Google Ads Compliance

Google Ads cloaking agency: vendor evaluation, policy exposure and the dual-review problem

By the ROAS365 team 2026-09-20 8 min read

Plenty of advertisers search for a "Google cloaking agency"; far fewer can describe what they would actually be buying. Compared with TikTok or Pinterest, the Google side carries one extra layer of difficulty: the same domain is judged twice by the same company under two independent rulebooks — by the advertising side under its landing page requirements, and by the search side under its spam policies — and enforcement frequently lands at the account level rather than on a single ad. This piece is not about how routing works. It is a procurement view: what Google's review surface actually inspects, which three businesses hide behind one vendor label, what to ask before signing, which claims should end a conversation, and which responsibilities stay with the advertiser regardless of what the contract says.

TL;DR
  • Google's distinguishing feature is dual review: the advertising policies and the search spam policies look at the same domain, so exposure on one side is usually visible from the other. Pure ad platforms do not create that structural overlap.
  • At least three businesses share the vendor label: media buying, managed technology, and tool reselling. They differ in cost structure, transparency and exposure when something goes wrong, so step one is establishing which one is across the table.
  • Google-side inspection is not a one-off. The final URL and the tracking template redirect chain are both in scope, and checks recur — behaviour on approval day says nothing about behaviour three weeks later.
  • A vendor promising approval or non-suspension is promising something it does not control. Credible commitments are procedural: exportable per-visit records, a written response path, a defined remediation window.
  • The account, the billing relationship, the domain and the policy agreement all sit with the advertiser, and enforcement follows those rather than the contract. Execution is what gets outsourced; liability is not.

The Google-only problem: one domain, two rulebooks

On TikTok or Pinterest, a destination problem stays largely inside that ad platform: the ad is disapproved, the creative comes down, in bad cases the account is restricted. Those platforms are not search engines and form no view on how the domain should appear elsewhere. Google is different. It is both an ad platform and a search engine, and the two policy systems each have their own definition of, and their own response to, serving different content to different visitors. The search-side rules and the advertising-side circumventing systems policy are not two chapters of one document; they are two independent tracks that do not consult each other.

The procurement consequence is direct: evaluating a Google-side vendor cannot stop at whether ads get approved. A vendor accountable only for the advertising side can solve the ad problem while leaving consequences on the same domain in organic search — consequences the contract typically never mentions. If that domain also carries organic traffic, brand queries, or any future content plan, this belongs in the calculation before signing, not after.

The second Google-specific factor is enforcement granularity. Many platforms stop at the ad or ad group level. Google's circumventing systems findings have historically landed on the account itself, and can propagate along the payments profile to linked accounts. A configuration operated by an external team — one the advertiser may never have inspected in detail — can therefore affect far more than the campaign line that vendor was hired to run. Common suspension triggers covers the wider list.

What the Google-side review surface inspects

Before evaluating a vendor it helps to know what the system on the other side checks, otherwise vendor claims cannot be assessed. Four points are worth holding on to:

What is inspected Commonly assumed to be What it actually is
The final URL Checked once, at submission Re-checked on an ongoing basis for as long as the ad runs, so consistency on launch day supports no lasting conclusion
Tracking template and redirect chain A measurement detail outside policy scope In scope. Any hop that changes what the visitor ultimately receives is a policy question, not a technical detail
The identity of automated fetches Something robots.txt can handle Ad-side crawling follows different rules from ordinary search crawling, and treating it like a generic crawler creates a problem of its own
The domain's standing in search Unrelated to ad review A separate judgement by the same company on the same domain; both conclusions can exist at once

The table's value is in spotting sales talk. A vendor that describes the tracking template as "pure measurement, outside review", or claims that crawler directives handle ad-side fetching, either does not know this channel or knows and chooses not to say. Neither is good news. How ad platforms detect content differences covers the detection methods themselves.

One label, three different businesses

The phrase maps to at least three very different company shapes. Separating them matters more than any price comparison, because the advertiser sits in a different position under each when something goes wrong.

Shape What is actually sold What the advertiser should watch
Media buying shop Runs the campaigns; destination handling is one part of a bundled service, rarely priced separately Account and data ownership. If the account is not in the advertiser's name, history, audiences and domain relationships may not survive the end of the engagement
Managed technology provider Operates the routing infrastructure on the advertiser's behalf while the advertiser keeps the media Whether records export, and whether infrastructure is shared across clients. Shared resources carry other clients' problems back along the same path
Tool reseller A markup on someone else's product, with no engineering capability of its own Cannot diagnose or fix, only escalate upstream, which makes any response-time commitment unenforceable in practice

The test is simple: ask one concrete technical question — whether a specific signal survives a specific arrival path, and how they handle it. The first two shapes answer directly. The third goes away to check. Agency versus self-serve tool works through the cost structures of the two models in more detail.

Nine questions worth asking before signing

The following questions do not test technical skill. They test verifiability: whether, on the day a notice arrives, the advertiser can produce evidence and explain what happened without depending on the vendor's goodwill.

  1. Do per-visit records export as raw data? An aggregate dashboard is not enough. What is needed per visit: arrival time, the signals the decision keyed on, the verdict, the stated reason, and what that visit actually received.
  2. Do those records reconcile against platform reports and server logs? Records that do not reconcile carry no evidentiary weight in a challenge; they are just another set of self-reported numbers.
  3. Is the infrastructure shared or dedicated? Shared IPs, domains and certificates mean another client's history reaches you through resources you neither see nor control.
  4. Are configuration changes logged — who, when, what? Without a change log there is no way to answer the question that matters most in a post-mortem: from which day did behaviour change.
  5. What is the response path when a platform notice arrives? A named contact, a written response time and a defined remediation window — not "reach out any time".
  6. What stays with the advertiser when the engagement ends? Account, domain, records, configuration documentation. Anything unanswered is an exit cost.
  7. How do they handle the organic search side? The answer is revealing. A vendor that has never considered it has a narrower scope of responsibility than the advertiser assumes.
  8. What does pricing meter on? Traffic, domains, seats or a flat bundle. The meter decides how cost behaves as volume changes, and which direction the vendor's incentives point.
  9. Can a low-stakes line run first as a trial? A vendor that will not accept a small verification engagement is usually avoiding verifiability itself.

Claims that should end the conversation

Some statements are themselves the conclusion, and need no further diligence. Any one of the following five makes the remaining questions unnecessary.

The second item deserves a note of its own. The clearest entry on any red-line list is serving the platform's own checks something different from what real visitors receive. A vendor that leads with this as its core capability is not demonstrating strength; it is treating the advertiser's account as a testing ground for its own product. Where compliant personalisation ends and that red line begins is worked through separately.

What never transfers

A contract can allocate work and set remedies. Several things stay with the advertiser structurally, regardless of what the contract says:

Item Why it does not transfer
Policy liability The policy agreement is between advertiser and platform, and enforcement acts on the account, not on the vendor
Domain reputation The domain is the advertiser's asset; once a record exists on either the ad side or the search side, changing vendors does not reset it
The burden of explanation When a challenge arrives, the advertiser is the party asked to show evidence. If the evidence sits in the vendor's system and does not export, the obligation cannot be met
Business continuity The moment an account stops, the loss lands entirely on the advertiser's revenue; the vendor at most refunds a service fee

This table explains why verifiability should carry more weight in an evaluation than price or promised outcomes. In assembling an appeal after an enforcement notice, every usable item is a raw per-visit record. Without those, an appeal can only be a statement rather than a demonstration.

When a vendor is the wrong answer

The window in which a vendor is worth paying for is narrower than it looks: the team genuinely lacks the domain knowledge, the engagement is short and non-recurring, and the advertiser accepts not seeing the details. Outside that, three situations usually favour a self-serve setup:

The full platform-by-platform evaluation framework — how the review surface differs across Google, YouTube, TikTok, Pinterest and Snapchat — is here. For advertisers who simply want to see what their own route decides on each arrival, reading routing analytics is the place to start.

Frequently asked questions

What is a Google Ads cloaking agency?

It is a label covering at least three businesses: a media buying shop that treats destination handling as part of a bundle, a managed technology provider that runs routing infrastructure for the advertiser, and a reseller marking up someone else's tool. They differ in cost structure, transparency and in where the advertiser stands when something breaks, so step one of any evaluation is establishing which one is across the table.

Why is Google harder to outsource destination handling on than other platforms?

Because the same company judges the same domain twice under two separate rulebooks — the advertising policies on one side, the search spam policies on the other. A destination arrangement that draws attention on one side tends to be visible from the other, and the domain carries the consequences into channels the vendor was never hired to manage.

Can a vendor guarantee a Google Ads account will not be suspended?

No. No vendor controls enforcement decisions, so a guarantee of approval or non-suspension promises something the seller cannot influence. What a credible vendor commits to is process: documented behaviour, exportable per-visit records, a named response path when a notice arrives, a defined remediation window. Read an approval guarantee as a signal about the vendor's honesty rather than about the product.

Who is liable if a vendor's setup breaks Google Ads policy?

The advertiser. The account, the billing relationship, the domain and the policy agreement all sit with the advertiser, and enforcement follows those rather than the contract between advertiser and vendor. A vendor may owe the advertiser commercially under whatever the agreement says, but that is a separate matter, recovered separately, and usually long after the account is gone.

What records should a routing vendor be able to hand over?

Per-visit records at minimum: arrival time, the source signals the decision was made on, the verdict, the stated reason, and what that specific visit was served. They need to export in raw form and reconcile against platform reports and server logs. A dashboard showing aggregate pass rates with no path down to an individual visit cannot answer the one question that matters when a notice arrives.

Is an in-house setup better than hiring an agency for Google traffic?

It depends on whether the constraint is knowledge or capacity. A vendor earns its fee when the team genuinely lacks the domain knowledge and the engagement is short. When campaigns are ongoing, the same decisions repeat weekly, and the advertiser needs to see the evidence directly, a self-serve tool with full record access usually costs less and leaves the advertiser able to answer questions with no third party in the loop.

Next step

ROAS365 keeps a visit-level record for every arrival: where it came from, the verdict, the reason behind it, and what that visit was actually served. Records export in raw form and reconcile against platform reports, edge logs and downstream conversions. When the records sit with the advertiser, the question of evidence living inside a vendor's system does not arise. To see how that fits an existing campaign structure, contact sales.