Two different things can go wrong with Meta ads, and in the interface they look almost identical. A red flag, some language about policy, a sense that you have done something wrong.
One of them is an afternoon's work. The other one can take your main advertising channel away permanently, and if Meta is where most of your new customers come from, that is not a marketing problem. That is a business continuity problem.
Almost every small business owner we talk to worries about the first one and has never thought about the second. It is worth understanding which is which, because the early warnings for the serious one are visible, unglamorous, and mostly ignored.
A Rejected Ad Is the System Working
Meta reviews every ad before it runs. The review is primarily automated, and Meta's documentation says it is typically completed within 24 hours, though it can take longer.
If the ad is rejected, you edit it or build a new one, and it goes back through review as a new ad. That is the whole process. It is annoying, it is occasionally baffling, and it is not a sign that anything is wrong with your account.
Two things about that review are worth knowing, because both surprise people.
The first is that approval is not permanent. Meta states plainly that ads remain subject to review and re-review at all times, and can be rejected for a policy violation at any point, including after they have been running. An ad that ran fine for three weeks can stop tomorrow. That is not a glitch and it is not personal.
The second is that the review includes your landing page. Meta's Advertising Standards say the review process may cover the ad's images, video, text and targeting, "as well as an ad's associated landing page or other destinations." There is also a separate relevance rule: the products and services promoted in the ad must match the ones promoted on the landing page. So a compliant ad pointing at a page that oversells, or at a page selling something adjacent to what the ad promised, is still a policy problem. The ad is not the whole submission.
The correct response to a rejection is to read the stated reason, change the thing, and resubmit. The incorrect response, and the one that causes real damage, is to delete and rebuild the same ad repeatedly hoping for a different reviewer.
A Restriction Is a Ladder, Not a Switch
This is the part I most want an owner to read, because the mental model almost everyone has is wrong.
People imagine account restriction as binary: you are advertising, and then one morning you are not. Meta's own documentation describes something quite different. Advertising restrictions, in their words, may include limits on the amount you can spend per day or a lower payment threshold, loss of access to some payment features, loss of access to some advertising features, and loss of the ability to advertise at all.
Read that order again. The first rung on the ladder is a spend limit.
That matters enormously, because a daily spend cap does not look like an enforcement action. It looks like a technical hiccup, or a billing quirk, or Meta being weird again. An owner who suddenly cannot push past a certain daily number usually assumes it is a payment issue and works around it. It can be the first visible signal that Meta has flagged the account.
Restrictions applied for unusual activity have their own version of this: limited spending or a lower payment threshold, loss of some payment features, loss of the ability to add admins, partners or users, and loss of the ability to create new ad accounts.
That last one deserves a moment. If you have lost the ability to create new ad accounts, the usual escape route from a disabled account has already been closed before you knew you needed it.
None of this is hidden. It is published. It is just written in a help center nobody reads until something has already gone wrong.
Which Asset Got Hit Decides How Bad It Is
Restrictions do not land on "your account" as a single thing. Meta can restrict four separate assets, and which one it is changes everything about your exposure.
The business portfolio is the container holding your Pages, Instagram accounts, ad accounts and catalogs. If it is restricted, none of it can advertise.
The ad account is where campaigns and billing live. If it is restricted, that account, its ads and some of its assets are disabled.
The Page is the identity your ads run from. Every advertiser needs one. If it is restricted, that Page cannot advertise, which means the ads themselves have nowhere to run from even if the ad account is healthy.
The user account is the individual person. If a person is restricted from advertising, they personally cannot advertise or create ads.
That last one has a detail attached that is worth the price of this entire article. Meta says that when a user account is restricted, any ad accounts where they are the only attached user may also be disabled. But other members of the portfolio, ad account or Page may still be able to advertise.
So a one-person business, with one login attached to everything, has built a single point of failure. If that person gets restricted, whether for something they did in the ad account or something entirely unrelated on their personal Facebook profile, the ad account can go down with them.
Adding a second admin costs nothing and takes four minutes. It is the highest-return piece of housekeeping in this whole article, and nobody does it until after the first bad morning.
You Get a Limited Number of Appeals, and Then It Is Final
Here is the line that changes how you should behave, quoted from Meta's own troubleshooting documentation:
"There is a limited number of times you can request an advertising restriction review and once the review has happened the decision is final."
Limited, and final.
That reframes the whole recovery process. The instinct when an account goes down is to fire off an appeal immediately, then another, then another, on the theory that persistence eventually reaches a human. On Meta, persistence spends a finite resource and then closes the door.
The better sequence is to work out what actually happened first. Meta's Business Support Home shows a "What you can do" section per restricted asset, and often the required step is not an appeal at all. It might be confirming your identity, completing verification, or securing the account. Those steps can reinstate an account without ever touching the appeal count. Only when you understand the reason, and genuinely believe the decision is wrong, do you spend a review.
One practical note that catches people at the worst moment: you must be an admin on the account to request a review. If the only admin is a former employee, an agency you have parted ways with, or an account nobody can log into, you cannot even start.
There Is a Clock, and It Runs Out
If an ad account is disabled for a policy violation and stays ineligible for reinstatement for six months, Meta's documentation states that unused prepaid balances may be forfeited where allowed by law, and after that period the account cannot be reinstated at all. Meta also reserves the right to disable an account permanently before the six months are up.
That is the honest worst case, stated plainly and then left alone. It is not the likely outcome of a rejected ad, and it is not where most restrictions end up.
It matters for one practical reason. "Ineligible for reinstatement" is not the same as "waiting in a queue." An account sitting unresolved is not quietly working its way toward a resolution; it is running down a clock while you assume somebody is looking at it. That is why recognizing the early rungs of the ladder is worth more than knowing how to appeal, and why the twenty minutes of prevention at the end of this article is the cheapest insurance in your account.
Most of What Gets a Small Business Restricted Is Not the Creative
If you ask an owner why an ad account might get restricted, they will describe something about the ad: a claim that was too strong, an image that was too much, a before-and-after photo.
Meta's own list of triggers is mostly about something else entirely. Alongside policy violations, they name suspected compromised or hacked accounts, failure to meet two-factor authentication requirements, unusual payment or account activity, and high rates of failed or disputed payments.
Three of those four have nothing to do with advertising.
The two-factor one is worth calling out specifically, because it is the most avoidable restriction on the list. Meta's documentation says that users of a business portfolio more than 90 days old may need two-factor authentication enabled to meet security requirements, and that access to Business Suite tools may be restricted if it is not. An advertising restriction caused by not turning on 2FA is a genuinely silly way to lose a week.
The payments one is the other quiet killer. A card that fails repeatedly, or a chargeback because someone in the business did not recognize a Meta charge and disputed it, reads to the system as exactly the pattern it is watching for.
The Categories That Put You on a Shorter Leash
Some businesses are held to stricter rules, and the surprise is how ordinary they are.
Special Ad Categories is the big one. Any US advertiser running ads for housing, employment, or financial products and services must self-identify the campaign as a Special Ad Category and run it with the approved, restricted targeting options. That sounds like it is aimed at banks and property developers. In practice it catches the realtor, the property manager, the recruiter, the staffing agency, the mortgage broker and the insurance agent. Every one of those is a normal local business that may have no idea the designation applies to them, and running those ads without it is a compliance problem rather than a preference.
Lead form fields are the second trap, and this one is easy to walk into with good intentions. Meta prohibits lead ads from requesting a long list of information without prior written permission, including health information, financial information such as income or debt, government-issued identifiers, insurance details, and criminal history. A physiotherapist asking "what is your injury?" or a finance broker asking "what is your current debt?" on a lead form is not being careless with someone's data in their own mind. They are qualifying. Meta reads it as a prohibited field. If your qualifying questions are that specific, they belong after the click rather than inside the form, which is one more reason a landing page beats an instant form for anything that needs real qualification.
There is also a set of categories that require prior written permission before you can advertise at all, including dating, cryptocurrency, online gambling, and addiction treatment, which additionally requires third-party certification in the US.
The Boring List That Prevents Almost All of This
None of this is clever, most of it is free, and all of it is done once.
Turn on two-factor authentication for every user attached to the business portfolio. Add a second admin so no single person is a point of failure. Use a payment method that will not fail, and make sure whoever watches the bank account knows what a Meta charge looks like so nobody disputes one.
Never buy, rent or borrow an aged ad account. Meta's policies explicitly prohibit selling, renting, buying or exchanging administrative access, and the advice circulating about acquiring accounts to escape a restriction is advice to commit a further violation while already under scrutiny.
If you are in housing, employment or financial services in any form, self-identify as a Special Ad Category before you run anything. Check your lead form fields against the prohibited list. Make sure your landing page sells the same thing your ad promised, and that it works.
And keep your own copy of what is running. Not because Meta will lose it, but because rebuilding an account from memory while it is offline is a bad week made worse. If your campaign structure is simple enough to rebuild, that is an argument for keeping it simple in the first place.
What to Actually Do With This
A rejected ad is not an emergency. Read the reason, fix the thing, resubmit, and get on with your day.
A spend limit you did not ask for, a payment feature that disappeared, or a sudden inability to add a user is a different signal entirely. That is the ladder, and the right response is to go and read the "What you can do" section for that asset before anything else changes.
And the prevention work is worth doing this week rather than the week you need it. Two-factor on, second admin added, payment method solid, categories declared, landing page honest. Twenty minutes, once.
We run Meta accounts for small businesses every day, and the ones that never have this problem are not lucky or better at writing ads. They just did the boring parts early. If you would rather have someone watching the account so the first rung of that ladder gets noticed when it appears, that is part of what we do.
