Is Cloaking Illegal or Just Against Platform Policy?

Is cloaking a crime or a terms of service violation?

Usually, it starts as a terms-of-service problem. Google Ads says cloaking is not allowed under its circumventing systems policy, and Meta has publicly called cloaking a malicious technique and sued vendors that sold it. That makes the first hit contractual: rejected ads, disabled accounts, and lost access to spend.

The legal question comes later, after you ask what the tactic was hiding. If the hidden page is just a policy-violating destination, you may be looking at a platform enforcement file. If the hidden page is part of a false commercial story, the same setup can become evidence.

That is the floor.

The difference matters because platform rules are not criminal law. A platform can eject you for breaking its contract even when no prosecutor cares. It can also keep its own evidence, including landing-page diffs, redirect logs, and account history, which is often the first paper trail a plaintiff or regulator wants to see.

When does cloaking cross into fraud?

When cloaking is built to move money through a lie, the line is criminal. In the US, 18 U.S.C. § 1343 covers schemes to defraud, or to get money or property by false pretenses, when the scheme uses wires, radio, or television communications in interstate commerce. The statute carries up to 20 years, which is why the same tactic can be a ban in one case and a felony file in another.

Intent matters.

A landing-page split that only hides restricted content from a reviewer may still be a platform violation without a criminal case. Once the split is used to sell a fake offer, conceal a bait-and-switch, or route payments on the back of a false claim, the facts change. The paper trail matters too: invoices, chat logs, pixel edits, payout splits, and who asked for the cloaked version.

A buyer clicks a supplement ad, the reviewer sees a neutral article page, and the user lands on a checkout page for a different product with a recurring charge. If the hidden page was built to sell that switch, the issue is no longer a neat policy dispute. You are looking at a deceptive sales mechanism, not a harmless routing trick.

How do the FTC and consumer protection law treat it?

The FTC treats the consumer-facing deception as the issue. Under its guidance, an ad is deceptive when it contains a material misrepresentation or omission likely to mislead a reasonable consumer, and format counts as part of the message. The FTC's Native Advertising Guide is explicit about that point: if the commercial nature of content is hidden, the format itself can mislead.

Format is evidence.

That is why the FTC talks about the net impression, not just isolated lines of copy. A clean headline does not save a page if the overall presentation suggests editorial content, a comparison tool, or a product review when the page is really paid promotion. The agency also makes clear that affiliates and ad networks can matter if they help create or present the deception.

So the question is not whether your redirect is clever. The question is whether the consumer was supposed to understand the commercial nature of what they were seeing, and whether you hid that fact in the path between click and sale. That is where the civil case gets traction.

How does the analysis differ across the US, EU and Brazil?

The split across the US, EU, and Brazil is real. In the US, you usually start with the fraud and consumer-protection facts; in the EU and Brazil, misleading presentation itself can trigger liability faster. The same cloaked page can be a platform ban in one file, a civil consumer-law problem in another, and a criminal file only when the money trail and intent line up.

That split matters.

Here is the short version:

In the EU, Article 6 and Article 7 are broad enough to catch both false presentation and omission. A trader can cross the line by hiding material information or by presenting it in an unclear, unintelligible, ambiguous, or untimely way. Brazil is blunt in a different way: Article 37 prohibits misleading advertising, and Article 38 puts the burden of proving truth and accuracy on the sponsor.

The Meta Ad Library is still useful. It is bad at proving a live funnel, but it is good for date-stamped declared creatives, naming patterns, spend cadence, and the repeated shell that points to a regulated-niche advertiser. Meta has publicly described cloaking as hiding the true landing page from its systems, which is exactly why the archive often records the decoy, not the destination.

Useful, just not decisive.

Archive depth is mostly dead weight. What matters is what is scaling this week.

What civil liability can a platform pursue?

A platform can usually pursue contract remedies before anyone files a lawsuit. Google says cloaking is not allowed under its policy, and platforms can reject the ad, suspend the account, terminate the business relationship, or withhold access to inventory that was earned under the violated terms. If the contract gives them indemnity or fee-recovery rights, they can press those too.

The contract controls.

• Reject or disapprove ads.
• Suspend or terminate accounts.
• Freeze payouts where the terms allow it.
• Seek damages, injunctions, or arbitration if the terms support that path.

Meta has publicly used litigation against cloaking vendors. That does not make every banned advertiser a defendant, but it tells you where the platform sees the line: not as a clever optimization, but as abuse of the review system. Once the platform can show deception plus breach, civil remedies become much easier to frame.

The practical point is simple. A platform does not need a criminal case to hurt you. It needs terms, logs, and proof that your route was built to hide something material from its review process.

Does the affiliate share liability with the operator?

Yes, the affiliate can share liability with the operator. The clean split people like to imagine rarely survives emails, payout sheets, and edit access. If you knew the page was cloaked, helped write the copy, approved the landing page, or kept promoting after warning signs, you can sit inside the same factual story.

Knowledge is the hinge.

Courts and regulators tend to look at control, benefit, and awareness. Did you select the angle? Did you supply the bridge page? Did you split traffic across accounts to hide the trail? Did you get paid more when the user saw a different page than the reviewer saw? Those details matter more than the title on the PayPal memo.

• Shared logins or hosting.
• Repeated edits after complaints.
• Messages about staying hidden from review.
• Payout splits tied to the cloaked version.

If you are only forwarding traffic and you truly do not know what the operator is doing, your exposure is lower. It is not zero. The moment the evidence shows willful blindness or active help, the defense gets thin fast.

What does this mean for researching versus running a cloaker?

If you are researching, stay on the public side. Read live ads, public landing pages, and your own test account. Do not probe hidden routes or try to imitate a review system you do not control. The useful habit is simple: log what a normal user sees this week, not what a 6-month archive once showed.

Weekly beats ancient.

A manual sheet still wins here because it records the moving parts: ad ID, date, device, geo, redirect chain, final URL, and a screenshot. That is boring, and it works. Manual monitoring works, and almost nobody keeps doing it.

• Save the ad ID and page title.
• Capture the H1 and final URL.
• Record the redirect chain.
• Screenshot the page from a clean browser.
• Compare this week against last week.

That workflow tells you whether the page is stable, whether the shell changed, and whether the offer is still live. It also tells you when automated spy tools are lying to you because they are only seeing the decoy. If you are running the cloaker instead of studying it, your risk is real.

FAQ

Is cloaking always illegal? No. Often it is not. The criminal step usually appears when the cloak is part of a scheme to mislead buyers or regulators and to move money or property through wires. If you only have a policy breach, the platform may be the first and only actor that moves.

Can a platform ban me before a regulator acts? Yes. Platform bans arrive first. A rejected ad, suspension, or loss of access can follow long before any regulator opens a file, because the contract usually gives the platform broad enforcement rights against deceptive or evasive behavior, and those remedies do not require a criminal charge.

What proof changes the analysis? Intent changes everything. If you knew the page was hidden, helped build it, or kept selling after warnings, the risk rises fast. Regulators and plaintiffs look for messages, edits, payments, and control, not just the title on your invoice.

Is the Meta Ad Library enough? No. It is a map, not the territory. The Meta Ad Library is useful for timing, naming patterns, and recycled shells, but it cannot prove what a user saw after the click, which is the part that matters when cloaking is in play.

What should I do if I am only researching? Public research is safer. Use live pages, your own test account, and dated screenshots, then compare this week to last week. If you start trying to imitate or bypass a review system, you are no longer studying the funnel.

Frequently asked questions

Is cloaking always illegal?

No. Often it is not. The criminal step usually appears when the cloak is part of a scheme to mislead buyers or regulators and to move money or property through wires. If you only have a policy breach, the platform may be the first and only actor that moves.

Can a platform ban me before a regulator acts?

Yes. Platform bans arrive first. A rejected ad, suspension, or loss of access can follow long before any regulator opens a file, because the contract usually gives the platform broad enforcement rights against deceptive or evasive behavior, and those remedies do not require a criminal charge.

What proof changes the analysis?

Intent changes everything. If you knew the page was hidden, helped build it, or kept selling after warnings, the risk rises fast. Regulators and plaintiffs look for messages, edits, payments, and control, not just the title on your invoice.

Is the Meta Ad Library enough?

No. It is a map, not the territory. The Meta Ad Library is useful for timing, naming patterns, and recycled shells, but it cannot prove what a user saw after the click, which is the part that matters when cloaking is in play.

What should I do if I am only researching?

Public research is safer. Use live pages, your own test account, and dated screenshots, then compare this week to last week. If you start trying to imitate or bypass a review system, you are no longer studying the funnel.