Customer data policies

This policy applies to advertisers using enhanced conversions (EC) with Floodlight.

References to Search Ads 360 include both the old and new versions of the product.

Collecting customer information

Unless you are an advertiser that sells your products through retailers (see below), you may only upload first-party data, which is defined as customer information that is shared directly with you by the customer. This may be gathered from your websites, apps, physical stores (including offline transaction data), or other places where customers interact with your business.

If you are an advertiser that does not directly sell your products to customers (for example, you are a product manufacturer or a movie studio), you may upload customer information collected by a retailer that sells your products (where customers share their information directly with the retailer). You must (1) ensure in writing that the retailer complies with these policies, and (2) where required by applicable laws, have written agreements in place with such retailers.

If a third party who you have authorized uploads data into your Campaign Manager 360, Display & Video 360, or Search Ads 360 account on your behalf (“Third Party Uploader”), then you must also (1) ensure in writing that the Third Party Uploader complies with these policies, and (2) where required by applicable laws, have written agreements in place with such Third Party Uploaders.

Examples of where you can collect customer data

Customers who purchased an item from your website, app, or physical store
Customers who registered to receive marketing messages
Customers who requested more information / quotes from you
Customers who signed up for an account / your loyalty program

Requirements for collecting customer information

Ensure that you disclose to customer (for example, in your privacy policy) that you share their personally identifiable information (PII) with third parties to perform ad measurement services on your behalf, and that you obtain customer consent for such sharing and use where legally required. You must obtain consent from your end users for the passing and use of any PII you send to Google through enhanced conversions with Floodlight where legally required.
Comply with all applicable laws and regulations, including any data protection or privacy laws, as well as self-regulatory or industry codes that may apply.
You may not upload information that is prohibited by law, including information about minors. Don't upload any data (1) that you know relates to individuals under the age of 13 or (2) that was collected from any site or app directed to children under the age of 13.
You may not upload transaction information related to the sensitive categories, described below. You may only use Floodlight or the Campaign Manager 360 API to upload customer information.
Ensure any data you send Google through enhanced conversions with Floodlight that allows Google to personally identify an individual (such as email, phone numbers, first name and last name, and street address) is hashed using the SHA256 algorithm, which is the industry standard for one-way hashing. Note that country, state, city and zip code data fields themselves should not be hashed.

Restrictions on measurement in sensitive categories

Transactions related to sensitive categories can’t be used for measurement in enhanced conversions.

Sensitive categories include:

Interest or participation in adult activities such as gambling, sexual encounter dating, sexualized theme dating, sexual entertainment, pornography
Sexual behavior or orientation
Racial or ethnic information
Political affiliation
Trade union membership or affiliation, such as trade union membership purchases
Religion or religious belief, such as people's affirmative information on religion or religious beliefs
Negative financial status or situation, such as information indicating that a user has a low credit rating or high debt load
Health or medical information, such as purchases of medical services, prescription drugs or medical devices
Status as a child under 13
The commission or alleged commission of any crime, such as information indicating that a user has a criminal record
Divorce or marital separation, such as transactions related to divorce counseling

What happens if you violate our policies

Compliance review: We may review your business for compliance with these policies at any time. If we contact you to request information related to compliance, you're required to respond in a timely manner and swiftly take any corrective action needed to comply with our policies. We may review all advertiser accounts within an agency to verify compliance and contact the agency manager or advertiser manager to verify compliance.

Notification of non-compliance: If we believe that you're violating these policies, we'll contact the agency manager or advertiser manager to request corrective action. If you fail to make the requested corrections within the time period given, you may be denied the ability to use these products, or your access to your Campaign Manager 360, Display & Video 360, or Search Ads 360 accounts may be limited, or your Campaign Manager 360, Display & Video 360, or Search Ads 360 advertiser may be removed. In cases of serious or repeated violations, these enforcement actions may be taken immediately and without notification.

Was this helpful?

How can we improve it?