Facebook is hoping to avoid another privacy scandal by adding new accountability and transparency requirements for businesses that use its Custom Audiences too to target you with ads based on your email address or phone number. Starting July 2nd, advertisers will have to declare whether contact info uploaded for ad targeting was collected with proper user consent by them, one of their partners or both. Users will be able to see this info if they opt to block future ads from that business.

Companies can only share Custom Audiences info with partners like ad agencies if they’re formally connected through Facebook’s business manager tool. And Facebook will start to show advertisers reminders that they need consent for contact info ad targeting and force all users connected to an ad account to confirm these terms.

The new consent tool launch confirms TechCrunch’s scoop from March that Facebook would crack down on Custom Audiences targeting without consent. Facebook has always technically required consent, but it hasn’t necessarily done much to enforce those rules. That same approach to API rules produced the Cambridge Analytica debacle. Facebook began to safeguard Custom Audiences a few months ago when it blocked third-party data brokers like Datalogix and Acxiom from work with Facebook to upload data sets as Partner Categories that advertisers could target. But that still let businesses just upload the same data themselves.

[Update: Two days after the March announcement, Facebook also announced it would be shutting down Managed Custom Audiences, which let data brokers upload data sets on behalf of marketers. But in doing so, Facebook also formalized its policy that advertisers could still buy these data sets from data brokers and upload them themselves.]

Custom Audiences is one of Facebook’s most valuable revenue generators because it allows businesses to hit up their former customers to buy more. A scandal surrounding the targeting mechanism could be seriously detrimental to the social network’s business in a way that the rest of its recent public image problems haven’t, judging by the recovery of Facebook’s share price.

Since 2012, Facebook has offered Custom Audiences as a way for businesses to upload privacy-safe hashed lists of customer contact info. Facebook matches that against its users’ info to show them the business’ ads, rather than companies having to pay to try to reach those people through demographic targeting. That way, a company that already sold you a car and got your email signup could target you a few years later with ads to trade in and buy a new vehicle. Businesses can also use Facebook’s lookalikes targeting to reach people with similar characteristics to their existing customers.

Now at least Facebook will show this “Original Data Source” field asking who collected the uploaded phone numbers or emails. Users can check out this info if they click the “Why Am I Seeing This Ad?” button in the drop-down. However, Facebook stops short of scanning the lists for suspicious info, such as blocks of contact info that match hacked or purchased data sets.

That means Facebook is trusting advertisers to tell the truth about consent for targeting… despite them having a massive financial incentive to bend or break those rules. Today’s update will give Facebook more plausible deniability in the event of a scandal, and it might deter misuse. But Facebook is stopping short of doing anything to actually prevent non-consensual ad targeting.