A major new campaign of disinformation around Brexit, designed to stir up U.K. ‘Leave’ voters, and distributed via Facebook, may have reached over 10 million people in the U.K., according to new research. The source of the campaign is so far unknown, and will be embarrassing to Facebook, which only this week claimed it was clamping down on “dark” political advertising on its platform.

Researchers for the U.K.-based digital agency 89up allege that Mainstream Network — which looks and reads like a “mainstream” news site but which has no contact details or reporter bylines — is serving hyper-targeted Facebook advertisements aimed at exhorting people in Leave-voting U.K. constituencies to tell their MP to “chuck Chequers.” Chequers is the name given to the U.K. Prime Ministers’s proposed deal with the EU regarding the U.K.’s departure from the EU next year.

89up says it estimates that Mainstream Network, which routinely puts out pro-Brexit “news,” could have spent more than £250,000 on pro-Brexit or anti-Chequers advertising on Facebook in less than a year. The agency calculates that with that level of advertising, the messaging would have been seen by 11 million people. TechCrunch has independently confirmed that Mainstream Network’s domain name was registered in November last year, and began publishing in February of this year.

In evidence given to Parliament’s Digital, Culture, Media and Sport Select Committee today, 89up says the website was running dozens of adverts targeted at Facebook users in specific constituencies, suggesting users “Click to tell your local MP to bin Chequers,” along with an image from the constituency, and an email function to drive people to send their MP an anti-Chequers message. This email function carbon-copied an info@mainstreamnetwork.co.uk email address. This would be a breach of the U.K.’s data protection rules, as the website is not listed as a data controller, says 89up.

The news comes a day after Facebook announced a new clampdown on political advertisement on its platform, and will put further pressure on the social media giant to look again at how it deals with the so-called “dark advertising” its Custom Audiences campaign tools are often accused of spreading.

89up claims Mainstream Network website could be in breach of new GDPR rules because, while collecting users’ data, it does not have a published privacy policy, or contain any contact information whatsoever on the site or the campaigns it runs on Facebook.

The agency says that once users are taken to the respective localized landing pages from ads, they are asked to email their MP. When a user does this, its default email client opens up an email and puts its own email in the BCC field (see below). It is possible, therefore, that the user’s email address is being stored and later used for marketing purposes by Mainstream Network.

TechCrunch has reached out to Mainstream Network for comment on Twitter and email. A WhoIs look-up revealed no information about the owner of the site.

TechCrunch’s own research into the domain reveals that the domain owner has made every possible attempt to remain anonymous. Even before GDPR came in, the domain owners had paid to hide its ownership on GoDaddy, where it is registered. The site is using standard GoDaddy shared hosting to blend in with 400+ websites using the same IP address.

Commenting, Damian Collins MP, the Chair of the Digital, Culture, Media and Sport Committee of the U.K. House of Commons, said: “We do not know who is funding the Mainstream Network, or who is behind its operations, but we can see that they are directing a large scale advertising campaign on Facebook designed to get people to lobby their MP to oppose the Prime Ministers’s Brexit strategy. I have been sent a series of emails from constituents as a result of these adverts, in a deliberate attempt to alter the outcome of the Brexit negotiations.”

“The issue for parliamentarians is we have no idea who is targeting whom via political advertising on Facebook, who is paying for it, and what the purpose of that communication is. Facebook claimed this week that it was working to make political advertising on their platform more transparent, but once again we see potentially hundreds of thousands of pounds being spent to influence the political process and no one knows who is behind this.”

Mike Harris, CEO of 89up said: “A day after Facebook announced it will no longer be taking ‘dark ads’, we see once again evidence of the huge problem the platform is yet to face up to. Facebook has known since the EU referendum that highly targeted political advertising was being placed on its platform by anonymous groups, yet has failed to do anything about it. We have found evidence of yet another anonymous pro-Brexit campaign placing potentially a quarter of a million pounds worth of advertising, without anyone knowing or being able to find out who they are.”

Josh Feldberg, 89up researcher, said: “We have no idea who is funding this campaign. Only Facebook do. For all we know this could be funded by thousands of pounds of foreign money. This case just goes to show that despite Facebook’s claims they’re fighting fake news, anonymous groups are still out there trying to manipulate MPs and public opinion using the platform. It is possible there has been unlawful data collection. Facebook must tell the public who is behind this group.”

There is no suggestion that anything Mainstream Network or its backers have done is illegal, other than a requirement to comply with GDPR rules. Political communications in the UK are mostly unregulated outside election periods, except for registered political parties. There is no requirement to disclose funding sources or to reveal who paid for or promoted an advertisement.

TechCrunch has reached out to both Facebook and Mainstream Network for comment prior to publication and will update this post if either respond to the allegations.

UPDATE: Rob Leathern, director of product management at Facebook, told the Guardian: “On 7 November, all advertisers will have new requirements before they can place political ads in the UK, including Mainstream Network. “These advertisers will need to confirm their identity and location through an authorisations process and accurately represent the organization or person paying for the ad in a disclaimer. These steps must happen or the advertiser will be prevented from running ads related to politics on Facebook.”