If you’re in the performance marketing industry, chances are you’ve had your Facebook ad account disabled more than once.

As the digital marketing world evolved, so did the online scams, regulations, and marketing methods.

The recent crackdown and lawsuit against companies using link cloaking to circumvent Facebook advertising policies is the last episode of the ‘cats and dogs’ war that has been going on since the Facebook Ad platform was first launched.

In this post, I will explain what goes on behind the scenes of some of the account bans you’ve suffered. I’ll also cover what the Facebook Ad review process really* is, and how you can avoid having your Facebook ad account disabled.

Are you still trying to circumvent the Facebook Ad review system?

99.9% of the time there is no way to overturn Facebooks Ad account bans.

Everything connected to the business account typically gets affected (or shall I say infected?). Whether it’s the payment method, the pages, the ad accounts, domains, and the pixel data.

If you’ve run only a few campaigns, then it might not be the end of the world for you. However, for some marketers, we are talking about huge amounts of audience data built over the years with massive investments of time and money that are now gone in an instant.

If you’re an agency, the implications of getting your account or client accounts disabled can be devastating, if not fatal to your business.

The most frustrating aspect of this ban is that sometimes you have no idea that you’ve done something wrong or what exactly led to the account ban.

You wake up one day and see a notice like this on your Facebook Ad account:

Your account has been disabled. Your ads have been stopped and should not be run again. We disable an account if too many of its ads violate our Terms of Use. We cannot provide you with the specific violations that have been deemed abusive. Please review our Terms of Use and Advertising Guidelines if you have further questions.

Facebook Ads Team

Not a great way to start your day. Isn’t it?

I recently posted a poll on the Facebook Ad Buyers Group asking this:

How many people got their Facebook Ad account disabled, and don’t know what is the reason behind the ban?

And here were the results:

Facebook ad account disabled survey
Poll on Facebook Ad Buyer Group

The top 5 reasons that lead to Facebook ad account bans

  1. Direct affiliate link
    Are you posting your offer link directly in your ads? This is a no go! Facebook will simply not let you run these ads. Too many attempts to advertise direct links will get your Facebook Ad account disabled. Even if they did allow it, posting your offer link directly in your ads gives you zero control as to where the traffic is going.
  2. Redirect campaign URL
    Are you using a campaign tracking software that provides a redirect campaign URL? The ads will be disapproved, regardless of whether the campaign goes to your landing page or to an affiliate link. Too many attempts will get your Facebook Ad account disabled.
  3. Your Facebook Pixel has been set on the Offer Thank You Page
    Let’s say some affiliate networks or vendors have been kind enough to accommodate your request to add your Facebook Pixel on the offer thank you page. The problem with this is that other marketers have their pixel on the same thank you page, and you don’t know if the other marketers are doing any shady stuff with Facebook. So, if one facebook ad account gets disabled, it will likely impact you, and the others who have their pixels on the same thank you page. A domino effect of epic proportions.
  4. Your landing page outbound links are “smart” redirects
    This is ban is more subtle. Your campaign final URL is your website landing page, but the outbound links (call to action URLs, click url) are smart links rotating various offer links based on GEO, Device, or other criterion. Whether you control the redirect or not, Facebook ad review crawler will see these links as cloaked links, and get your facebook ad account disabled.
  5. Your tracker behaves like a cloaking system.
    This is probably the most mind blowing nonsense. Trackers like Voluum claim to provide a “redirectless tracking method”, when in fact it’s an ordinary cloaking mechanism. This is the worst situation, as your facebook ad account will certainly be disabled.
How your Tracker's redirectless feature works.
“When a landing page loads, the direct tracking pixel makes a request to tracker with visit info and campaign ID. The difference comes when a visitor clicks a CTA button. The direct tracking pixel replaces a standard click URL with a direct click URL that leads straight to an offer.”

This last case has some nuances that are worth looking into because they tend to be confusing, and can often lead to disaster.

Tracker’s call to action URLs

If you’re using a traditional tracker, you are probably familiar with the “call to action” URLs, or otherwise called “Click URL”. They look like https://trk.example.com/click/1 and they have this in common:

Unless the visitor catch the campaign’s cookie, clicks on the Click URL will trigger a 404 page.

The top 5 reasons that get your facebook ad account disabled
Traditional Trackers tracking flow

While this method can prove to be very efficient when running pop up campaigns at scale, it has its downsides. Especially when trying to run on Facebook Ads or running affiliate campaigns on Google Ads.

Is your tracker’s Click URL leading to Facebook ad account ban?

It’s fair to assume that the automated ad review system runs multiple tests on your ads before (dis)approving them. These diagnostics might include going through your ads from various locations, devices, connections, and browsers.

Needless to say that as soon as the system detects a different landing page, it will disapprove your ad. Then the “bots” simulate different browser configurations.

And this is where things start to get complicated.

When a browser with an ad blocker and disabled JavaScripts visits your site, none of the trackers’ cookies will be set, and your tracker’s Click URL will generate an error like the famous one below.

💡 What is CNAME cloaking
While your tracker might set cookies on your custom domain, browsers now identify that it’s in fact a third party cookie. This method is called CNAME Cloaking and browsers have already started to block these cookies leading to massive click loss.
Voluum’s 404 page

What happens next is this error will get logged in the Facebook database. Your ad will first be disapproved, and eventually your Facebook ad account disabled.

Now if you ask me, there is nothing wrong with these “call to action” URLs. They’re part of your marketing stack and you’re probably not trying to do anything misleading. However, Facebook sees them from a different perspective. Especially when the same types of links show up regularly and across many ad accounts.

Your tracker’s footprints and patterns.

As I mentioned earlier, errors are logged into databases. They are cross-referenced, mined, and processed by machine learning engines.

Then patterns are discovered, tested, and back-tested against millions of ad accounts in order to find positive and “false positive” cases.

Finally, they are factored into the automated ad review process so that your ads are approved in seconds rather than hours.

On the other hand, since these footprints are now part of the ad review process, you get your facebook ad accounts disabled before you even get a chance to run a campaign.

Why is the Facebook Ad review process so important?

To understand the big picture of the ad review process, one simply needs to follow the money.

Facebook being Facebook, they are accountable for what is advertised on their network. We know all too well the kind of impact rogue advertisers can have on the worlds order, don’t we?

Considering the magnitude of the fines they get each time something goes sideways, they need to protect themselves and their shareholders. If you need a reminder, you can check out this article.

So every second in the review process counts.

According to Statista, in 2019 Facebook ad revenues reached USD$69 Billion.

Let’s do some math…

The top 5 reasons that get your facebook ad account disabled
Facebook Ad Revenues 2019

When you look at the problem from this realistic perspective, you realize why Facebook deals with these annoyances in a swift manner.

What does Facebook see as an annoying pattern?

The Facebook team did not wake up one day and decide to sue a cloaking service provider out of the blue.

While I am not familiar with the cloaking service itself, after reading the Facebook press release, suing them was a no brainer. One can only ask themselves:

Why did they wait so long?

Facebook noticed a few things like:

  • The advertisers high spend
  • They all have the same technology footprints
  • The same type of hosting, landing pages stacks, link patterns, etc.

Facebook data privacy team then dug deeper to find out what was really going on, and the rest was history.

Some of the known patterns:

  • Link URL structure i.e. https://trk.rdtrk.io/click/1
  • IP addresses tracking domains are pointing to
  • Domain Whois privacy protection
  • Recent Facebook profile accounts with high spend
  • Advertiser behavior, such as sign in locations, browsers, payment methods
  • Marketing stacks such as tracking software
  • Not using the Facebook Pixel or firing it through iframes or piggyback

And this is probably just the tip of the iceberg. Facebook likely has a ton of other metrics and data points, because with Facebook, it’s all about data, isn’t it?

Is your tracking subdomain giving you up?

A classic assumption is thinking that having your domain hiding your tracker will somehow make you anonymous. You might even be willing to pay a premium fee for that. While it’s true that a tracking link being on the same domain as your site looks sexy for John Doe, Facebook will easily find the trail leading to the real server – even behind Amazon Web Services load balancers.

Companies like Security Trails and VirusTotal provide cyber forensics services. They let you freely look up all domains and subdomains associated with your tracking domain.

  • Check Virus Total analysis of the domain Voluumtrk.com
  • Check Virus Total analysis of the domain redtrack servers.

So while you might be happily paying for a “premium feature” that allows you to have your own tracking domain, you are in fact sending the rogue signals to the automatic ad review process.

The first signal is obvious, as it indicates that your Click URL is a redirect. But the less obvious signal is that because your subdomain is a CNAME pointing to a domain shared by hundreds of other marketers, and using the same Click URL patterns, you either join a segment that might raise suspicion or you quickly make it to the top of Facebook’s sh** list.

This alone is not a sign that you are doing anything wrong. But if too many “lookalike” advertisers are caught circumventing the ad review process, “using” the same server, you will become an unfortunate collateral damage, and your Facebook ad account will be disabled.

On the other hand, if your site carries a standard analytics tracking code, like Mixpanel, Google Analytics or Adobe Analytics, you will fly under the radar and be pretty sure that they will not count toward your “risk” assessment.

Industry chatters

What would you do if you were given the task to protect the ad review process? Would you try to learn the industry that is seen as constantly trying to circumvent the ad review process?

Being located in Israel, we have the chance to know and work with some of the world’s best cyber security experts. They are are the good hackers that build systems that defend enterprises and/or personal computers against the bad hackers.

Do you think they’d be experts if they didn’t know how the bad hackers operate? Probably not.

That’s probably how the guys at Facebook, Google, and other ad networks operate.

They 🕵️‍♂️ the enemy, so they can better 🤼 it!

They probably even send “undercover” employees to sign up for affiliate programs, industry forums, befriend with influencers…

Yeah, exactly like in the spy movies.

The top 5 reasons that get your facebook ad account disabled
The GodFather

I would read Bloomberg and pay attention to what marketers say, what they do and how they do it, especially when it directly involves Facebook Ads.

How Facebook Helps Shady Advertisers Pollute the Internet.

“…and ban accounts that broke the rules. But affiliates evaded them using a subterfuge they call “cloaking.” It was easy, especially if you were running …”

Zeke Faux for Bloomberg (March 27, 2018)

Understand this
: Running the ad review process is like running a counterintelligence service. You plant spies, analyze content, behavior, collect and correlate data, until you can make an informed decision.

Unfortunately, like in every good spy story, there is always collateral damage where the good guys like you get caught in the crossfire.

Check out how AnyTrack’s features compare to Voluum, and which features will help you prevent your next Facebook Manager suspension.


How to avoid your next Facebook Ad account Suspension?

While the same rules apply to all Facebook advertisers, Affiliate Marketers need to be extra careful. One reason is because as an affiliate marketer, you only control one part of the funnel.

Facebook Ads policies

It goes without saying that you must follow the Facebook Ads Policies.

Affiliate Networks and Offers

Promote offers from premium affiliate networks like CJ, Impact, Rakuten or TradeDoubler. With these networks, you are almost guaranteed to promote legit offers. Also, these affiliate networks enforce strict terms on what you can or can’t do, minimizing your chances to be caught in a crossfire.

Another important consideration with premium affiliate networks is the fact that they do not use smart redirects. Since they promote premium brands and retailers, they are not allowed to redirect a visitor that clicked on an American Express offer, to a Capital One offer, just because the GEO target didn’t match the original offer service area.

If you’re wondering why, it’s a blatant trademark infringement, and it can be seen as misleading advertising.

Protect your Facebook Business account

Your Facebook Business account is an asset with virtually unlimited growth potential.

In fact, when you start buying ads on Facebook, your data becomes an asset which you can leverage indefinitely across your campaigns. So protect your Facebook Business account.

Don’t share your Business Account with partners who might harm it.

Don’t share assets across business accounts that could negatively affect each other.

Avoid Smart Links

Do not use any types of smart links on your landing pages. As explained earlier, as soon as the redirect behaves inconsistently, it will be flagged as a link cloaker.

Special considerations:

Blocked countries: even if the offer is not available in specific Geo’s, the link must redirect to the same URL.

This is something that might not sound very “smart”, but in this case, being right is better than being smart. One way to do this is by using deep links so you can define where the link is actually pointing.

Safeguard Your Facebook Pixel

Don’t place your pixel where other marketers have theirs, even if the merchant uses Google Tag Manager to load your pixel specifically for you.

The fact that the triggering page is the same can associate your pixel and account with the wrong guys.

Since the Facebook Pixel is an asset that contains your data, its value only increases over time as you accumulate more and more data. Once your ad account gets suspended, all the precious data you gathered is gone.

What to do instead?

Connect with the Facebook Conversion API, which allows you to track conversions with Facebook without adding your pixel on third party websites.

Wrap up, best practices and solutions.

When you are notified that your facebook ad account is disabled, you are generally given a vague reason. Considering they may see you as a “fraudster”, they probably prefer to keep their trade secrets for themselves, rather than disclosing the inner details of their ad review process.

So besides the written rules to which you must comply, there are subtleties that are learned with experience.

Best practices

Generally speaking, properly using the Facebook Business tools will help you get the most out of your Facebook campaigns.

Not only will you benefit from the extensive set of optimization engines Facebook provides, but you will also signal to Facebook that you embrace their system.

The Facebook automated review system is probably also using these tools to gauge your account risk level.

For example, if you use the 2 Factor Authentication to secure your account, it’s unlikely that you’ll trigger any alerts when logging into your business account from a remote beach in Mexico. 

Big issue is that I traveled to Mexico and the international IP address triggers our FB business manager account to get disabled. 

Kyle A.

Also, if you use the Facebook pixel properly and leverage your conversion data to optimize your campaigns, Facebook will use this data to rank your ads account accordingly.

Can AnyTrack help you prevent your Facebook ad account from being disabled?

While AnyTrack alone can’t help you avoid the next account ban, it comes with features that are designed to work with Facebook. These features indicate to Facebook that you’re not hiding anything behind link cloakers.

The AnyTrack platform has been built from the ground up to enable performance marketers to access the very same tools top advertisers have access to when advertising on Facebook.

Key features for affiliate marketing on Facebook

The Facebook Conversion API (CAPI)

Since the Facebook Pixel is the ultimate measurement tool for tracking campaigns and building audiences, we’ve integrated both the Facebook Pixel that we trigger for engagements occuring on your website, and the Facebook Conversion API (AKA: Facebook Postback URL) where we send conversions triggered in affiliate networks or third party platforms.

The Facebook Conversion API (initially called the server-side API) is one of our Facebook Business Tools that lets you share key web and offline events, or customer actions, directly from your servers to ours. The Conversion API works with your Facebook pixel to help improve the performance and measurement of your Facebook ad campaigns.

This way you are not only accurately tracking all your conversions back to Facebook, but you are also sending a clear signal to Facebook that you are trying to make the most out of the tools they provide.

Redirectless Tracking

Because redirects need to be avoided at all costs, AnyTracks tracking method is 100% redirectless.

Working with a redirectless tracking software has a lot of positive implications in your marketing flows:

  • The Final URL you set in your Ad is your landing page URL
  • The offer links placed on landing page are the links provided by your affiliate programs
  • You don’t need to configure offers and offer links in AnyTrack
  • You can promote 1 or 10000 offers on your site, and they will all be tracked.



Literally it means: Automatic Tracking.

As soon as you add the AnyTrack TAG on your site, it will AutoTrack outbound clicks and forms submissions events to your Facebook Pixel (and Google Analytics).


Literally it means that it will Automatically Tag your links with key value pair query strings such as aff_click_id=click_id data (for Hasoffers).

Summary about Redirect-Less Tracking
Beside the fact that your tracker can no longer “flag” you as a Link Cloaker, these two features alone, will save you countless hours of tagging and adding Click URLs on your site. They will also bring your visitor closer to the conversion.


Facebook is considered to be one of the best traffic sources for performance marketing. They have pushed the digital advertising world forward through innovation, data mining, and an extraordinary advertising and targeting platform. 

All these technologies and methods are available to you so you can advertise to nearly 2.5 Billion users! Unlimited opportunities for selecting, tailoring and refining your targeting.

Facebook is all about data.

Data is the foundation of Facebook. Data is what fuels Facebook’s growth.

Whether it’s consumer data, user data, or advertiser data… All this data is collected, processed, compiled, and analyzed in order to provide a safe environment for the consumers, and a way for advertisers to bring consumers to their business.

However, the data is also what will get your account banned if you don’t play by the rules, or use the wrong tools to run your campaigns.

Disclosure & DisclaimerThe points that I raised in this post are my own opinion. They are based on conversations with marketers, many years in the advertising industry, stories from customers, partners, colleagues, and my passion for spy novels.

The assumptions made as to how Facebook runs its ad review process, and how they allegedly “spy” on the affiliate marketing industry to protect the ad review process, are the result of my imagination. I have no proof, nor did I receive any insider information or confirmation, from Facebook current, former employees or contractors. You can read more about how Facebook deals with political and cyber threats here.

The recommendations that I’ve put forward are not a guarantee that your ad accounts will not be disabled now or in the future.

Lastly, I am fairly sure that others have also some ideas and conclusions of their own. You’re welcome to join the discussion below and add your advice.

Got your Facebook Ad account disabled, read how you can get out of the ban.