How Google uses enhanced conversion data

Google Ads enhanced conversions for web allows you to measure online conversions driven by Google Ads using your first-party data (e.g. purchase, lead). Google is committed to protecting the confidentiality and security of the data that you share with us. This article explains how Google handles the data files that you upload for use in enhanced conversions for web.

Learn more about how Google handles the data that you upload in enhanced conversions for leads.

When you enable Google Ads enhanced conversions for web or enhanced conversion for leads, your Google tags may automatically detect user-provided data from your website and this first-party data will be uploaded to Google for use as described in this article. You can change how your Google tags detect user-provided data any time by following the instructions to set up enhanced conversions for web using the Google tag or set up enhanced conversions for web using Google Tag Manager.

How we handle your data

The data that you upload will be used to match your customers to Google Accounts and report the online conversions driven by Google ad interactions. We'll keep your data confidential and secure using the same industry-leading standards that we use to protect our own users' data.

Here’s how the data you upload is handled:

• Limited data use. Google will only use the data you shared for enhanced conversions to provide you services, including technical support. The data can be used to provide measurement for all Google media (search, video, display) and platforms (AW, DV360, SA360, GA). For example, we'll match the conversion data that you upload with Google ad event data to report conversions. As another example, per your instructions, Google may also combine your enhanced conversions data with data from other measurement products that you use, such as standard conversion tracking, to improve the accuracy of your conversion measurement. We may also make available to you other optional features that use your enhanced conversions data that you can opt in to, such as incrementality studies. For some products, you may also instruct Google to generate Customer Match lists using the data uploaded. Google uses privacy-safe event data for the overall benefit of advertisers for certain features such as automated bidding to improve their overall quality and accuracy and for spam and invalid activity detection. Google may use privacy-safe event data to ensure compliance with our enhanced conversions policies.
• Limited data access. Google uses encryption and employee access controls to protect your data from unauthorised access.
• Limited data sharing. Google won’t share your data with other advertisers. Where required, we may share this data to meet any applicable law, regulation, legal process or enforceable governmental request.
• Data security. Google is committed to ensuring that the systems that we use to store your data remain secure and reliable. We've dedicated security engineering teams to protect against external threats to our systems, and we store all your data in an encrypted format to protect against unauthorised access.

About the data sharing process

Here are more details about the matching process and how we process the data shared to Google. When using the Google tag:

• We only allow tags to share conversion events if sent using an HTTPS protocol, the industry standard for secure data transmission.
• Email, phone number and address matching: For matching based on your customers’ data, Google maintains the email addresses for Google accounts and the corresponding hashed strings. After you've uploaded your data with hashed email addresses, Google Ads will compare each hashed string in your data with the hashed string of Google Accounts. If there's a match, we'll mark those conversion records as matched.
• Google will use the matched conversion records to combine with ad click/event information in your account to report online conversions driven by Google Ads.

If you're using enhanced conversions API to deliver data to Google, you will be responsible for putting together your data:

• Customer data needs to be hashed using the SHA256 algorithm, which is the industry standard for one-way hashing.
• Only the personally identifiable customer data, such as email, phone numbers, first name and surname and street address, should be hashed. Please don't hash country, region, city and postcode data.
• Email matching: For matching based on your customers’ email addresses, Google maintains the email addresses for Google accounts and the corresponding hashed strings for those email addresses. After you've uploaded your data with hashed email addresses, Google Ads will compare each hashed string in your data with the hashed string or email address of Google Accounts. If there's a match, we'll mark those conversion records as matched.
• Address matching: For matching based on your customers’ mailing addresses, Google joins hashed name and address information for Google Accounts to construct a matching key. After you've sent data with hashed customer names and addresses (don’t hash postcode, city, region and country data), Google constructs a similar key based on your data and then compares each key in your data with the keys based on Google Accounts. If there's a match, we'll mark those conversions as matched.
• Phone matching: Similar to email matching, Google maintains the phone numbers for Google accounts and the corresponding hashed strings for those phone numbers. After you've uploaded your data with hashed phone numbers, Google Ads will compare each hashed string in your data with the hashed string or phone numbers of Google accounts. If there's a match, we'll mark those conversion records as matched.
• Google will use the matched conversion records to combine with ad click/event information in your account to report online conversions driven by Google Ads.

About enhanced conversions for leads

How we handle your data

The data that you upload will be used to match your offline customer conversions to clicks that landed on your website and submitted a lead form. This matching allows you to report offline conversions driven by Google ad interactions. We'll keep your data confidential and secure using the same industry-leading standards that we use to protect our own users' data.

Here’s how the data you upload is handled:

• Limited data use. Google will only use the data that you shared for enhanced conversions for leads to provide you services, including technical support. The data can be used to provide measurement for all Google media (search, video, display). For example, we'll match the conversion data that you upload with Google ad event data to report conversions. As another example, per your instruction, Google may also combine your enhanced conversions for leads data with data from other measurement products that you use, such as standard conversion tracking, to improve the accuracy of your conversion measurement. We may also make available to you other optional features that use your enhanced conversions data that you can opt in to, such as incrementality studies. For some products, you may also instruct Google to generate Customer Match lists using the data uploaded. Google uses privacy-safe event data for the overall benefit of advertisers for certain features such as automated bidding to improve their overall quality and accuracy and for spam and invalid activity detection. Google may use privacy-safe event data to ensure compliance with our enhanced conversions policies.
• Limited data access. Google uses encryption and employee access controls to protect your data from unauthorised access.
• Limited data sharing. Google won’t share your data with other advertisers. Where required, we may share this data to meet any applicable law, regulation, legal process or enforceable governmental request.
• Data security. Google is committed to ensuring that the systems that we use to store your data remain secure and reliable. We've dedicated security engineering teams to protect against external threats to our systems, and we store all your data in an encrypted format to protect against unauthorised access.

About the data sharing process

Here are more details about the matching process and how we process the data shared to Google. When using the Google tag:

• We only allow tags to share form events if sent using an HTTPS protocol, the industry standard for secure data transmission.
• Email and phone number storage: Google maintains the corresponding hashed strings of email addresses or phone numbers from configured website form events.
• Google will use the hashed strings for matching to uploaded offline conversions, combined with ad click/event information in your account to report offline conversions driven by Google Ads.

When using enhanced conversions for leads API or file upload to deliver offline data to Google, you will be responsible for putting together your data:

• Customer data needs to be hashed using the SHA256 algorithm, which is the industry standard for one-way hashing.
• Only the personally identifiable customer data, such as email and phone numbers, should be hashed.
• Email matching: After you've uploaded your data with hashed email addresses, Google Ads will compare each hashed string in your data with the hashed string sent from previous website form events. If there's a match, we'll mark those conversion records as matched.
• Phone matching: After you've uploaded your data with hashed phone numbers, Google Ads will compare each hashed string in your data with the hashed string sent from previous website form events. If there's a match, we'll mark those conversion records as matched.
• Google will use the matched conversion records to combine with ad click or event information in your account to report offline conversions driven by Google Ads.

Data security certifications

ISO 27001

Google has earned ISO 27001 certification for the systems, applications, people, technology, processes and data centres serving a number of Google products, including enhanced conversions.Download the Google Ads/Analytics Scope Expansion Certificate – ISO27001 (PDF)

Last updated: March 2023