- “Google cloaking” maps to two rulebooks: the Circumventing Systems policy on the ads side, and the Search spam policies on the organic side. Both prohibit it, but different teams, different detection paths, different outcomes.
- Detection is not a one-time event. Ads establishes a baseline at approval and re-crawls repeatedly afterwards; Search cross-references Googlebot fetches against rendering signals and real-user experience data. “It passed at first” is never a safety signal.
- Consequences are tiered and asymmetric: on ads, from disapproval up to account suspension, often dragging linked accounts with it; on search, from a single page losing visibility to a site-level removal that takes months to recover from.
- The compliant alternative is the same on both sides: one URL for every visitor, personalized in-page — in-page A/B testing, audience-aware content, invalid-traffic filtering. What review sees, what Googlebot fetches and what the user gets all match.
“Google cloaking” is actually two different things
The general definition of cloaking is simple: one URL returns materially different content to different visitors, with the branch keyed off IP range, device fingerprint, geolocation, referrer, or whether an ad-click parameter is present. Inside Google, though, the word lands on two entirely different product lines, and most of the confusion around it comes from not separating them first.
On the ads side, it means the destination URL that was submitted, reviewed and approved is not the page users reach after clicking. Google files this under the Circumventing Systems policy — the bucket for any attempt to keep the platform's review and detection processes from seeing what is actually being served. We walk that policy through clause by clause in the Google Ads Circumventing Systems policy explained.
On the organic side, it means Googlebot is fetching different content than human visitors get. This sits in Google Search's spam policies, in the same family as doorway pages and sneaky redirects. The organic tests do not perfectly overlap with the ads tests — serving different languages by country is fine on both sides, while stuffing a keyword-dense page for Googlebot and sending users elsewhere is a textbook organic violation. We cover that family in cloaking in an SEO context and doorway pages and sneaky redirects.
One point that gets missed a lot: the two rulebooks operate independently. A page can sit fine with ad review and still be judged a violation on the organic side and lose its visibility — and the reverse holds too. If your landing page carries both paid traffic and organic traffic, it is bound by both sets of rules at once, and a problem on either side breaks the whole chain.
On the ads side: how Google Ads finds branched landing pages
A common mental model is that review is a single glance at submission and then it is over. In practice, Google Ads detection spans the whole life of an ad and stacks into roughly four layers, any of which can surface a gap between the approved page and the user page:
- Review at submission — automated systems crawl the landing page and policy review checks the content against what the ad promises and what the policies require. This records what the page looked like at the moment of approval, forming the baseline for every later comparison.
- Periodic re-checks after launch — once the ad is live, the platform re-crawls on its own schedule. If the page changes face only after approval, a re-check readily surfaces the drift from that baseline.
- Multi-profile verification — verification visits do not all arrive from one IP range or one device profile. When a single URL returns materially different content across profiles, the divergence itself is the signal; nothing has to be proven about which tool produced it.
- User reports and experience signals — a destination that does not match the ad's promise, or that redirects somewhere unrelated, feeds back into the same enforcement queue through reports and behavioural data.
The decisive dimension is time. Branching does not have to be caught in a single instant; it only has to reveal, in any one verification across the ad's lifetime, that a verification profile received different content than a real user. The underlying mechanics are shared across platforms — we break them down in how ad platforms detect pages that branch by identity — and for how Google's stance lines up against Meta and TikTok, see the cloaking policy comparison.
On the organic side: how the Googlebot path is judged
The organic path works differently. Googlebot's crawling is openly identifiable — published IP ranges and user-agent strings — so recognising the crawler is not the hard part. The hard part is that doing so is itself the stated test. Google's spam policies name “serving different content based on whether the visitor is a search engine or a person” as a violation outright, and there are several cross-checks: the rendered page snapshot, live fetch tests inside Search Console, and experience signals from real users. When the crawled version and the user version stay out of sync, the problem usually shows up first as indexing anomalies rather than as a warning email.
One recurring misconception deserves a direct answer: “I only do geo-targeting / mobile adaptation / a login wall — does that count?” Usually not. Google accepts normal differentiation by region, device and login state, provided the same logic applies to Googlebot and to ordinary users rather than carving out a special case for the crawler. The test is whether search engines as an identity get treated differently, not whether the page varies at all. To check which side of that line a page falls on, see how to check whether a page is cloaking.
What the consequences look like on each side
| Dimension | Google Ads side | Google Search side |
|---|---|---|
| Policy home | Circumventing Systems policy | Search spam policies (cloaking / sneaky redirects) |
| First action | Ad disapproval, landing page flagged | The page loses visibility in search results |
| Escalation | Account suspension, frequently extending to accounts sharing payment, device or entity data | Site-level manual action, the whole site removed from results |
| Recovery path | Appeal after remediation; success correlates strongly with violation history | Reconsideration request after remediation; recovery typically measured in months |
| Odds of passive discovery | High — re-checks continue for as long as the ad runs | High — re-crawls continue for as long as the page is indexed |
Beyond the direct penalties, several costs get underestimated. First, interrupted learning: when an account is repeatedly restricted, the delivery system's accumulated model resets and rebuilding is expensive. Second, linked enforcement: where several accounts share payment, device or entity data, one flagged account can drag a chain with it. Third, the sunk cost on the organic side: an action there wipes out indexing and authority built over a long period, and unlike paid traffic, that cannot simply be bought back. For the specific behaviours that sit firmly on the wrong side of the line, see the policy red lines around cloaking.
The compliant alternative: same-URL personalization
The business problems advertisers are actually trying to solve are rarely about keeping review from seeing something. They are usually: different audiences should see more relevant content; we want to find out quickly which version converts better; we do not want invalid traffic eating the budget. All three can be met without going near the policy line, by keeping the differentiation inside one URL:
- Every visitor — including Google's verification traffic and Googlebot — hits the same landing-page URL and gets the same content foundation.
- Run proper in-page A/B tests: variants assigned randomly under the same URL, applied equally to all visitors, never branching along a “platform vs user” axis.
- Adapt copy and offers to audience signals — region, language, device, referrer are all usable, as long as one consistent logic applies to everyone.
- Identify and filter invalid traffic so bots and anomalous clicks stay out of conversion data, protecting budget and data quality — a separate matter from hiding content.
- No sneaky redirects, no doorway pages, no blocking Googlebot: the approved page, the indexed page and the page users reach stay identical.
This “same URL, in-page personalization” model satisfies both rulebooks at once, because it never creates a gap between what a verification profile sees and what a real user sees in the first place. For the mechanics of proper A/B testing inside one URL, see the same-URL A/B testing methodology; for a sharper view of where compliant personalization ends, see cloaking vs compliant personalization; and for the fuller compliance checklist on the ads side, see Google Ads cloaking compliance essentials.
Both Google rulebooks ask the same question — is the page you show to verification the same page you show to users? Make the answer yes, and neither side is a worry.
Frequently asked questions
What does “Google cloaking” mean?
It means one URL returning materially different content depending on who is asking. Inside Google the term maps to two rulebooks: on ads, an approved destination that differs from the page users reach, handled under the Circumventing Systems policy; on organic search, content served to Googlebot that differs from what visitors get, handled under the Search spam policies. Both prohibit it, but the teams, the detection paths and the consequences differ.
How does Google detect a landing page that branches by visitor identity?
Not with a single check. On ads, a baseline is set at approval and the live page is re-crawled and compared afterwards, with verification traffic arriving from varied IP ranges and device profiles and user reports feeding the same queue. On search, Googlebot fetches are cross-referenced against rendering signals and real-user experience data. Because these checks recur for as long as the page is live, a mismatch tends to surface over time rather than at one moment.
Is showing different content by region cloaking?
Usually not. Google accepts normal differentiation by region, language, device and login state, provided the same logic applies to every visitor — verification traffic and Googlebot included — with no special case carved out for platform identity. The test is whether search engines or verification visits get treated differently, not whether the page varies at all.
Is there a compliant alternative on Google?
Yes. Serve every visitor the same landing-page URL and personalize inside the page: in-page A/B testing, audience-aware copy and offers, invalid-traffic filtering. Verification, Googlebot and real users all get the same page, which satisfies both rulebooks.
Personalize without the ban risk
Same landing-page URL for every visitor — in-page A/B testing, audience-aware content and invalid-traffic filtering. No cloaking, no sneaky redirects.