Cloaking in Affiliate Marketing: What It Is and How It Works in 2026

Cloaking is one of the most discussed topics in affiliate marketing and one of the riskiest. One click sees a harmless page, another sees the real offer, and the decision takes tens of milliseconds. Here is what actually happens at the click level, which signals a filter uses, how ad platforms detect the switch, what it costs an account and a domain, and when the same job can be done with legitimate personalization. This is an educational piece: cloaking violates Google and Meta policies, so we explain the mechanics and risks rather than provide a playbook for evading moderation.

What is cloaking in simple terms?

Cloaking is showing different content to different visitors through the same link. The ad platform, its crawler and its reviewer see one page, while a user in the target geo sees another. In search, cloaking is used to manipulate rankings; in advertising, it is used to push an ad through review and show users something the rules prohibit.

Technically, cloaking is a filter between the ad link and the site. It evaluates every visit and decides where to send the person: to a white page that will satisfy the reviewer, or to a black page with the offer. There is no magic here: a set of rules, IP databases, geolocation, browser fingerprints and sometimes machine learning.

Do not confuse cloaking with personalization. Personalization changes the presentation, language, currency or block order but offers the same product on the same terms. Cloaking hides the offer itself from the person who is supposed to review it. That is what makes it a violation rather than conversion optimization.

White Page and Black Page: how the setup works

The industry uses two terms. A White Page is the safe page seen by moderators, ad platform crawlers, platform staff and sometimes spy services. It has to look legitimate and at least loosely match the ad. A Black Page is the pre-lander or offer seen by real users. A filter sits between them and makes the decision.

The more the white and black pages differ in meaning, the higher the risk. If the ad promises “investments”, the moderator sees a finance article and the user sees a casino, that is not a minor mismatch but obvious substitution. Platforms compare not only the link but the creative, ad copy, domain and audience behavior.

How traffic filtering works

A filter collects signals about the visitor and checks them against its rules. The more independent signals, the more accurate the decision — and the more expensive the mistake: too strict a filter cuts real users, too loose a filter lets reviewers through.

Integration can be server-side or client-side. In the first case the decision is made before the HTML is served, on the hosting side through a PHP script or a separate service. In the second, it happens after the page loads, through JavaScript. Server-side is faster and more reliable for review checks; client-side yields more browser data. Strong services combine both, but neither changes the core fact: the white and black pages still exist, and sooner or later someone will compare them.

Types of cloaking

• Geo-cloaking. Users in some countries see one version, users in others see another. Often disguised as a “local version”.
• Device cloaking. Different pages for mobile and desktop. Reviewers more often check from a computer, so mobile traffic goes to the offer.
• Referer cloaking. The site checks where the visitor came from: an ad, search, bookmarks or direct.
• Time-based. One version at night or on weekends, another during working hours when review is more likely.
• Behavioral. The filter evaluates mouse movement, click speed and session depth, not just technical parameters.
• JS and fingerprint. JavaScript checks canvas, WebGL, fonts, screen parameters and automation flags.
• AI/ML cloaking. A model scores hundreds of signals and outputs the probability that “this is a reviewer”. Modern filtering services work this way.

All types share one thing: the user is shown something the reviewer does not see. A smarter filter does not make the scheme legal; it only makes detection harder.

How cloaking differs from geo redirects and A/B tests

The line is drawn by one question: can the reviewer see the same thing the user sees? If yes, it is personalization. If no, it is cloaking. That is why an “honest” geo redirect that changes only language and currency is not substitution, while a redirect from a finance landing page to a casino is.

How platforms detect cloaking

Ad platforms do not have a single “cloaking detector”. They combine methods:

• Crawlers. Google, Meta and TikTok regularly visit ad links from different IPs, devices and geos. They maintain “clean” subnets and user agents for this.
• Manual review. Especially in sensitive verticals: finance, health, gambling, crypto. A reviewer opens the link, clicks through blocks and follows the path.
• Complaints. Users and competitors report mismatches between the ad promise and the page. One complaint rarely causes a ban; a pattern does.
• Creative-to-page comparison. If the ad shows one product and the page shows another, no filter is needed to spot it.
• Behavioral anomalies. A spike in “empty” clicks, a mismatch between platform and tracker stats, strange conversions.
• Payment and account signals. Cards, devices, account history and links between accounts can all speed up a review.
• AI crawlers. In 2026 platforms increasingly use models that behave like humans: scroll, click, compare text. Old “block data centers” rules stop working.

The practical conclusion: perfect cloaking does not exist. The more complex the filter, the more false positives — and the higher the chance that one day a reviewer sees the offer. The price of that failure is not a lost click but a blocked ad account, business manager and domain.

What cloaking costs you

Google classifies cloaking as a search spam technique and separately penalizes circumventing systems in ads. Meta prohibits misleading pages and circumvention of reviews. The wording differs, the result is the same: this is not “grey optimization” but a policy violation that can take down the entire infrastructure, not just one ad.

Legal classification depends on the country and the specific actions. In some cases it is a breach of contract with the platform; in others, unfair advertising or fraud. This is not legal advice, but before launching any scheme you should understand who is responsible and for what.

When you do not need cloaking: legitimate alternatives

The goal of “showing different things to different people” is normal. The problem starts where the reviewer is deceived. Here is what you can do without substitution:

• Honest geo-personalization. Change language, currency, payment methods and block order, but keep the same product and terms.
• A disclosed pre-lander. An intermediate page that explains the transition and does not hide the offer. It can convert as well as a “black” page.
• A/B tests. Test headlines, creatives and structure, not facts. You get data without a ban risk.
• Dynamic landing pages. Insert the city, language or campaign name into the copy. That is relevance, not substitution.
• Audience segmentation. Different creatives for different segments behind one honest page.
• Compliance audit. Check the landing page against platform rules before launch, not after a ban.

If an offer fails review, that is a signal to rebuild the setup: change the creative, the promise, the terms or the vertical. Masking does not solve the cause; it only postpones the outcome.

Checklist: personalization or cloaking?

Answer eight questions. If even one answer is “no”, the scheme is probably cloaking.

1. Do all visitors see the same offer and the same terms?
2. Can a platform reviewer see the offer if they follow the link?
3. Do the ad promise and the page copy match?
4. Does the content change based on IP, user agent or “reviewer” status?
5. Are price, timing and limitations clear without hidden redirects?
6. Is there a redirect that depends on geo or device?
7. Can you explain the personalization logic in two sentences?
8. Would you be comfortable showing the page to a platform representative?

How to spot cloaking: a note for advertisers

This section is useful not only for media buyers but also for brands, agencies and users who want to check a site.

• Open the ad link in a normal browser, incognito, on mobile and through a VPN in another country. Compare the content.
• Check the ad promise against the page: product, price, terms, timing.
• Inspect the redirect chain in developer tools: extra domains and substitutions are a red flag.
• See whether the page changes after the first click or a few seconds later.
• Look for complaints and reviews about the domain, but remember that their absence proves nothing.
• If you see a mismatch, report it to the platform: Google and Meta have forms for misleading ads.

If you are comparing filtering services

We do not recommend violating platform rules, but we understand the service market exists and people study it. If you compare tools, look at measurable things, not “100% bypass” promises:

• Transparency. Are there decision logs, rejection stats and clear documentation?
• False positives. What share of real traffic is lost on mobile carriers and VPNs?
• Speed. Filter latency adds to page load; hundreds of milliseconds cost conversions.
• Source support. Does the vendor explicitly support your platform and traffic type?
• Trial. Can you test on your own volume before paying?
• Reputation. Reviews, service age, willingness to show real cases.

A detailed comparison of pricing and features is in our separate review, “Cloaking for affiliate traffic: top 5 services”. You can also leave a review in the cloaking catalog.

FAQ

What is cloaking in simple terms?

It is showing different content through one link: a safe page to the reviewer and the real offer to the user. A filter evaluates IP, geo, device and behavior to decide.

What are White Page and Black Page?

White Page is the safe page for moderators and crawlers. Black Page is the pre-lander or offer for the target audience. The filter decides who sees which.

Is cloaking legal?

The term itself is not defined by law, but the actions may breach platform contracts, advertising rules and consumer rights. In some cases it is classified as unfair advertising or fraud. Get legal advice for your jurisdiction.

Will you get banned for cloaking?

Yes, the risk is high: ad, account, Business Manager, domain and payment method blocks. The more sensitive the vertical, the closer the review.

How is cloaking different from a geo redirect?

An honest geo redirect changes language, currency or payment method but keeps the same product. Cloaking hides the offer itself from the reviewer.

Do white offers need cloaking?

No. If the offer and landing page comply with the rules, filtering is unnecessary. Anti-fraud tools may protect against spy services and bots, but that is a different job.

Can you pass moderation without cloaking?

Yes, by bringing the creative and page into compliance, choosing an allowed vertical and running a compliance audit. It takes longer but does not put the infrastructure at risk.

How much does a cloaking service cost?

Expect tens to hundreds of dollars per month, depending on click limits, source, number of streams and support. Exact pricing is in the service review.

How do I check a site for cloaking?

Open the link from different IPs, devices and geos, compare it with the ad and inspect the redirect chain. If the content changes based on “reviewer” signals, it is cloaking.

What happens to the domain?

It can be blocked on the platform or added to blacklists. A new ad account does not always help: infrastructure and domain history matter.

Key takeaways

• Cloaking is page substitution for a reviewer, not personalization.
• The setup consists of a White Page, a filter and a Black Page.
• The filter scores IP, geo, fingerprint, behavior and referer.
• Platforms catch substitution with crawlers, manual review, complaints and AI models.
• The cost of a mistake is the account, Business Manager, domain and budget.
• The legitimate alternative is honest personalization, A/B testing and compliance.

To go deeper into the traffic infrastructure, start with the affiliate glossary, our guide to antidetect browsers and mobile proxies. If your account is already blocked, read the Facebook ban breakdown.