Ad Cloaking vs URL Cloaking: The 2026 Policy Line

The mix-up that costs advertisers their accounts every week

Walk into any paid-media Discord and ask whether you can use cloaking on Facebook. Inside five minutes you'll have two contradictory answers — both confident, both half right, both dangerous. The reason is simple: the people answering aren't talking about the same thing.

"Cloaking" describes two completely unrelated practices that share nothing but a name.

• URL cloaking (also called link cloaking, affiliate link cloaking, link masking) — hiding a long, ugly URL behind a clean branded short link on your own domain. Broadly legitimate. Permitted by Meta, Google, TikTok and every major affiliate network. Basic hygiene for any affiliate or media buying operation.
• Ad cloaking (also called deceptive cloaking, page cloaking, white page / black page) — showing one landing page to the platform's review bots and a different one to real people. Explicitly prohibited by Meta's circumventing systems policy, Google's Misrepresentation policy and TikTok's equivalent clauses. The single largest source of permanent bans in 2026.

Conflating the two is the most common reason behind "my account got banned and I don't know why." The media buyer believes they're doing the legitimate version — URL cloaking — while the tool or service they've bought has quietly crossed the line into the prohibited one. They find out when the warning email lands.

This piece draws that line. For the broader ad review approval picture, see the complete Facebook ad approval guide. For the hands-on side of URL cloaking, see the practical URL cloaking guide. For Facebook specifics, see the complete Facebook cloaking guide.

The two, side by side

The one question that settles it

Answer this correctly and you'll never confuse the two again:

If a real person and a platform reviewer both click your ad link, will they see materially different content?

• No — both see the same thing, no matter how complex your routing → URL cloaking, or clean infrastructure. Legitimate.
• Yes — the reviewer sees one page, the human sees another → ad cloaking. Violation.

That question cuts through every layer of apparent complexity. You are free to:

• Run sophisticated bot detection ✓ (users and bots go to different pages, but a bot isn't a person — the comparison that matters is against humans)
• Route by country ✓ (EU users get the EU-compliant version, US users the US-compliant one; every real person gets the build made for their market)
• A/B test landing page variants ✓ (different users see different variants of the same offer; the reviewer sees one of them and approves it)
• Cloak affiliate link parameters ✓ (user and reviewer land on the same destination; only the URL prefix differs)

Every one of those sits on the legitimate side of the line — because none of them shows the reviewer a different offer.

What clean cloaking infrastructure actually does

Clean cloaking platforms — the category covered in cloaking website tools compared for 2026 — exist to solve three legitimate technical problems. Not one of them violates platform policy.

Bot vs human routing

Somewhere between 30% and 60% of the traffic hitting a typical paid-media landing page isn't human: crawlers, ad network bots, competitor research tools and, yes, some platform review probes. A clean cloaking layer identifies that traffic and routes it to a non-monetizing fallback page.

Why isn't that deception? Because the bots being filtered aren't the review bots. They're third-party scrapers and scanners. The platform's own review bots are routed to the same content real people see. The fallback page exists for the machine traffic polluting your conversion data, not for the platform's review system.

The distinction matters enormously. The moment your "bot filtering" includes Meta's known reviewer IP ranges, you've crossed into deceptive cloaking. A clean implementation explicitly lets platform reviewers through to the real content.

Geo routing

The same product needs a different compliance layer in every market. EU users need a GDPR consent flow. California users need CCPA disclosures. UK users in regulated verticals need specifically worded compliance language. Brazilian users buying a financial product need a CVM disclaimer.

Serving each market the version of the offer built for that market isn't deception — it's compliance. When a reviewer crawls from a given IP, they're routed to the build for that IP, using the exact same routing logic applied to real humans on that IP.

Source / channel routing

Someone who clicked a Meta ad and someone who arrived from organic search need different post-click experiences — not a different offer, but a creative bridge that matches. A Meta click expects continuity with the ad creative; an organic visitor expects continuity with their search query.

Routing on ?utm_source=fb versus no UTM is standard practice and isn't cloaking under any reasonable definition. A reviewer clicking from a known Meta context sees the Meta version of the landing page — the same thing a real Meta user sees.

What deceptive ad cloaking does (and why it died in 2024)

The classic deceptive pattern, sometimes called "white page / black page":

• Build two pages on your domain: a "white" page (harmless content — a recipe blog, tech news, a yoga retreat) and a "black" page (the actual offer — poker, crypto pumps, nutra with inflated claims, sweepstakes scams).
• Build a router that inspects every inbound request. Anything that looks like a platform reviewer — known IP ranges, known user agents, known browser fingerprints — gets the white page. Everyone else gets the black page.
• Submit the ad with the white page URL. The reviewer crawls it, sees harmless content and approves. Real people click and land on the black page.
• The ad runs, and you collect conversions on the black page offer until it blows up.

That worked from roughly 2016 until the end of 2023. It stopped working because Meta and Google both rebuilt their review systems:

• Multi-IP crawling. Review bots now crawl from many IPs, including residential ones indistinguishable from real users'. IP-based detection no longer reliably answers "is this a reviewer?"
• Full JS execution. Reviewers run as complete browser sessions with JavaScript, cookies and storage — fingerprint-identical to a human session.
• Randomized re-crawl intervals. Reviewers re-crawl pages on unpredictable schedules from rotating IPs, so a page that cleared initial review gets re-checked weeks later.
• Click telemetry reconciliation. Meta already knows what users see after the click, from Pixel events. If those events reveal a material difference from what the reviewer crawled, the discrepancy alone raises the flag — no re-crawl required.

By 2025, white page / black page cloaking was being caught within 30 days of launch at close to a 100% rate. The 2026 reality: it's a permanent-ban trigger, not a viable operating technique.

Where the line sits on the three big platforms

The line is the same everywhere. Only the wording changes.

Meta (Facebook + Instagram)

Prohibited under Meta's circumventing systems policy. The operative language covers inauthentic behavior — engaging in, or claiming to engage in, the use of Meta technology to mislead people about who you are or what you're doing.

Detection: reviewer crawls, plus Pixel telemetry reconciliation, plus Ad Library scraping. Enforcement: ad rejection plus a circumventing systems warning, escalating to a permanent ban on the third strike. See the Meta circumventing systems warning recovery playbook.

Google Ads

Prohibited under the Misrepresentation and Compromised Site policies in the Google Ads policies. The specific clause sits under unacceptable business practices, defining cloaking as manipulating the destination so that specific users are shown content different from what the ad reviewer sees.

Detection: reviewer crawls, plus the Google Safe Browsing database, plus occasional manual spot checks. Enforcement: ad disapproval plus an account-level Misrepresentation strike, escalating to suspension.

TikTok For Business

Prohibited under the general fraud and misleading-content clauses of TikTok's advertising policies. Enforcement is less mature than Meta's or Google's, but it's closing the gap fast in 2026.

Detection: reviewer crawls plus behavioral pattern detection. Enforcement: ad rejection plus account-level restrictions. The appeal path is shorter than Meta's, but the reversal rate is lower.

Clean infrastructure in practice: the Smart Cloak architecture

DeepClick's Smart Cloak is a working example of clean cloaking infrastructure — built specifically to handle the legitimate routing problems (bot filtering, geo overlays, source-aware landing page variants) while being architecturally incapable of showing platform reviewers something different from what real people see.

The architectural choices that keep it on the right side of the line:

• Reviewer IPs are whitelisted to the real content, not routed to a "safe" fallback. When a Meta reviewer crawls, they're served the same content a real user in the same region gets.
• The router's decision tree is auditable. Every request logs its routing decision and the reason behind it, so if you ever need to appeal, you can produce evidence that the reviewer saw what users saw.
• There is no white page capability at all. The platform is architecturally unable to serve reviewers and users different offers. It serves one offer; what varies is fraud filtering and geo overlays.

For anyone running grey verticals who has to solve compliance, bot filtering and multi-market routing at the same time, that architecture is the difference between sleeping through the night and being woken at 2 a.m. by another ban email.

Decision tree: is your current setup safe or exposed?

Walk your current landing page routing through these questions.

• Do you have a "page A for reviewers / page B for users" architecture?
• Yes → you're doing deceptive cloaking. This will get you banned, quite possibly with a circumventing systems escalation attached.
• No → continue.
• Does your bot filtering include the platforms' known reviewer IPs?
• Yes → you're calling it "bot filtering" but you're filtering reviewers. That's deceptive cloaking. Remove the platform IP ranges from the filter.
• No → continue.
• When a platform reviewer crawls your landing page, do they see the same offer — product, claims, CTA — that a real user sees?
• Yes → you're on the clean side. Your routing layer can still filter crawlers, overlay geo compliance and A/B test creative. All legitimate.
• No → you're cloaking. The "real" offer might be 100% legal on its own, but showing the reviewer something else is the policy violation.
• If a platform reviewer asked you to "show us what a user in [country] sees right now when they click this ad," could you produce screenshots and logs proving it matches what the reviewer crawled?
• Yes → your appeal evidence is one query away. Good.
• No → the day you need to appeal a cloaking flag, you'll have nothing. Build the audit log capability before you need it.

If you're already on the wrong side

If that audit puts you inside the deceptive cloaking bracket:

• Stop now. The longer it runs, the more behavioral evidence accumulates against the account.
• Rebuild the landing page architecture. Move to a single unified content layer plus legitimate routing: geo, source, and bot filtering that only filters crawlers.
• Wait 14 days before any new ad activity, then submit with the clean new architecture. That's the cooldown window for Meta's clustering algorithm.
• If the account is already flagged, the 7-day Facebook ad account ban recovery playbook and the circumventing systems warning recovery playbook walk through the specific appeal and recovery sequences.

FAQ

Is URL cloaking legal on Facebook ads?

Yes. Hiding a long affiliate URL behind a clean branded short link on your own domain is broadly permitted. Full walkthrough in the practical URL cloaking guide.

Is ad cloaking legal?

Ad cloaking — showing reviewers and users different content — is legal in code. It doesn't break the law in most jurisdictions. But it violates the terms of service of Meta, Google and TikTok, and the consequence is an account ban. Legally permitted, operationally fatal.

Can you use cloaking software for Facebook ads?

It depends entirely on what the software does. Software that handles bot vs human routing, geo overlays and source-aware landing page variants, and never shows reviewers different content? Fine, widely used, no issue. Software with a "this page for reviewers, that page for users" feature? Stay away — you're one detection away from a circumventing systems warning.

Can an ad cloaker get you through ad review?

Yes, used correctly. The "ad cloaker" tool category contains two very different things: (a) legitimate cloaking infrastructure — bot detection, geo routing, source detection — which is entirely fine on compliant offers, and which is where DeepClick's Smart Cloak sits; and (b) deceptive cloaking (white page / black page), which died in 2026 terms and carries permanent-ban risk the first time it's caught. Until you can tell the two apart, don't touch anything marketed as a magic "approval hack."

How does Meta detect cloaking?

Three main mechanisms in 2026. First, reviewers crawling from residential IPs in full browser sessions. Second, Pixel telemetry reconciliation — comparing what users see after the click against what the reviewer saw on the crawl. Third, Ad Library scrapers run by outside researchers, whose findings feed back into Meta enforcement. Any one of them catches most cases; together they catch essentially all of them within 30 days.

Is cloaking the same thing as a sales funnel?

No. Sales funnels — ad, then a pre-sell page, then the real offer page — are permitted, provided the funnel is internally consistent. The pre-sell page and the real offer belong to the same offer narrative, and the reviewer can crawl the whole funnel. Cloaking is when the funnel's destination depends on who's clicking, and the reviewer is routed away from the real destination.

Is geo routing the same as cloaking?

No, as long as the routing is based on what real users in that region see. A reviewer crawling from a Brazilian IP who lands on Brazil-compliant content identical to what real Brazilian users get is compliant routing, not cloaking. You cross the line when a reviewer in any region sees a different offer than real users in that region.

Can a cloaking-related ban be appealed?

Sometimes. Your appeal evidence has to be screenshots of the landing page as real users in the relevant region see it, alongside screenshots of what the reviewer crawled, demonstrating that they match. If they don't match, there's no defense to mount. The audit log and screenshot capability has to exist before the ban — see question #4 in the decision tree above.

Does using a CDN count as cloaking?

No. A CDN edge caches and serves everyone the same content, just from a geographically closer server. Reviewers and users see identical content; only the latency and origin IP differ. CDNs are universally permitted.

What if I'm not cloaking but Meta thinks I am?

Appeal with screenshots and audit log evidence showing that reviewers and users see the same content. False-positive cloaking flags are reversible when you have proof; without proof, appeals usually fail, because you can't prove a negative. Building audit log capability in advance costs far less than one evidence-free false-positive ban.