The changes include a tightened verification process that will require anyone wanting to run ads pertaining to elections, politics or big social issues like guns and immigration to confirm their identity and prove they are in the U.S. Beginning in mid-September, such advertisers confirm their group’s identity using their organization’s tax identification number or other government ID.

The verified group name will be listed on the “paid for by” disclaimers that disclose the backers of ads. Facebook says it will verify this information against government records and will note in the disclaimer for confirmed ads that they’re placed by a “confirmed organization.”

That process won’t apply to everyone, as Facebook says it would bar some smaller but legitimate groups from advertising. But a loophole that will allow small grassroots groups and local politicians to run political ads could also continue to allow bad actors to take advantage of the process.

Advertisers who don’t have tax ID numbers, government websites or registrations with the Federal Election Commission will still be able to post ads by providing an address, verifiable phone number and business email. These advertisers won’t get a “confirmed” designation. Previously, only a U.S. address was required. But it’s not inconceivable that bad actors will find a way to spoof phone numbers and email addresses.

“We’ve acknowledged that these tools will not be perfect,” Sarah Schiff, a Facebook product manager, said in an email. “But we are committed to making it more difficult for bad actors to misuse and abuse our platform” without penalizing smaller organizations.

Schiff also reiterated the company’s calls for regulation of online political advertising. Critics have said that Facebook’s attempts at self-regulation are merely a way for the company to pre-empt stricter government crackdowns.

Last month, Facebook was ordered to pay a S5 billion fine to the Federal Trade Commission over privacy violations. It also faces a series of other investigations into its privacy practices in Europe and across the U.S., in addition to new investigations into its allegedly anticompetitive behavior, such as the social network’s habit of buying would-be rivals like Instagram and blatantly duplicating features introduced by competing services.

While the company has beefed up its fight against misinformation and coordinated attacks by malicious nation-states, the same can be said for those trying to game its systems. After revelations that that Russians bankrolled thousands of fake political ads during the 2016 elections, Facebook and other social networks faced intense pressure to ensure that doesn’t happen again.

In late 2017, Facebook said it will verify political ad buyers by requiring them to confirm their names and locations, the latter by receiving a postcard with a confirmation code at a U.S. address. Page administrators also had to be verified.

But critics said the rules were easy to evade. Last fall, for instance, Vice News was able to place ads on behalf of the likes of Vice President Mike Pence and the Islamic State, which were all approved by Facebook.

More must-read stories from Fortune:

—Will gaffes hurt Biden’s chances of a 2020 win? Strategists are divided
—These are the 2020 senate races to watch
—What is BDS? Boycott, Divestment, and Sanctions explained
—When does Congress reconvene? August recess, explained
—Trump thinks he is winning the trade war, but the data tell a different story
Get up to speed on your morning commute with Fortune’s CEO Daily newsletter.