- Routing and delivery are two separate decisions. The first determines which version a visitor gets; the second determines how that version arrives. Most configurations only think carefully about the first.
- A 302 leaves an extra hop in the chain and ends on a URL that is not the one in the ad. That is explicitly visible in any external fetch, and it is the thing redirect-related policy text describes directly.
- Static render and proxy both keep the URL unchanged. They differ in where the bytes come from: a static file on your own domain, versus a live fetch from an upstream origin each time. The first is the most reproducible; the second introduces an upstream dependency.
- None of the three makes materially different content across two fetches compliant. Delivery method changes how hard the difference is to evidence and how expensive it is to explain. It does not move the policy line.
- The criterion is not which one is hardest to observe, but which one you can reproduce when something goes wrong. An architecture you cannot reproduce leaves nothing usable in a dispute.
Two separate decisions: who, then how
A routing system does two things on every request. The first is the judgement: does this visit satisfy the conditions you set — country, city, device class, operating system, browser, whether it arrives through a proxy exit, whether it carries the signature of headless automation, referring domain, presence of an ad click parameter, language, time window. Those conditions stack into one compound gate, and traffic reaches the real page only by clearing all of them. This part gets discussed at length; a full breakdown of the decision layer is in how cloaking architecture is put together.
The second thing is rarely discussed. Once the decision resolves to the compliant version, that page still has to arrive in the visitor's browser somehow, and the way it arrives is a choice independent of the decision logic. In most consoles it is a three-option dropdown on the link creation form, and it gets skimmed past. It determines what the whole path looks like from outside, and outside is exactly where every verification happens.
Method one: the 302 redirect
The mechanism is the plainest of the three. A request reaches your domain, the decision resolves, and the server returns a 302 — or a 301 or 307 — with a Location header pointing somewhere else. The browser then fetches that address. The compliant content is hosted elsewhere and your job is only to point non-qualifying traffic at it. It is the cheapest to implement and it is the default in most systems.
The cost is that it puts everything in plain sight. Any external fetch sees a hop, a status code, a Location header and a final URL that differs from the one in the ad. Observing that requires no particular sophistication; one curl flag shows the whole thing. Every additional hop adds another layer of observable surface, and how those chains get taken apart is covered in redirect chain analysis.
More consequentially, it sits where the policy text already points. Platform language about redirects describes exactly this shape: a click that lands somewhere other than what was represented. Whether a given instance breaches anything depends on the substance and the intent, but the fact that a redirect exists which sends different audiences to different endpoints falls inside what the text describes directly, with no inference required. That boundary is set out in doorway pages and sneaky redirects.
Method two: the static render
The URL does not change. A request arrives at your-domain.com/abc, the decision resolves to the compliant version, and the server returns HTML hosted under your own domain. The address bar never changes. There is no hop, no Location header and no second domain in the picture.
From a verification standpoint this is the cleanest of the three. The content is a fixed file you fully control, it returns identical bytes whenever asked, and in a dispute you can state precisely which file a given path returns under given conditions — and the other side can repeat the fetch themselves. Reproducibility is the only property that actually carries weight when a destination is questioned.
The limitation is that it can only be static. If the compliant page needs to track upstream changes, needs live data, or lives in another system entirely, this method does not apply. Static delivery also grants no exemption on the content itself: the file has to be a real, usable page consistent with what is being promoted, not a placeholder. What that page should actually contain is covered in safe page versus real page structure.
Method three: the proxy
The URL is again unchanged, but the content is not a local file. Each request is fetched from an upstream origin in real time and passed through to the visitor. The visitor sees your domain while the bytes come from elsewhere. It solves the static method's rigidity problem: when upstream changes, visitors see the change immediately.
The cost is a dependency you do not fully control, and one that produces differences in ways that are easy not to anticipate. The upstream has its own geo restrictions, its own bot filtering, its own cache tiers, its own A/B buckets. Any of those makes the same URL return different content at different moments for reasons that live nowhere in your rules. When an external check retrieves two mismatched responses, you need to be able to name which layer produced the difference — and if that layer is not yours, the cost of explaining it rises sharply.
One operational point gets overlooked: if the upstream fails or changes structure, your compliant page breaks with it, usually without an alert. A static file failing is explicit; a proxy failing tends to be quiet.
What each method looks like in a single external fetch
Put the three under the same lens and the differences are structural rather than a matter of degree. A 302 presents as multiple responses, a 3xx status, a Location header, and a final URL on a different domain or path from the starting one. A static render presents as a single 200, an unchanged URL throughout, and stable bytes that reproduce on demand. A proxy presents as a single 200 and an unchanged URL, but with bytes that may vary by time, region or upstream state for reasons not visible anywhere in your own configuration.
One thing here is routinely misread: an unchanged URL does not mean the arrangement is unobservable. It changes the shape of verification, not whether verification is possible. Fetch twice, fetch under different conditions, compare the content — that method applies equally to all three. What an unchanged URL actually buys is something else: when a difference turns out to be benign, such as two cache generations upstream, you have a clean path to demonstrate that, instead of first having to explain why a redirect exists at all.
The line that does not move
It needs stating plainly: none of the three delivery methods turns materially different content for verification and for real users into something compliant. That boundary is set by the substance of the content, not by the transport mechanism. Choosing static or proxy so the URL stays constant reduces observable surface on the path and removes some pointless explanatory overhead. It is not an exemption and should not be treated as one. The full mapping of the relevant terms is in where the red lines are.
Conversely, varying content on one URL is ordinary web practice when the variation stays inside what personalization covers — language, regional currency, layout adapted to the device, a different ordering for a returning visitor. That is a different thing from routing altogether, and where the two separate is set out in routing versus compliant personalization.
Choosing between them
The choice is settled by three constraints, not by which option is least visible. If the compliant page need not be dynamic, static gives the strongest reproducibility. If it lives outside your control, proxy is the only workable option, but budget for explaining upstream-induced differences and monitor upstream availability. And if there is no reason the URL must change, the extra hop and extra policy exposure a 302 brings are cost paid for nothing.
One requirement cuts across all three: whichever you pick, every visit should leave a retrievable record of source, decision and which version was actually returned. Without that record, any challenge can only be answered by assertion rather than evidence, and assertion does very little in a dispute. How to read that record is covered in reading traffic routing analytics.
FAQ
Does an unchanged URL make the arrangement unobservable?
No. The basic method is to fetch the same address more than once under different conditions and compare what comes back, and that applies equally to redirect, static and proxy delivery. An unchanged URL removes one observation — that an extra hop exists on the path — and removes nothing about content comparison. Treating it as an avoidance measure leads to poor architecture decisions.
Does it matter whether the redirect is a 302 or a 301?
It does, but not for the compliance question. A 301 is permanent and gets cached by browsers and intermediaries, which means a given client may stop reaching your decision layer at all and the outcome becomes unpredictable. A 302 is temporary and returns to the decision layer every time. For routing purposes the caching semantics of a 301 are almost always wrong. As to whether either constitutes a breach, there is no difference between them.
Under proxy delivery, can the upstream's own bot filtering create problems for me?
It can, and it is the most common source of surprises here. The upstream sees your proxy egress rather than the original visitor, and if that egress falls in a range it treats as data-centre traffic, it may return a challenge, degraded content or an error — which the visitor experiences as a failure on your domain. Keep your decision layer and the upstream's filtering layer separate when investigating.
Can the three be mixed within one account?
Yes, and usually they should be, because the constraint belongs to the link rather than the account. The condition is that you check which method a link uses before investigating it: the same symptom has entirely different causes under the three.
What is the default if nothing is chosen?
Most systems default to the 302, because it is cheapest to implement and assumes nothing about where the compliant page is hosted. So a large number of links use redirect delivery without anyone having made the decision. If that page could sit on your own domain, changing the default costs very little.