Guidance for complying with the Identifying Users Policy
Google offers many advertising products and many types of ad tags. But whichever type of tag you use, there are a few things to bear in mind.
Ad requests typically send a page URL to Google. So make sure that there is nothing featured in your page URLs that shouldn't be sent in ad requests to Google.
Specifically, the Identifying Users Policy states that publishers must not pass any information to Google:
In particular, please make sure that pages that show ads by Google do not contain your visitors' usernames, passwords, email addresses or other personally identifiable information (PII) in their URLs.
Some Google products allow you to add macros, such as the key-values feature of DoubleClick Campaign Manager (DCM) and DoubleClick for Publishers (DFP). Again, you must avoid putting anything into these macros that Google could use or recognise as PII. Failure to comply with this requirement will be treated as a material breach of contract.
Review the following articles for more information: