Understanding PII in Google's contracts and policies

Many contracts, terms of service, and policies for Google's advertising and measurement products refer to "Personally Identifiable Information" (PII). You may find in such contracts, terms of service, and policies a prohibition against passing information to Google that Google could use or recognize as PII.

This article explains how Google will interpret the term PII in the event PII isn't defined in your existing contract or the applicable product's terms of service or policies. This is to minimize confusion among customers, particularly in light of the EU's General Data Protection Regulation (the GDPR) which expanded the definition of "personal data" under EU law as of May 25, 2018. 

What Google considers PII

Google interprets PII as information that could be used on its own to directly identify, contact, or precisely locate an individual. This includes:

  • email addresses
  • mailing addresses
  • phone numbers
  • precise locations (such as GPS coordinates - but see the note below)
  • full names or usernames

For example, if you're a publisher whose contract prohibits you from passing PII to Google, the URLs of pages on your website that display ads by Google must not include email addresses, because those URLs would be passed to Google in any ad request. Google has long interpreted its PII prohibition in this way.

Note: Certain product's help centers and policies set out the limited means by which certain forms of PII may be sent to Google. For avoidance of doubt, this article does not amend such provisions. So, for example, certain products allow precise location data to be sent to Google, provided the requirements of the applicable policies are met.

Google interprets PII to exclude, for example:

  • pseudonymous cookie IDs
  • pseudonymous advertising IDs
  • IP addresses
  • other pseudonymous end user identifiers

For instance, if an IP address is sent with an ad request (which will be the case with almost any ad request as a consequence of internet protocols), that transmission will not breach any prohibition on sending PII to Google.

Note that data excluded from Google's interpretation of PII may still be considered personal data under the GDPR.

Was this helpful?
How can we improve it?