Customer Match lets you show ads to your customers based on data about those customers that you share with Google. We understand the importance and sensitivity of your customers' data, and we're committed to protecting the confidentiality and security of the data you share with us. This article explains how we handle the data files you upload for use in Customer Match.
How we handle your data
The data files you upload will only be used to match your customers to Google accounts and to ensure your Customer Match campaigns comply with our policies. We'll keep your data confidential and secure using the same industry-leading standards we use to protect our own users' data.
More specifically, here is how we treat the data files you upload:
- Limited data use. We won’t use your data files for any purpose other than to create your Customer Match audiences and ensure compliance with our policies. We won’t use your data files to build or enhance profiles of your customers.
- Limited data access. We won't share your data files with other Google teams other than to create your Customer Match audiences and ensure compliance with our policies. We use employee access controls to protect your data files from unauthorized access.
- Limited data sharing. We won’t share your data files with any third party, including other advertisers. We may share this data to meet any applicable law, regulation, legal process or enforceable governmental request.
- Limited data retention. We won’t retain your data files for any longer than necessary to create your Customer Match audiences and ensure compliance with our policies. Once those processes are complete, we'll promptly delete the data files you uploaded via the Display & Video 360 interface or the API.
We are also committed to ensuring that the systems we use to store your data files remain secure and reliable. We have dedicated security engineering teams to protect against external threats to our systems, and we store all your data files in an encrypted format to protect against unauthorized access.
We won’t use the fact that a Google user is in your Customer Match audiences to build or enhance profiles about that user, and we won’t share that a Google user is in your Customer Match audiences with any third party, including other advertisers. When generating your similar audiences, we may compare the profiles of the Google users in your Customer Match audience with the profiles of other Google users.
Security certifications
ISO 27001
Google has earned ISO 27001 certification for the systems, applications, people, technology, processes and data centers serving a number of Google products, including Customer Match. Download the Google Ads/Analytics Scope Expansion Certificate 2016 — ISO27001 (PDF) certificate or learn more about ISO 27001.
About the email matching process
Here are more details about the matching process and how we process the files you upload:
- You're responsible for putting together your customer data files. You may upload a list of email addresses that you have already hashed using the SHA256 algorithm, or, if you upload a list of email addresses in plain text, Google Marketing Platform will hash them for you using the same SHA256 algorithm, which is the industry standard for one-way hashing.
- You must upload the data file using Display & Video 360. We use Transport Layer Security (TLS) for your upload, which is the industry standard for securely transferring files.
- For matching based on your customers’ email addresses, Google maintains the email addresses for Google accounts and the corresponding hashed strings for those email addresses. After you've uploaded your list of email addresses, we compare each hashed string on your list with the hashed string or email address of Google accounts. If there's a match, we add the corresponding Google account to your Customer Match audience. If an email address doesn't match, we may still use it as part of our policy compliance checks, but we won't otherwise use it for Customer Match or any other Google product. The matching process can take up to 24 hours.
- After the matching process and policy compliance checks are complete, your data file is marked for deletion.
- You can then start targeting your Customer Match audience in your eligible campaigns.
- You can also start targeting similar audiences if your Customer Match audience meets the eligibility requirements.
Last updated: July 2020