Facebook Fingerprinting and Business Manager Restrictions: What Meta Sees and What It Allows

You know the notification. "Your ad account is restricted." Maybe it's the Business Manager itself, maybe it's your personal profile, maybe it's all three at once. Facebook fingerprinting is usually somewhere in the story.

And the first instinct, almost everyone's, is to start over. New Gmail. New card. VPN pointed at another city. Fresh Business Manager by lunchtime.

Then that one gets restricted too, sometimes within a day, and it feels like Meta is reading your mind.

It isn't. It's reading your browser, your payment details and your account connections, and it's doing so on purpose. This post explains what that looks like, what Meta's own rules say about multiple accounts, how agencies and multi-brand businesses run several Business Managers properly, and the official way back from a restriction.

One disclosure before we start: we sell an antidetect browser. So read the product section with a raised eyebrow, and hold us to it — we'll be straight about where a tool like ours helps and, more usefully, where it does nothing at all.

Curious what your own browser gives away? We built a free checker at justbrowser.app/fingerprint-checker. It runs client-side, no signup. Worth a look before you read on, so the signals below have your numbers next to them.

First, What Meta's Rules Actually Say

Before anything technical, the rules. Most people in the "new email, new IP" loop have never read them, and they settle the question faster than any fingerprint explainer.

Personal profiles. Meta's Terms of Service ask you to use the name you use in everyday life and to create only one personal account, your own. They also say that if Meta disables your account for breaking its terms, you agree not to create another one without its permission. That clause is the whole story for anyone thinking about a replacement account. (Read the current wording on Meta's Terms page. Paraphrase is never a substitute for the source.)

Business Manager is now "business portfolios." Meta renamed Business Manager accounts to business portfolios, managed through Meta Business Suite and Business Settings. Same idea: a container that owns ad accounts, Pages, pixels and catalogs, with people and partners given roles inside it.

The rename causes more trouble than a rename should. Most guides still say Business Manager, parts of Meta's own interface use both names, and you end up translating between the two while trying to fix something urgent.

Several portfolios and several ad accounts are normal. One person can belong to more than one business portfolio. A single portfolio can hold multiple ad accounts, which is how a brand runs separate accounts for regions or product lines. Separate legal businesses can each have their own portfolio. Meta sets limits on how many ad accounts a portfolio can create, those limits move with account history, and they aren't published anywhere as a fixed number — which is genuinely irritating when you're trying to plan a client structure in advance and someone wants an answer today. Check the Business Help Center rather than trusting any number you read in a blog post (this one included).

Advertising has its own rulebook. Meta's Advertising Standards say that helping anyone evade or get around its enforcement is prohibited, and its Community Standard on Account Integrity covers accounts created to evade an earlier removal or used to get around enforcement or review. If you're advertising at all, both pages are worth ten minutes.

So "can I run more than one Business Manager?" has a plain answer. Yes, through the structures Meta built for it. "Can I make a new one because the old one got restricted?" also has a plain answer. No.

How Facebook Fingerprinting Connects Your Accounts

Meta doesn't publish its detection model, and anyone who claims to know its exact signal weights is guessing. What's public is how browser fingerprinting works in general, because researchers and vendors have documented it for years. That's enough to explain why "new email plus new IP" never looked like a new person.

The signals below are the ones people mean when they say Facebook fingerprinting. None of them is exotic; the power is in the combination.

Canvas. A page asks your browser to draw a hidden image. The exact pixels depend on your GPU, graphics driver, operating system and font rendering, so the resulting hash tends to be stable for one machine and different across machines.

WebGL. Query WebGL and the browser reports a renderer string naming your graphics hardware, plus a long list of capabilities. We wrote a deeper look at WebGL fingerprinting if you want the mechanics.

Fonts and audio. Installed fonts differ between machines, and an audio sample processed through the Web Audio API comes out very slightly different depending on hardware and drivers. Both get hashed. (These two get far less attention than canvas, which is odd, because they're quietly effective. More in our piece on audio and font fingerprinting.)

The boring stuff. Timezone, language, screen size, pixel ratio. Weak alone. Useful in combination.

Then there are the account-level signals, which matter at least as much: the payment method, the admins on a portfolio, the Pages and domains it's connected to, the phone number used for verification. Email and IP are only two of many signals, and the account-level ones — payment method, admins, connected Pages, verification phone — tie a "new" account back to the person behind it no matter what browser it's opened in.

Here's our honest take, and it isn't the one you'll find on most antidetect blogs. Facebook fingerprinting, and the account-level linking it feeds, is a reasonable thing for Meta to do. Ad platforms get hit by scam advertisers who come back the morning after every takedown, and connecting a "new" account to the person behind the old one is how they protect users and other advertisers from that. You can find it frustrating (we do too, when a legitimate account gets caught up in it) and still see why it exists.

The Pixel and Your Browsing Trail

Facebook fingerprinting isn't the only thread. The Meta Pixel sits on a huge number of websites, and Meta's privacy policy says it receives information from partners about activity off its own products. When you browse with Meta cookies in your browser, those visits can be tied back to you.

For most people that's a privacy question, not an advertising one. Two practical points:

You can see and disconnect much of this data in Accounts Center under "Your activity off Meta technologies."
If you manage client ad accounts from the same browser you use for personal browsing, everything blurs together: your shopping, your client's checkout tests, your logins. Keeping work in its own browser profile is just good hygiene.

Notice what we're not saying. Separate browsing doesn't make a restricted advertiser into a new one, and it isn't meant to.

Why a Replacement Account Is the Worst Move

Let's be blunt, because this is the part most "fresh BM" advice leaves out.

It's a terms violation in its own right. The original restriction might have been a mistake. Creating a new account to get around it is not, under Meta's terms, and it hands Meta a clean reason to make everything permanent.

Restrictions spread through connections. A restricted personal profile can affect the portfolios it administers, and a disabled portfolio can take its ad accounts and Pages down with it. For an agency, that means one person's shortcut can land on a client's assets. Ask anyone who runs an agency how that phone call with the client goes.

You lose the appeal. A review only works if you have a clean story: here's what happened, here's what we fixed. "We also opened four other accounts" is not a clean story.

There's money and legal exposure. Unpaid ad balances don't vanish when an account does, and payment disputes over ad charges can follow you to your card issuer. If the original restriction was for something like misleading claims, running the same ads from a new account turns an advertising problem into a consumer-protection one. We're not lawyers and this isn't legal advice, but the risk runs one direction.

The Official Route Back

Boring answer. Correct answer.

Open Account Quality in Meta Business Suite. It lists restricted assets and, usually, the policy Meta cites.
Read the actual reason. A rejected ad, a payment failure, an unverified business, suspicious login activity. These need different fixes. Sometimes the policy Meta cites is broad enough to tell you almost nothing, which is the most frustrating part of the whole process — you're asked to fix a cause nobody will name. Work backwards from what changed in the last week: a new ad, a new admin, a declined card.
Check for a compromised account. Plenty of restrictions start with a hacked admin profile running ads nobody approved. Secure every admin with two-factor authentication, remove people who no longer need access, and say so in your review request.
Fix the cause before you ask. Edit or remove the offending ad, settle the payment issue, complete business verification if it's pending.
Request a review from Account Quality, and keep it factual.
Use Meta's advertiser support if it's available to your account. Availability varies.

Some reviews go your way. Some don't. If a decision stands, the honest options are to change the business model that triggered it or to advertise somewhere else, not to come back under a different name.

Running Several Business Managers the Right Way

Most readers who searched for this aren't scammers. They're running real businesses with genuinely complicated account structures. Here's how that's meant to work.

Agencies. The client owns its business portfolio. It adds your agency as a partner in Business Settings and assigns the ad accounts, Pages and pixels you need. Your staff log in as themselves, with their own real profiles, under the permissions the client granted. Nobody shares a password, and when the contract ends the client removes you in two clicks.

Brands with several product lines or regions. One portfolio, several ad accounts, each with its own budget, payment method and people. Meta built this exact setup.

Separate businesses under one founder. Each legal business gets its own portfolio, with you as a person in each. That's allowed. Faking separate people to run them is not.

Freelancers and staff. Add them as people with the narrowest role that works, and take access away when they leave.

Where an Antidetect Browser Fits (and Where It Doesn't)

This is the part where we talk about our product. JustBrowser is an antidetect browser built on a custom Chromium engine with native C++ integration, not an extension, and it's always current with upstream Chromium. Each profile is a separate, self-contained browser with its own cookies, storage, logins and settings.

What that's good for, in an ad-ops context:

Agency staff working in client-owned accounts with permission. One profile per client keeps each client's cookies, logins and open tabs contained, which cuts down on the "wrong account" mistakes that happen when ten clients live in one Chrome window. Team seats are free and run the profiles the owner shares with them, with owner, admin, member and viewer roles and view-only or launch shares.
Ad verification and QA across regions. Checking how your ads and landing pages render in another country, on another operating system, at another screen size. Our ad verification workflow walks through it. (You bring your own proxies; JustBrowser doesn't include any.)
Privacy. A work profile that never touches your personal browsing.
Automation. A local REST API plus CDP for Playwright, Puppeteer and Selenium, for reporting and testing jobs.

Two limits worth knowing before you get interested. There's no Linux build — Windows x64 and macOS on Apple Silicon only, which rules out parking it on a cheap remote box. And the REST API is local, bound to 127.0.0.1, so there is nothing to call from somewhere else; people do ask, and the answer is no.

What it's not for: making a restricted advertiser look like a stranger. Meta's agency model expects you to log in as yourself, so the browser's job there is containment, not disguise. If your account is restricted, the tool you need is the review form in Account Quality, and we'd rather lose the sale than have you buy ours expecting otherwise.

If your ad problem is actually junk traffic on your landing pages rather than an account issue, that's a different product altogether. Our sister tool ClickzProtect handles bot detection for affiliates and traffic operators.

For more on how teams set this up day to day, see the antidetect browser FAQ for teams and agencies.

JustBrowser is $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles, unlimited cloud sync, unlimited team seats. It runs on Windows x64 and macOS (Apple Silicon).

Frequently Asked Questions

Does using a VPN stop Facebook from linking my accounts?

No, and it isn't meant to. A VPN changes your IP address, but platforms look at far more than an IP: browser fingerprint signals such as canvas, WebGL, fonts and audio, plus account details like payment methods, admins and phone numbers. More to the point, if Meta disabled one of your accounts, its terms say not to create another without its permission, and its Community Standards prohibit any account set up to get around a restriction or other enforcement. A VPN doesn't change that rule, it just breaks it.

Am I allowed to have more than one Business Manager?

Meta lets a person belong to more than one business portfolio (the current name for Business Manager), and a single portfolio can hold several ad accounts and Pages. What its terms don't allow is fake personal profiles, or a new account created to get around a restriction. Separate legitimate businesses can each have their own portfolio. Check Meta's Business Help Center for the current limits, because they change.

How do agencies manage client ad accounts properly?

Through partner access. The client keeps ownership of its business portfolio and adds the agency as a partner in Business Settings, then assigns the ad accounts, Pages and pixels the agency needs. Agency staff work under their own real profiles with the permissions the client granted. Nobody shares passwords, and the client can remove access at any time.

How do I appeal a restricted Business Manager or ad account?

Open Account Quality in Meta Business Suite, find the restricted asset, read which policy Meta cites, and use the request-review option if you think the decision is wrong. Fix the actual cause first: a rejected ad, a payment problem, an unverified business or a compromised admin account. Creating a replacement account instead of appealing breaks Meta's terms and usually makes the outcome permanent.

Can an antidetect browser get my restricted account back?

No. An antidetect browser keeps browser profiles separate on one machine, which helps with agency work in client-owned accounts, ad verification across regions, QA and privacy. It isn't an appeal, and using any tool to stand up a replacement advertiser after a restriction breaks Meta's terms. The official review in Account Quality is the only route back.

Try JustBrowser

Native Chromium antidetect browser (not extension-based) for keeping client, QA and personal browsing in separate profiles. Local REST API and CDP for Playwright, Puppeteer and Selenium. Free team seats for running shared profiles. $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles.

Get started → · How it differs from Multilogin / GoLogin / AdsPower