Cloaking: The Line Between Personalisation and a Violation

Cloaking is not “showing different content to different people.” It is serving search engines materially different content from what a user can obtain at the same URL, in a way that manipulates rankings or hides the true destination.

That distinction matters because legitimate personalization, localization, device adaptation, consent handling, and paywalls all create variation. The question is whether the variation preserves the page’s core purpose and whether Googlebot can access the same meaningful content and user journey as an eligible human visitor.

What cloaking means in practical SEO terms

Google defines cloaking as presenting different content or URLs to human users and search engines. The most obvious example is a page that shows Googlebot a 2,000-word guide about mortgage rates while ordinary visitors receive a thin affiliate page, a redirect, or unrelated content.

But cloaking is not limited to obvious bot detection. It can happen when a site:

• Serves keyword-heavy copy only to requests identified as Googlebot.
• Redirects search visitors to a different page based on referrer, user agent, or IP address.
• Shows crawlers product inventory, pricing, or editorial content that users cannot access.
• Uses JavaScript, edge rules, or server-side rendering to create a materially different page for crawlers.
• Hides spammy text, links, or structured data from users while exposing them to search engines.

The word materially is important. A local phone number, translated heading, cookie banner, or mobile navigation does not usually change the page’s purpose. Replacing the main content, destination, offer, or access conditions does.

Where legitimate variation ends and cloaking begins

Variation is generally defensible when it responds to a real user constraint and does not give Google a privileged version of the page. A German visitor may need German-language pricing. A mobile visitor may need a compressed image and a simplified menu. A subscriber may see a full article where a non-subscriber sees a paywall.

The safe test is simple: if a human using the same location, device class, login state, and access entitlement as the crawler would see substantially the same primary content, the implementation is usually on solid ground. If the crawler gets a more indexable, more persuasive, or entirely different version than any comparable user can get, risk rises quickly.

Geo-targeting: legitimate localization versus deceptive routing

Geo-targeting becomes cloaking when IP-based logic changes the subject of the page or denies Google access to the page users actually receive. Showing United Kingdom visitors prices in GBP and United States visitors prices in USD is normal. Showing one country a regulated financial-services page and another country an unrelated gambling offer is not.

Country redirects deserve special care. A visitor to /uk/ may reasonably be routed to /us/ when the business does not serve the United Kingdom, but the destination should explain the change and remain relevant. Do not redirect every foreign IP to the homepage while allowing Googlebot to crawl deep product or editorial pages. That creates a mismatch between indexed URLs and real user access.

For international sites, keep three controls separate:

• Language targeting: use distinct, crawlable URLs for genuinely translated or regionally adapted pages.
• Location suggestions: offer a country selector or a dismissible recommendation rather than forcing every visitor through an irreversible redirect.
• Legal restrictions: where a product cannot be sold in a territory, state that clearly and return an appropriate status or restriction page consistently.

A useful operational threshold is to review any geo rule that changes more than 20% of visible body copy, removes the primary conversion path, or sends visitors to a different URL. Those are not Google thresholds; they are practical review triggers. Any one of them warrants a side-by-side crawl and human test before release.

Device adaptation: why “mobile users do not need that content” is risky

The popular advice that mobile pages should contain only the essentials is wrong when “essentials” means stripping content that supports the page’s ranking. Google primarily uses the mobile version of content for indexing, so removing product specifications, supporting copy, internal links, reviews, or structured data from mobile can reduce visibility even if it is not intentional cloaking.

Responsive design is the lowest-risk approach because one URL and broadly one HTML document serve all screen sizes. Dynamic serving can work, but it introduces more moving parts: user-agent detection, caches, CDNs, rendering paths, and bot identification rules. Each is an opportunity for accidental divergence.

Test at least three views before deploying a major template change: a standard desktop browser, a modern mobile browser, and Google Search Console’s URL Inspection or rendered-page view. Compare the title, primary heading, body copy, canonical tag, robots directives, internal links, product availability, and structured data. If the mobile or crawler version lacks a meaningful section present elsewhere, treat it as a defect rather than a design preference.

Paywalls and structured data: the narrow legitimate exception

Paywalls are not cloaking simply because subscribers see more than non-subscribers. A publisher can require a login or subscription and still allow Google to index the article, provided the access model is transparent and technically consistent.

For paywalled content, Google supports structured data that identifies restricted content. The relevant approach uses isAccessibleForFree set to false, plus a cssSelector identifying the paywalled portion of the page. This tells Google that the visible or indexed content has an access restriction rather than pretending the restriction does not exist.

Google’s flexible sampling guidance has recommended a metered model of roughly 10 articles per month as a starting point, while emphasizing that publishers should select a model suited to their audience. That number is guidance, not permission to give crawlers unlimited access while giving users none.

Do not do the following:

• Whitelist Googlebot for unlimited full-text access while blocking every ordinary visitor after a headline.
• Mark a page as paywalled when the real purpose is to hide low-quality, affiliate-heavy, or misleading content from users.
• Put the full article in structured data but show users a substantially unrelated landing page.
• Require searchers to complete unexpected surveys, app installs, or lead forms before accessing content that Google indexed as an article.

A legitimate paywall has a recognizable publisher policy, a consistent access decision, and a user-visible path to subscribe, sign in, or consume the permitted sample. A crawler-only exception without those elements is difficult to defend.

How search engines and reviewers detect cloaking

Cloaking detection is not limited to a single Googlebot visit. Search engines can fetch pages repeatedly with different user agents, IP ranges, locations, cookies, rendering capabilities, and request histories. They can compare raw HTML, rendered DOM output, redirects, response codes, canonical tags, and linked destinations.

Manual reviewers can also reproduce suspicious behavior. A common investigation compares what Googlebot receives with what a standard browser receives from the same URL. Differences in the main content, redirects, or monetization layer are especially significant.

Technical signals that frequently expose cloaking include:

• User-agent rules containing terms such as Googlebot, bingbot, crawler, or known bot IP ranges.
• Server logs showing bot-only 200 responses while human requests receive 302 redirects, 404 errors, or thin pages.
• CDN or edge-worker rules that branch on user agent, referrer, geography, or query parameters.
• JavaScript that detects automation or headless browsers and swaps the visible content.
• Structured data describing prices, reviews, recipes, jobs, or products absent from the rendered user page.

Review logs over at least 30 days when investigating a suspected issue. One clean spot check is not enough: conditional scripts may trigger only after a specific referral, on a second visit, during certain hours, or for a subset of IP addresses. Preserve request headers, response status, redirect chains, HTML snapshots, and rendered screenshots for the affected URLs.

Penalty severity: from lost visibility to removal from results

Cloaking can trigger a manual action under Google’s spam policies. The scope may be partial, affecting a directory or group of URLs, or sitewide when the practice is broad or severe. A manual action can suppress rankings or remove affected pages from Google Search until the issue is fixed and a reconsideration request is approved.

There is no published fixed penalty duration, no reliable “30-day recovery” promise, and no safe percentage of cloaked pages. A single high-value template can affect thousands of URLs, while a small set of intentionally deceptive pages can still damage trust across a domain.

Algorithmic effects can be less explicit but still costly: reduced rankings, fewer indexed pages, poorer rich-result eligibility, and delayed recrawling after cleanup. Recovery depends on successful recrawling and reassessment, so changes should be deployed immediately rather than waiting for a traffic decline to confirm the problem.

How to audit and fix a cloaking risk

1. List every rule that varies content by IP address, country, user agent, cookie, login state, referral source, or bot classification.
2. Choose a sample of at least 20 URLs across templates, countries, device types, and monetization states.
3. Capture the HTTP status, redirect chain, raw HTML, rendered content, canonical tag, robots directives, and structured data for each variation.
4. Compare the primary heading, main copy, offer, links, and access conditions—not merely the page title or visual layout.
5. Remove bot-specific content and redirects. Where variation is necessary, make it user-led, equivalent in purpose, and documented.
6. For paywalls, apply the appropriate structured data and verify that the restricted section matches what the markup identifies.
7. After deployment, monitor server logs and Search Console for at least 30 days, then repeat the comparison crawl.

The defensible standard is not perfect visual sameness. It is honest equivalence: Google should index the same page people can meaningfully access, subject to the same reasonable geographic, device, and subscription conditions. Once a crawler receives a better or different reality than users do, personalization has crossed into cloaking.

Related reading

• Our services — scope, method and what we measure.
• Technical SEO
• Negative SEO: What Is Real, What Is Panic
• Meta Descriptions: Rewritten Most of the Time, Still Worth Writing