This policy applies to advertisers using enhanced conversions (EC) with Floodlight.
Collecting customer information
Unless you are an advertiser that sells your products through retailers (see below), you may only upload first-party data, which is defined as customer information that is shared directly with you by the customer. This may be gathered from your websites, apps, physical stores (including offline transaction data), or other places where customers interact with your business.
If a third party who you have authorized uploads data into your Campaign Manager 360, Display & Video 360, or Search Ads 360 account on your behalf (“Third Party Uploader”), then you must also (1) ensure in writing that the Third Party Uploader complies with these policies, and (2) where required by applicable laws, have written agreements in place with such Third Party Uploaders.
Examples of where you can collect customer data
- Customers who purchased an item from your website, app, or physical store
- Customers who registered to receive marketing messages
- Customers who requested more information / quotes from you
- Customers who signed up for an account / your loyalty program
Requirements for collecting customer information
- Ensure that you disclose to customer (for example, in your privacy policy) that you share their personally identifiable information (PII) with third parties to perform ad measurement services on your behalf, and that you obtain customer consent for such sharing and use where legally required. You must obtain consent from your end users for the passing and use of any PII you send to Google through enhanced conversions with Floodlight where legally required.
- Comply with all applicable laws and regulations, including any data protection or privacy laws, as well as self-regulatory or industry codes that may apply.
- You may not upload information that is prohibited by law, including information about minors. Don't upload any data (1) that you know relates to individuals under the age of 13 or (2) that was collected from any site or app directed to children under the age of 13.
- You may not upload transaction information related to the sensitive categories, described below. You may only use Floodlight or the Campaign Manager 360 API to upload customer information.
- Ensure any data you send Google through enhanced conversions with Floodlight that allows Google to personally identify an individual (such as email, phone numbers, first name and last name, and street address) is hashed using the SHA256 algorithm, which is the industry standard for one-way hashing. Note that country, state, city and zip code data fields themselves should not be hashed.
Restrictions on measurement in sensitive categories
Transactions related to sensitive categories can’t be used for measurement in enhanced conversions.
Sensitive categories include:
- Interest or participation in adult activities such as gambling, sexual encounter dating, sexualized theme dating, sexual entertainment, pornography
- Sexual behavior or orientation
- Racial or ethnic information
- Political affiliation
- Trade union membership or affiliation, such as trade union membership purchases
- Religion or religious belief, such as people's affirmative information on religion or religious beliefs
- Negative financial status or situation, such as information indicating that a user has a low credit rating or high debt load
- Health or medical information, such as purchases of medical services, prescription drugs or medical devices
- Status as a child under 13
- The commission or alleged commission of any crime, such as information indicating that a user has a criminal record
- Divorce or marital separation, such as transactions related to divorce counseling
What happens if you violate our policies
Compliance review: We may review your business for compliance with these policies at any time. If we contact you to request information related to compliance, you're required to respond in a timely manner and swiftly take any corrective action needed to comply with our policies. We may review all advertiser accounts within an agency to verify compliance and contact the agency manager or advertiser manager to verify compliance.
Notification of non-compliance: If we believe that you're violating these policies, we'll contact the agency manager or advertiser manager to request corrective action. If you fail to make the requested corrections within the time period given, you may be denied the ability to use these products, or your access to your Campaign Manager 360, Display & Video 360, or Search Ads 360 accounts may be limited, or your Campaign Manager 360, Display & Video 360, or Search Ads 360 advertiser may be removed. In cases of serious or repeated violations, these enforcement actions may be taken immediately and without notification.