Cloaking and compliance are two different answers to the same problem: your offer sits in a category the ad platforms scrutinize. Cloaking shows reviewers one page and customers another. Compliance makes the page reviewers see the page customers see, with claims you can back up. Google, Meta and TikTok treat the first as a violation in its own right, and US regulators care about the second whatever a platform decides. This guide explains where the line sits, what each path costs you, and how we advise CBD, peptide, supplement, crypto and affiliate advertisers to choose.
TL;DR
- Platforms ban cloaking as a standalone offense. Google’s policy bars attempts to circumvent ad review, so a hidden page can cost you the account even if the product is legal.
- Cloaking never fixes a claim problem. The FTC and FDA judge what you say to consumers, not what a reviewer saw.
- Detection keeps improving, so an approval won through evasion is a liability that can be flagged later.
- The durable approach is a compliant, reviewable funnel: substantiated claims, required disclosures, valid licenses, clean tracking and account history.
- If you still need technical help in a restricted niche, buy a setup that stands up to a reviewer seeing everything, and be honest about the risk you are carrying.
Table of Contents
- What each term means in practice
- How the platforms treat cloaking
- Why cloaking does not solve the legal problem
- Side-by-side comparison
- The detection problem
- Policy drift: the failure mode that sinks good accounts
- A compliance-first checklist for restricted niches
- When the advertiser asks “but my competitors cloak”
- Our perspective
- Where our services fit
- How to decide
- FAQ
- Sources
What each term means in practice
Cloaking means serving different content depending on who is asking. A visitor flagged as a bot, a reviewer or a platform crawler gets a clean page. Everyone else gets the real offer. Detection can rely on IP ranges, device fingerprints, headers or behavior.
Compliance means the thing that gets reviewed is the thing that runs. The ad, the landing page, the checkout and the claims all conform to the platform’s policy and to the law that governs your product. For restricted categories this usually also means paperwork: certifications, licenses, age gates and disclosures.
The confusion comes from the fact that both aim at “approved ads.” But approval is an outcome, and the two methods produce very different risk profiles around it.
How the platforms treat cloaking
The rules are plain, and they are not softened for restricted verticals.
Google states that its ads policy doesn’t allow advertisers to trick or circumvent review processes through their ads, content or destinations. Its help page on suspensions says that cloaking means showing different content to different people or to Google to hide things that might break the rules. It is handled under the circumventing systems policy, not as a minor landing page error.
Meta’s Advertising Standards are the reference for what is allowed on Facebook and Instagram, and our research found Meta applies the same logic to any technique that limits access to the destination page for review. TikTok’s rules follow the same pattern. We cover the platform specifics on our pages about TikTok enforcement and Facebook compliance fixes.
Two consequences matter for planning:
- Circumventing systems is generally treated as a serious, account-level problem. It is not a one-ad disapproval you fix and resubmit.
- The violation is the behavior, not the product. A fully legal hemp brand can lose an account for cloaking, while the same brand with a straightforward page might only face a restricted-category review.
We lay out the business side of this in our note on cloaking risk and FTC scrutiny.
Why cloaking does not solve the legal problem
Platform bans are the visible risk. The quieter one is regulatory, and it applies in the US regardless of where your traffic is bought.
For CBD, supplements and many finance or health offers, the question is whether you can substantiate what you say. The FTC’s first law enforcement crackdown on deceptively marketed CBD products in December 2020 targeted sellers over claims about treating serious conditions. An earlier joint FTC and FDA letter to a Florida seller raised the same concern about unsubstantiated medical claims. A law firm summary of the joint crackdown describes the issues the letters raised, starting with general claims that CBD products diagnose, treat or prevent disease.
None of that depends on a platform reviewer. A regulator reads your live page. If the page that real customers see makes disease claims you cannot support, a clean page shown to a bot changes nothing, and it can make the story worse: you have documentation of a system built to show reviewers something else.
In short:
- Cloaking addresses who sees the claim.
- Compliance addresses whether you can make the claim.
Only the second protects you from the FTC, the FDA, state attorneys general and chargebacks.
Side-by-side comparison
| Factor | Cloaking-first approach | Compliance-first approach |
|---|---|---|
| Platform policy | Violates circumventing-systems rules | Within policy, subject to category restrictions |
| Ad account risk | Account-level suspension if detected | Ad-level disapprovals, fixable and appealable |
| Regulatory exposure | Unchanged, plus evidence of evasion | Reduced by substantiated claims and disclosures |
| Technical upkeep | Constant, detection is an arms race | Low once the funnel is clean |
| Account history | Can be flagged retroactively | Builds trust over time |
| Payment processors and partners | Often review the live page and traffic | Page matches what you told them |
| Scaling ceiling | Set by how long the cloak survives | Set by budget and offer quality |
The detection problem
People who sell cloaking often describe it as a settled technique. The security research says otherwise. Palo Alto Networks’ Unit 42 has documented how JavaScript-based evasion in phishing is being countered by dynamic code analysis and machine learning. That research concerns phishing rather than advertising, but the dynamic is the same one ad platforms face: evasion techniques get studied and countered.
For an advertiser the practical reading is this. An evasive setup leaves a trail of behavior: odd redirects, differing responses to different fetches, mismatched content. A platform that cannot catch it today may still be able to review stored data later. That is a judgment from the research, not a guarantee, but it is a reason not to treat a current approval as permanent. Our write-up on paired fetches and hidden destinations shows how reviewers compare what different requests receive.
Policy drift: the failure mode that sinks good accounts
The most common way restricted advertisers lose accounts is not one dramatic violation. A guide on business integrity describes “policy drift”: an advertiser gets approved through a workaround, then keeps ignoring the underlying requirements such as disclosures or valid credentials. Over time the account’s standing decays, so a minor later mistake triggers account-wide enforcement.
The flip side is useful. An account with a record of good-faith operation has some room for an honest error. That buffer is worth more than any single approval, and a cloaked funnel works against it.
A compliance-first checklist for restricted niches
Whether you run CBD, peptides, kratom-adjacent products, supplements, crypto or forex, this order of work holds up.
- Read the category policy first. Find out whether your product is prohibited outright, restricted with certification, or allowed with conditions. Prohibited means no technique makes it compliant.
- Audit every claim. Remove disease treatment, cure or prevention language you cannot substantiate. The FTC press releases above show what regulators look for.
- Match the funnel to the ad. The page a reviewer fetches should be the page a customer lands on, including pricing, subscription terms and shipping.
- Add the required disclosures and gates. Age verification, risk warnings for financial products, and clear business identity.
- Secure licenses and certifications where they exist. Some categories need platform-side approval before ads run. Our guide to the Google Ads license process covers that step.
- Separate risk. Keep ad accounts, domains and payment methods organized so that one disapproval does not spread to the rest of your operation.
- Track cleanly. Reliable conversion data helps you scale without chasing volume through risky shortcuts.
- Monitor and document. Keep records of approvals, appeals and policy changes. Platforms change rules often.
Our article on why audits beat cloaking in restricted industries goes deeper on steps 1 to 4.
When the advertiser asks “but my competitors cloak”
This is the objection we hear most. Three points help.
- Survivorship bias. You see the accounts that are still running. You do not see the ones that were suspended, which is most of the story.
- Different risk tolerance. Some operators run disposable accounts and treat suspension as a cost of doing business. If you have a brand, a merchant account and a customer list, that is not your model.
- Platform-specific differences. Affiliate offers, for instance, face their own review patterns. See our notes on affiliate ads compliance for what actually moves approvals.
If you are weighing a vendor that promises guaranteed approval with hidden pages, ask what happens to your account when the technique is detected, who carries that cost, and whether the vendor will put the live page in front of a reviewer.
Our perspective
We build cloaking systems, server configuration, safe landing pages and bot and reviewer detection for restricted verticals, so we do not pretend the technique does not exist. We also see the other side of it every week: accounts that were approved quickly and suspended later.
Here is what experience has taught us. The advertisers who last treat cloaking, if they use it at all, as a technical layer on top of a funnel that would survive a reviewer’s full inspection. They have substantiated claims, honest disclosures and tidy account structures. The advertisers who burn out used the technique to cover a page that could not be defended.
We will tell you plainly that platform policies prohibit showing reviewers different content, and that no vendor can remove that risk. What we can do is help you reduce it: audit the funnel, fix what is fixable, set up the infrastructure properly, and manage accounts with an eye on long-term standing instead of a single approval. If your product is prohibited outright, we will say so rather than sell you a setup.
— Umar
Where our services fit
If you are in a restricted category and want a second opinion before spending on ads, start with a consultation call on our main page. We look at your offer, your claims and the platforms you want to run on, and tell you what is realistic.
For teams that need infrastructure, the Setup Cloaking System service is $1,599 one-off. For hands-off execution, the Done-For-You engagement is $3,599 one-off. The consultation call has no published price. For category-specific detail, see our page on CBD, hemp and vape ad approval.
How to decide
Use these questions in order:
- Is the product allowed to be advertised at all? If not, stop.
- Can you substantiate every claim on the live page? If not, fix the claims before touching infrastructure.
- Could you comfortably show the live page to a platform reviewer? If yes, you may not need a cloak at all. If no, the page is the problem.
- What is the cost of losing the account? If it carries your brand history, pixel data and spend, lean hard toward compliance.
- Do you have a plan for appeals and policy changes? Ongoing management matters more than the first approval.
FAQ
Is cloaking illegal?
Cloaking is not automatically a crime, but it breaks the advertising policies of the major platforms and can bring account suspension. It can also aggravate legal exposure if the hidden content involves deceptive or unsubstantiated claims. For a legal opinion on your situation, speak to an advertising attorney.
What does cloaking mean in Google Ads?
Google describes it as showing different content to people or to Google in order to hide material that could break the rules. It is handled under the circumventing systems policy. Showing slightly different content for legitimate reasons, such as language or location, is a different matter.
Can a compliant page still get rejected in a restricted niche?
Yes. Some categories need certification or are limited by country, and reviewers can still disapprove an ad. The difference is that a disapproval on a transparent page can be appealed and corrected, while a circumvention finding usually threatens the whole account.
Does cloaking protect me from the FTC?
No. The FTC and FDA assess the claims real consumers see, as their CBD enforcement actions show. Hiding a page from a reviewer does not make an unsupported claim lawful.
Should I hire help for ad approval in a restricted niche?
If the product is allowed and you lack time or expertise, specialist help can save weeks. Look for a partner who audits your claims first, is open about platform risk and manages accounts after launch.
Sources
- Circumventing systems, Google Advertising Policies Help
- Why is my account suspended for cloaking, Google Ads Help
- Advertising Standards, Meta Transparency Center
- FTC announces crackdown on deceptively marketed CBD products
- FTC and FDA warn Florida company about CBD claims
- A Joint Crackdown from the FTC and FDA on Medical Treatment Claims from CBD Companies, Knobbe Martens
- JavaScript-based phishing, Unit 42
- Business Integrity 101