumers: "In view of the principle of effectiveness under EU law, the requirements must not be set too high."
In the US, PPC Land reported that Character.ai bankruptcy notices still name 8 attorneys general out of office, a problem for a sale that, as PPC Land puts it, "only binds parties who were properly told." And PPC Land reported that Getty Images files Chapter 11 to cut more than $500m of debt. "Today's filing is a procedural step to implement the financial restructuring previously announced," said Craig Peters, its chief executive.
Platform safety featured too. PPC Land reported that YouTube halts uploads on suspected hacked channels, typically for 24 hours. "When a channel is hijacked, hackers look to quickly lock account owners out and upload unwanted videos or live streams," TeamYouTube wrote. And PPC Land reported that Google Trends scores differ by IP in 60% of weekly checks, ExpressVPN finds, though the VPN seller acknowledged that "our sample and methodology are insufficient to draw this conclusion."
Messaging, audio and streaming
Meta set a deadline for WhatsApp marketers. PPC Land reported that WhatsApp Cloud API loses marketing messages on October 13, 2027. "After this date, sending marketing messages on Cloud API will produce an error," Meta says.
Audio platforms competed for creators and listeners. PPC Land reported that Spotify lets podcasters keep 90% of fan Membership revenue in 34 markets, against YouTube's 70%. Adweek's Stenberg reported that Substack brings dynamic ad insertion to podcasts. In AdExchanger, Victoria McNally interviewed Maria Tullin of Horizon Media, who said video podcasts are hot, but audio should not be abandoned. "The big hole is YouTube," Tullin said. PPC Land reported that Comscore data shows July audio minutes drop 36B from a year earlier, even as the report headlines growth against 2023. And Spotify puts its native app in five Audi models, free tier included. "Drivers get instant, hands-free access the moment they sit down," said Jonathan Tarlton.
Streaming added outlets. PPC Land reported that JustWatch TV opens to 50 million guide users with 30 content partners in 11 markets. "The launch of JustWatch TV marks the most important new development in our company's twelve-year history," said David Croyé. PPC Land reported that Rings of Power season 3 arrives November 11 with 4 of 8 episodes, and that Prime Video's worldwide chart for October 12 to 18 was led by a romance starring Gabriel Basso and Margaret Qualley, with Carrie topping series; the page gives rank order only.
Publishers looked for revenue beyond search. PPC Land reported that the Tampa Bay Times gains an Azerion games portal as the Tribune network hits 20, and that Celebrity Traitors stories got 1m page views, under half of Strictly's, in Taboola data, even though Traitors has more television viewers. Digiday's Alyssa Mercante reported that creator mentors Colin and Samir want to turn their followers' ideas into productions, with a $25,000 grant funded by Adobe. "I always want to be a bridge between the worlds," said Samir Chaudry.
Holiday season
The holiday season is arriving early. Digiday reported that nearly 30% of holiday budgets are expected to be spent by the end of October, a six-year high in Deloitte's survey of 4,000 shoppers. "Retailers, in general, should try to make this concept of value easy to see," said Brian McCarthy of Deloitte. PPC Land reported that Amazon will hire 300,000 US holiday workers, up from 250,000 in 2025, and that 61% of SHEIN's US app shoppers put themselves first on holiday lists, in a survey of its own users.
Adweek's Parton covered two retailers' campaigns. Target ditches "Hot Santa" for D'Arcy Carden in its first holiday campaign under a new chief executive, focused on "making sure that all of our content supports the gift giver, building their confidence," said Michelle Mesenburg. Kohl's brings back Ellie Kemper for a campaign premiering during the World Series. Robert Klara reported that Whatnot launches its first national spot with Giants running back Cam Skattebo, and that a PepsiCo and AB InBev veteran takes the CMO post at Diageo North America, where Sebnem Erim joins a region the company calls its "biggest challenge." Adweek's TVNewser announced new daily cable news ratings from October 22.
Finally, in Berlin, PPC Land reported that Almedia takes its $1bn run rate to 3,500 Berlin posters to find staff, disclosing unaudited revenue of €281 million for 2025. "German tech doesn't usually grow like this. We do," the posters say.
Meta's quarter answered the question it posed. Advertising revenue grew faster than the legal bills, and the company that most embodies automated advertising can absorb a $25 billion penalty and still grow ad revenue by a quarter. The more difficult questions the day raised were not about Meta's capacity to pay. They were about whether anyone, from the IAB to the ICO to the W3C, can yet see clearly what the automated systems are doing, and who is responsible when they switch themselves on.
By the numbers
15%
Annual interest on Meta's $25bn New Mexico penalty, about $10.3 million a day by PPC Land's arithmetic.
Meta faces 15% yearly interest on $25bn New Mexico penalty
$15 billion
Annual run rate of Meta's partnership ads with creators, after 97% year-over-year growth.
Meta's ads with creators gain 97% to a $15bn annual run rate
97.7%
Share of legitimate AI agent sessions Arkose saw that carried no verified identity.
97.7% of legitimate AI agent sessions carry no verified ID, Arkose finds
89
Countries where advertisers can now buy ChatGPT ads, after 26 were added on October 21.
Advertisers in 26 more countries gain ChatGPT ads, bringing the total to 89
6,800
Muse share link hostnames Claroc found in public DNS records with a single query.
Meta halts Muse share links after 6,800 turn up in public DNS records
Discussion