What whitelisting actually is, in plain mechanical terms
Whitelisting is a brand running paid ads from your handle instead of their own. Your name and profile photo sit in the advertiser slot — their money and targeting sit behind it.
Mechanically, you grant it through a platform permission, never a password. TikTok does it with a per-video authorization code (Spark Ads). Meta does it with partnership-ads permissions linking your account to their Business Manager — you'll also hear "allowlisting." Either way, the ad platform treats the brand's campaign as if your account published it.
The frame that keeps you safe: whitelisting is a second product. The first thing you sold was a video. This is access to your identity — and brands want it because ads from a person outperform ads from a logo. Sell it knowingly: separate scope, separate end date, separate fee. What to charge lives in usage rights and whitelisting pricing; this guide is what you're actually handing over.
How TikTok Spark Ads codes actually work
A Spark Ads code is a per-video, time-limited authorization — not account access. You generate it inside the TikTok app; the brand redeems it in their own Ads Manager.
Your side of the flow:
- Turn on ad authorization once: Settings and privacy → Creator tools → Ad settings.
- On the specific video: tap the three dots → Ad settings → authorize the post.
- Pick the authorization window — options run from 7 days up to a year.
- Generate the video code and send it to the brand.
The brand pastes that code into TikTok Ads Manager and can now run your post as a Spark Ad — their budget, their audiences, your handle on the creative.
Two mechanics matter here. The code covers that one video, nothing else on your account. And when the window expires, the ad stops delivering — the brand has to come back to you to extend. Match the code window to the usage term you sold. A 365-day code on a 30-day license is an 11-month extension you never invoiced.
How Instagram and Facebook partnership ads access works
Meta's version comes in two levels — post-level and account-level — and they are very different grants.
Post-level is the tame one. You publish with the paid-partnership label, approve the brand as a partner in your branded-content settings, and flip the toggle that lets them boost that post. Newer versions of the flow let you generate a partnership ad code for a single post or Reel — closer to how TikTok handles it. Either way, the brand can only put spend behind that one piece of content.
Account-level allowlisting runs through Meta Business Manager. The brand sends a partner request; you approve it and choose which permissions their business gets on your professional account or Page. Grant only the ads permission. With it, they can create ads that run from your handle — including dark posts: ad-only variations that never appear on your grid.
The big difference from TikTok: account-level Meta access isn't tied to one video and doesn't expire on a timer. It lasts until you remove it.
What a brand can do with whitelisted access — and what it can't
Whitelisting hands the brand control of the advertising around your handle — targeting, spend, destination. It does not hand them your account.
What they can do:
- Run ads showing your name and photo as the advertiser.
- Set audiences, budgets, schedules and placements from their own Ads Manager.
- Add a CTA button pointing at their site or shop.
- On Meta, with account-level access: create dark-post variations on your handle that never touch your feed.
What they can't do — assuming you granted access properly, through codes and partner permissions rather than a login:
- Read your DMs or message anyone as you.
- Post to your feed, edit your captions, or delete your content.
- Keep delivering after the Spark window lapses or after you pull the permission.
The gray zone is spillover. Spark Ads promote your real post, so paid comments land on it — their budget can hand you a comment section to moderate. And your name sits on whatever the CTA points at, so click through the landing page before you authorize. If the offer is shady, the screenshots will have your face on them.
How to revoke access when the usage term ends
Revoking is your job, not the brand's — build it into the deal on day one.
On TikTok, expiry mostly handles itself: the authorization ends with the window you set and delivery stops. To end it early, open the video → Ad settings → remove the authorization.
On Meta, nothing expires on its own:
- Post-level: turn off the boost permission on that post, or remove the brand from your approved partners in branded-content settings.
- Account-level: open your Business settings (or Business connections in the Instagram app), find the partner, remove them.
The habit that makes this automatic: when you sign, drop the license end date into your calendar — "revoke [brand] access, offer renewal." If the ad is performing, that reminder isn't an off switch. It's a paid-extension conversation.
The checklist before you hand over any code
Run this every time, before any code or permission leaves your hands:
- Usage term in writing — platforms, start date, end date.
- Code or permission window matches the paid term. Never longer.
- Post-level access unless the deal explicitly pays for account-level dark posts.
- Whitelisting quoted as its own line item, priced above plain paid usage.
- No passwords, ever. Real whitelisting never needs your login — a brand asking for it is a red flag.
- You know where the revoke switch is before you grant access.
If the brand can't name the platforms and the window, they're not ready to whitelist — they're collecting rights they haven't scoped. Make them scope it.
FAQ
Does whitelisting give the brand my password? No — and it never should. Spark codes and Meta partner permissions work entirely inside each platform's ad system. A brand asking you to "just log in real quick" wants account access, which is a different and worse thing. Decline.
Do Spark Ads views and likes count on my video? Yes. Spark Ads promote your actual post, so likes, comments, shares and follows from the paid run accrue to your account. It's part of why brands pay for Spark — and why you should watch your comments while the campaign runs.
Can a brand keep using my video after whitelisting ends? Not from your handle. An expired Spark code stops delivery, and removed Meta permissions end their ability to run ads as you. Running the video from their own account is a separate grant — that's usage rights, not whitelisting.
Should I whitelist in a gifted-product deal? Treat it as paid either way. Whitelisting borrows your identity and feeds their ad account performance data tied to your face — that has value even when the video was a product trade.
How long should I authorize for? Exactly as long as the paid usage term. Thirty days of license, thirty days of code. If the creative performs, the brand will be back to extend — and that's where renewals get paid.