Jasmine Ault compares it to a house fire. On 24 September 2026, according to a report by Anja Karadeglija of The Canadian Press published five days later, the Toronto resident found that Meta had shut down her Facebook and Instagram accounts without warning. The Facebook profile was 20 years old. One Instagram account dated back to 2011. A second was dedicated to her dog. Overnight, two decades of memories, contacts and professional connections were behind a door she could not open.
“It's actually quite scary to think about the trust that we put in the social media platforms that can all be taken away in one day,” she told the news agency. The fire, she explained, is a metaphor, “and it's really upsetting because the hypothetical, the metaphorical fire that I'm referring to, is my memories.”
What made the loss feel so total was not just the ban. It was the silence after it. Ault told The Canadian Press she had not been able to reach a human being at Meta since the accounts were deactivated. The only things that would talk to her were AI chatbots, and they could not resolve the problem. CBC News, which also spoke to her, reported that after the deletion notice arrived she stayed up for about 26 hours straight trying to appeal. Within minutes of pressing appeal, she was told her case was closed and that she would not be permitted to appeal again. She was never told which rule her Facebook account had supposedly broken. Meta's explanation, as reported, amounted to a single line: her Facebook account “doesn't follow our rules”. When The Canadian Press asked questions, Meta did not respond to them directly and instead pointed to a support blog post, including an update from March about rolling out an AI support assistant. Meta did not respond to CBC's requests for comment.
This is the uncomfortable shape of a modern dispute with a platform. The thing that holds your relationships, your archive and your livelihood can remove all of them in an instant, and the only voice you hear afterwards may belong to software. That raises two questions bigger than one Toronto woman's Facebook profile. What should an effective appeal look like when AI mediates access to the platforms that hold people's lives? And how can platforms keep their security enforcement, which is real and necessary, while still offering a route to review that a locked-out human being can actually use?
What the Report Does and Does Not Establish
It is worth being precise about what is known. The Canadian Press report does not establish why Ault's accounts were disabled. Meta has not publicly said which rule it believes was broken. Ault herself has a theory: she told the agency she suspects someone tried to hack her account, because she found a record of suspicious login attempts shortly before it was deactivated, and Meta's records associated her phone number with someone in India. That is her suspicion, reported as such. It is not a finding.
It would be easy to fill the gap with a story. Perhaps an intruder got in and posted something that tripped an automated filter. Perhaps a classifier misread an old photograph. Perhaps something else entirely happened. None of those possibilities is established, and the honest position is that nobody outside Meta, including Ault, has been told. That gap is the point. A system that cannot tell a person what she is accused of has already failed the first test of a fair process, whatever the underlying facts turn out to be.
The human cost, at least, is not in dispute. Ault works in marketing and communications and had used social media to attract consulting clients. Prospective clients, she told the news agency, “have nothing to look at. They can't see my portfolio of work.” Friends might assume she had blocked them. “There's a dead end and I can't even communicate to the people I want to communicate with,” she said. Markus Giesler, a professor of marketing at York University, framed it in sharper terms for the same report: “We like to think of this as a customer service case when in actuality it's a case of platform accountability.” These platforms, he added, “have been woven so much into our social fabric, into who we are as individuals and communities, that access to them is really important.”
The Ban Wave That Came Before
Ault's story lands in a long, loud context. Through the summer of 2025, users in several countries reported Facebook and Instagram accounts being disabled in waves, often with no clear reason. In June 2025 Meta acknowledged what spokesperson Andy Stone called “a technical error that impacted some Facebook Groups”, after communities devoted to things such as parenting, birdwatching and gaming received violation notices. By early July, TechCrunch reported that a petition titled “Meta wrongfully disabling accounts with no human customer support” had passed 25,500 signatures, and that users were organising on Reddit to share experiences and talk about legal action.
Some of the most distressing cases involved accusations of child sexual exploitation, a category where, as the Oversight Board noted quoting Meta's Transparency Center, a single violation may be severe enough that “we'll disable your account”. ABC News in Australia reported in July 2025 on Madison Archer, a beautician whose Instagram business account, built over nine years, was permanently disabled in June 2025 after she posted a video of herself with her daughter. She appealed within minutes and was refused. Her account came back only after ABC News contacted Meta, which told her: “We're sorry that we've got this wrong and that you weren't able to use Instagram for a while.” Archer's verdict on the process was blunt: “If a human actually did the review they would see that I'm not sexually exploiting children.”
In South Korea, the backlash became political: The Korea Herald reported in July 2025 that the Korea Communications Commission had formally asked Meta for written clarification, and that Meta Korea had apologised for the “frustration”. None of this proves that Ault's case shares a cause with those waves. It does show that the pattern she describes, sudden loss, terse explanation and support that cannot or will not engage, was familiar long before September 2026.
Meta itself has not pretended its enforcement is flawless. In January 2025, Joel Kaplan, the company's chief global affairs officer, wrote that in December 2024 Meta was removing millions of pieces of content every day, and that “we think one to two out of every 10 of these actions may have been mistakes”. He conceded that “too many people find themselves wrongly locked up in 'Facebook jail,' and we are often too slow to respond when they do.” By May 2025 Meta reported a roughly 50 per cent reduction in enforcement mistakes in the United States between the fourth quarter of 2024 and the first quarter of 2025. Its more recent integrity reporting says that less than 0.1 per cent of the content produced on Facebook and Instagram in a quarter was removed incorrectly, but also discloses that in the fourth quarter of 2025 false positives “increased over 100% during a very brief period of the quarter due to a bug”.
A tiny percentage of an enormous base is still a great many real people, and one bug can double the rate of wrongful action in days. Automated enforcement will make mistakes. The question is what happens to the person on the receiving end when it does.
Paying for a Human and Getting a Bot
When Meta launched its paid Meta Verified subscription in 2023, it promised direct access to account support. It is precisely what a person in Ault's position would reach for: pay a monthly fee, get a human. Ault did exactly that. According to CBC News, she paid US$14.99 (about C$21) for Meta Verified's Standard tier, believing it would get her human support. The “enhanced support” she received was another AI chatbot, which promptly closed her ticket, telling her she had “reached her limit of support interactions”. She was not the first subscriber to be disappointed. TechCrunch reported in July 2025 that during the ban wave, paying subscribers described agents who were dismissive, closed chats and offered canned responses.
The sharpest assessment came from inside Meta's own governance structure. In June 2026 the Oversight Board, the independent body Meta funds to review its content decisions, issued its first decision on account disablement. Summarising the public comments it received, the Board recorded that many users said they were unable to appeal, never received any explanation for why their account was disabled, or were unable to download their content. Others, it noted, had created a new account specifically so they could pay for Meta Verified, “which includes '24/7 access to email or chat agent support,'” and yet “could not get meaningful assistance”. Some reported that their new accounts were then disabled for breaking the rule against creating an account after being banned.
The trap is circular. The paid route to a human requires an account. The person who most needs a human no longer has one. Opening a fresh account can itself be treated as evasion. And the free route, increasingly, is an AI assistant.
Meta has been explicit about that direction of travel. In December 2025 it launched a centralised support hub for Facebook and Instagram, acknowledging that “support hasn't always met expectations”, and began testing an AI support assistant. In March 2026 it announced a wider rollout, describing an assistant that provides “24/7 help for account issues” and can “respond to requests typically in under five seconds”. The same post contains a sentence that should be read closely by anyone who has been locked out: “people will continue to play a key role in how we make the highest risk and most critical decisions, such as appeals of account disablement.”
That is the right principle. The difficulty is that, from the outside, it is invisible. If a person cannot tell whether a human ever looked at her appeal, and receives a decision indistinguishable from an automated one, a human somewhere in the pipeline does little to make the process accountable.
Why Platforms Lock the Doors So Fast
None of this means platforms should slow-walk enforcement or open the doors to anyone who asks nicely. The reasons for speed are serious.
The first is child safety. Meta reported that in the fourth quarter of 2025 alone, Facebook, Instagram and Threads sent more than 2.6 million reports to the CyberTipline run by the National Center for Missing and Exploited Children in the United States. When a system detects apparent child sexual exploitation, the expectation is immediate action, not a conversation. Errors are horrifying for the wrongly accused, but delay on true positives carries its own grave cost.
The second is fraud. Meta says that in 2025 it took down 10.9 million accounts associated with scam centres in Southeast Asia and the Middle East. An appeals channel that can be gamed becomes a tool for operations of that scale.
The third, and the one most relevant to Ault's suspicion, is account takeover. A hijacked account carries the trust of its real owner's friends, followers and clients. A platform that detects suspicious logins faces a genuine dilemma: lock the account and the owner suffers; leave it open and the intruder can impersonate them or scam their contacts. Recovery itself is dangerous ground. The United States National Institute of Standards and Technology, in its digital identity guidelines, notes that because account recovery is invoked infrequently, it “is generally less convenient than authentication” and “may involve extended waiting times”, and requires that an account recovery event always triggers a notification to the subscriber “to help detect the fraudulent use of account recovery”. Security engineers expect recovery to be slower than logging in precisely because it is where attackers aim.
When the Help Desk Became the Break-In
If anyone doubted that recovery is a battleground, 2026 supplied the proof, courtesy of the very kind of AI support that now stands between users like Ault and their accounts.
On 1 June 2026, 404 Media reported that hackers had been taking over high-profile Instagram accounts by asking Meta's AI support assistant to link the target account to a new, attacker-controlled email address. The accounts reportedly affected included the Barack Obama White House account, the account of the chief master sergeant of the US Space Force and that of the retailer Sephora. TechCrunch reported two days later that Instagram was alerting users targeted during the attacks, and quoted Meta spokesperson Andy Stone saying that “the issue that did happen has already been fixed”.
The scale emerged in a filing Meta made to the Maine Attorney General, reported by Help Net Security on 8 June. It disclosed that 20,225 Instagram accounts had been taken over through a flaw in an AI-assisted recovery system called High Touch Support, with the first unauthorised access dating to 17 April 2026 and the vulnerability identified on 31 May. Amber Hannah, an associate general counsel at Meta, explained in the notice that “due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user's Instagram account.” Accounts without two-factor authentication could then be taken over.
The episode cuts both ways. It shows why platforms are wary of easy recovery: an assistant that says yes too readily is a gift to criminals. But it also punctures the idea that automation is inherently the safer option. An AI system that handed over more than 20,000 accounts was not a cautious gatekeeper. It was a fast one. Speed and security are not the same thing.
What the Oversight Board Found Inside the Account Machine
The Oversight Board's June 2026 decision is the most detailed public examination yet of how Meta disables accounts. The case itself was not a sympathetic one. The Board upheld Meta's decision to permanently disable an Instagram account with more than 70,000 followers that had posted threats of violence against a journalist, including an image of a bullseye over her face. It did not conclude that Meta should disable fewer accounts across the board.
What it did conclude, after more than 750 public comments, was that the disablement process raised serious concerns about due process and proportionality. It found no clear framework for when “egregious” violations justify immediate permanent removal, and noted that there were no intermediate options between permanent disablement and leaving the ordinary strikes system to run its course. Where mitigating factors exist, the Board suggested, “a significant but time-bound suspension may be more proportionate.”
On appeals, the Board was pointed. Many comments described reasons people did not understand and appeals denied within moments of submission. Ault's experience, as CBC News reported it, fits that description exactly: her case was closed within minutes of her pressing appeal, with no further appeal allowed. Appeals of account disablement, the Board wrote, “are not effective if they run the same decision through the same automated process, expecting different results with the same inputs.” It accepted that advances in AI should be used to make reviews more accurate and comprehensive, but said that “prioritizing of human review in edge cases will be important”, especially for “one and done” violations, “where any error in automated decision-making has very serious consequences beyond the removal of a post or imposition of a strike.”
It also set out what users should be able to see. It called for dashboards giving “reliable information on current account status, past violations, information on available appeal options, and the status of any pending appeals”, downloadable for record-keeping. It wanted clear, prominent and timely notifications, “in a language they understand”, specifying “the rule violated, the sanction imposed and options to appeal”. It asked that users be told about “the role of automation in the review of content or behavior and the imposition of warnings or penalties”, and that people who lose access through permanent disablement can still reach the reasons and appeal mechanisms. Meta said it welcomed the decision and would respond to the recommendations after reviewing them.
Set beside Ault's account, the Board's framework reads like a checklist of what she says she did not get.
Europe Has Already Written Down What an Appeal Owes You
For users in the European Union, much of this is not aspirational. It is law, under the Digital Services Act.
Article 17 requires hosting services to give “a clear and specific statement of reasons” to anyone whose account is suspended or terminated. That statement must include the facts and circumstances relied on, and information on the use made of automated means in taking the decision. A line saying an account “doesn't follow our rules” would struggle to meet that standard.
Article 20 requires online platforms to provide, for at least six months after a decision, “an effective internal complaint-handling system” that lets people lodge complaints “electronically and free of charge”, including against decisions to suspend or terminate their account. Complaints must be handled “in a timely, non-discriminatory, diligent and non-arbitrary manner”, and where the complainant's conduct does not warrant the measure, the platform must reverse its decision “without undue delay”. Crucially, the platform must ensure that these complaint decisions “are taken under the supervision of appropriately qualified staff, and not solely on the basis of automated means.” The law does not ban AI from the process. It bans AI from being the whole of it.
Article 21 opens a door outside the platform. Users can take disputes to a certified out-of-court dispute settlement body, which should decide within 90 days, extendable to 180 for complex cases. If the body finds for the user, the platform pays the fees; if it finds for the platform, the user does not cover the platform's costs unless they acted in bad faith. The catch is that these bodies cannot impose a binding settlement.
Data protection law adds another layer. The General Data Protection Regulation gives people a right of access to their personal data and a right to portability, receiving what they provided “in a structured, commonly used and machine-readable format”, normally within one month. Article 22 protects people from decisions “based solely on automated processing” with legal or similarly significant effects and, where exceptions apply, guarantees a right “to obtain human intervention” and to contest the decision. Whether a given ban meets that threshold is a legal question, but the principle is unmistakable.
Canadians have a version of the access right too. Under the Personal Information Protection and Electronic Documents Act, organisations must answer access requests in writing within 30 days, with limited extensions, and individuals can complain to the Office of the Privacy Commissioner of Canada. For someone whose memories are trapped in a disabled account, that is a lever that exists independently of any chatbot.
The Independent Referee With an Empty Evidence File
The most revealing evidence about how these systems work in practice comes from the referee. Appeals Centre Europe, an out-of-court dispute settlement body certified by Ireland's media regulator, Coimisiún na Meán, and set up with a one-time grant from the Oversight Board Trust, began operating in late 2024 and now covers platforms including Facebook, Instagram, TikTok and YouTube. When it began handling account suspensions in 2025, its chief executive, Thomas Hughes, said: “Losing your social media account is more than an inconvenience, it affects people's lives in fundamental ways.”
In May 2026 the centre published data covering April 2025 to March 2026. As reported by RTÉ, it received more than 24,000 disputes, of which more than 12,000 were within scope. Where it reviewed decisions, it disagreed with the platforms 59 per cent of the time. On account suspensions, the figures were starker still. It had received more than 5,000 eligible disputes from users challenging suspensions, but by the end of March 2026 had made decisions after actually receiving the relevant content in fewer than 150 of them. In the rest, the platforms did not supply the material, and the centre issued “default decisions” in the user's favour. Its decisions are not binding, and the centre said it was aware of only a handful of cases where platforms had implemented its decisions on harmful content.
Independent review works only if the reviewer can see the evidence, and a legal right to escalation can fail in practice if the platform does not engage. The infrastructure for a fair appeal can exist on paper and still leave a locked-out person with nothing.
Britain and Canada Are Still Catching Up
Outside the EU, the protections are thinner. The United Kingdom's Online Safety Act 2023 requires user-to-user services to operate complaints procedures that are “easy to access, easy to use (including by children) and transparent”. Section 21 includes complaints from users who have been warned, suspended or banned, but only where that action results from content the provider considers to be illegal content. A ban for breaching a platform's own terms of service, rather than for illegal content, sits largely outside that specific duty.
Canada, where Ault lives, has no equivalent framework in force. In June 2026 the federal government introduced Bill C-34, the Safe Social Media Act, which would create a Digital Safety Commission and impose duties on platforms around seven categories of harmful content, including content that sexually victimises children, incites violence or foments hatred. The government's published summaries require “accessible reporting and complaint mechanisms” and give the commission a role in handling user complaints about harmful content. They do not, in the material the government has published, set out a specific right for users to appeal account disablement or to have such an appeal decided by a human. According to LEGISinfo, Parliament's official bill-tracking service, the bill is at second reading in the House of Commons and has not yet been referred to committee, so that gap could yet be addressed.
What an Effective Appeal Actually Looks Like
Pull together the Oversight Board's principles, the DSA, data protection law and the experience described in the Canadian Press report, and a clear picture emerges of what an effective appeal must include when AI sits at the front door. None of it is exotic.
The first element is notice with a specific reason. A person should be told, at the moment of enforcement and in plain language, which rule they are said to have broken, what the sanction is, how long it lasts and how to challenge it. If the decision was triggered by an automated system, they should be told that too. “Doesn't follow our rules” is not a reason. It is a refusal to give one.
The second is access to the evidence, as far as safety allows. A user cannot contest a decision about content they cannot identify. Where the trigger was a post, a message or a login pattern, the appeal should show what was relied on. Disclosure that would compromise a child exploitation investigation or tip off a fraud ring is a legitimate limit, but it should be an exception, not the default. The Appeals Centre's experience shows how far the default currently leans towards secrecy.
The third is a real opportunity to make one's case. The Oversight Board insists on the chance to submit written reasons, with continued access to the policy justification and any relevant exceptions. A drop-down menu and a “submit” button is not that. An AI assistant can help people understand the rules and structure an appeal. Its job should be to prepare the case for a decision-maker, not to be the decision-maker in the hardest cases.
The fourth is a guaranteed human decision for serious sanctions. Permanent disablement of a long-standing account is the platform equivalent of capital punishment for a digital identity. The DSA already requires that complaint decisions are not taken solely by automated means, and Meta's own March 2026 announcement says humans remain key in appeals of account disablement. What is missing is visibility. People should be told, in the decision itself, that a named role (not necessarily a named individual) reviewed their case, and on what basis.
The fifth is predictable timelines. An appeal that may take a day or six months is useless to someone whose income depends on their account. Platforms should publish target times, show users where they are in the queue and report on whether targets are met.
The sixth is preserved access to one's own data during the dispute. Losing access to a platform should not mean losing one's photographs, messages and contact lists for the duration of a months-long appeal. Meta's own help pages say users “may be able to request a download” of their information from the notification screen, but the Oversight Board recorded many users saying they could not. Data export during suspension should be a default, subject only to narrow, specified exceptions such as material that is itself illegal.
The seventh is escalation that leads somewhere independent. Internal appeals will always carry a structural conflict of interest. Users need a clearly signposted route beyond the platform, whether that is a DSA-style dispute settlement body, a regulator's complaints function or an ombudsperson, with the power to see the evidence and a platform that is obliged to engage.
Enforcement That Does Not Have to Be All or Nothing
The second question is harder: how do platforms keep enforcement strong without making review impossible? The answer is to stop treating account action as a single switch with two positions, on and gone.
Graduated enforcement is the obvious starting point. The Oversight Board itself observed that Meta lacked intermediate options between permanent disablement and its ordinary strikes system, and suggested time-bound suspensions where mitigating factors exist. A spectrum of measures, from restrictions on posting or messaging, to temporary suspension, to permanent removal, lets a platform act immediately on a risk while matching the long-term sanction to the confidence and seriousness of the finding.
Read-only and data-only modes are the second tool. When a platform suspects compromise, as Ault believes happened to her, it can freeze outward activity without erasing the owner's access to her own past. A frozen account cannot scam a contact list, but its owner can still see and export her photographs and messages. Where the suspected violation is the gravest kind, read-only access may be inappropriate, but such cases are a subset of disablements, not a reason to treat every case as one.
The third tool is separating the security question from the conduct question. “Is this the real owner?” and “Did this account break the rules?” are different problems, and conflating them hurts everyone. If an account appears to have been hijacked, the right response is a security recovery process with strong identity checks, such as the optional selfie video verification Meta now offers, plus notifications to the owner's known contact points of the kind NIST requires. Only once ownership is established does it make sense to ask whether the owner, rather than an intruder, did anything wrong. The High Touch Support breach shows what happens when a recovery path skips the first step.
Fourth, verification should unlock a route to a human, not replace one. If a person proves who they are through a government document or a live selfie, the platform has sharply reduced the risk of handing the account to an attacker. That is exactly the moment when a human reviewer becomes affordable and safe. The cruel irony of Ault's account is that she says she had done the paid verification step and still could not get past the chatbot. A verification-gated escalation path, honoured in practice, would answer the security objection to human support rather than ignore it.
Fifth, proportionality needs to be measured, not merely promised. The Oversight Board asked for transparency reports on account disablement that distinguish “one and done” removals from graduated enforcement and specify which rules drove them. Add overturn rates, resolution times and the share of decisions reviewed by humans, and outsiders can see whether the system works. Meta already publishes precision figures for content removal. It should publish the equivalent for accounts.
Finally, platforms should design for the worst week of a user's life, not the median one. Most support requests are trivial, and AI assistants handle them well. Account disablement is rare per user, devastating when it happens and, as the 2025 ban waves and the 2026 recovery breach showed, vulnerable to systemic error. That is exactly where human judgement and independent oversight earn their cost.
Making the Machine Answerable
It is tempting to cast AI support as the villain of Ault's experience, but that is not quite right. Nobody outside Meta knows what triggered the shutdown. What the chatbot represents is a support model built to resolve common cases cheaply and quickly, deployed in front of the rare cases where cheap and quick is the wrong answer.
Meta has said in writing that humans will play a key role in appeals of account disablement. The Oversight Board has said appeals must not re-run the same automated decision. The EU has made human supervision of complaint decisions law. An independent appeals body has shown that when platforms are asked to defend suspensions with evidence, they often do not. Every piece of a fair system exists somewhere. What is missing is the will to assemble them in front of the person who has just lost twenty years of her life and wants, above all, to be told why.
Giesler's framing is the right one. This is not a customer service problem to be optimised for response time. It is an accountability problem, and accountability means a reason you can read, evidence you can see, a person who can decide, a deadline that is kept and a referee who answers to neither side. A chatbot can help with every one of those steps. It cannot be allowed to stand in for all of them.
