Google has a long history of taking a user-first approach in everything we do. As a part of our commitment to users, we never sell personal information and we give users transparency and control over their ad experiences via My Account and several other features to help you manage your account. Per our Personalized advertising policy, we never use sensitive information to personalize ads. We also invest in initiatives such as the Coalition for Better Ads, the Google News Initiative and ads.txt in order to support a healthy, sustainable ads ecosystem.
Today, we’re building on that feature set by offering restricted data processing, which will operate as set forth below, to help advertisers, publishers, and partners manage their compliance with the California Consumer Privacy Act (CCPA).
About the California Consumer Privacy Act
The California Consumer Privacy Act (CCPA) is a new data privacy law that establishes various rights for California state residents. The law applies to companies that do business in California and meet one of several criteria related to revenue, data processing, and other factors. CCPA requires giving residents the right to opt out of the “sale” of their “personal information” (as the law defines those terms), with the opt-out offered via a prominent “Do Not Sell My Personal Information” link on the “selling” party’s homepage. CCPA does recognize certain exceptions to the definition of “sale,” such that not all transfers of personal information are “sales.” For example, transferring personal information to a “service provider” under the law is not a sale.
About restricted data processing
Restricted data processing is intended to help advertisers, publishers, and partners meet their CCPA compliance needs. With restricted data processing, Google restricts how it uses certain unique identifiers, and other data processed in the provision of services to you, to only undertake certain business purposes. With respect to data to which restricted data processing applies, these business purposes include ad delivery, reporting and measurement, security and fraud detection, debugging, and improving and developing features for the products we offer you. Subject to the terms of our CCPA service provider addendum, we will act as your service provider with respect to data processed while restricted data processing is enabled.
Restricted data processing operates differently across our products. Advertisers, publishers, and partners should ensure that use of Google products and services, including restricted data processing, meets their CCPA compliance requirements. For products where action is required to enable restricted data processing, partners must decide for themselves when and how to enable it. Some may decide to enable restricted data processing on a per-user basis (for example, following a user opt-out by clicking on a “Do Not Sell My Personal Information” link). Alternatively, for products that support it, some partners may decide to enable restricted data processing for all users in California.
Finally, partners who have implemented the Global Privacy Control may choose to enable restricted data processing when they receive a GPC opt-out signal.
Restricted data processing does not extend to the sending or disclosure of data to third parties that you may have enabled in our products and services, and you should ensure that you’ve taken all measures with respect to such third parties as required to meet your CCPA compliance needs. If you have shared data from one Google product with another via product integrations or through other means, data will be subject to the terms of the recipient product once shared.
Products and features that already operate using restricted data processing
These Google Ads products and features already operate using restricted data processing:
No actions are required by users of these products and features.
If you have shared data from one Google product with another via product integrations or through other means, data will be subject to the terms of the recipient product once shared.
Products and features that require action to enable restricted data processing
When you enable restricted data processing, Google will limit how it uses data. Certain features will be unavailable, including adding users to remarketing lists, adding users to similar audience remarketing seed lists, and related functionality. For App campaigns, enabling restricted data processing may mean that the users who install your app will continue to see ads for that app following installation.
Even when you have enabled restricted data processing, ads with third-party ad tracking or third-party ad serving, where eligible to serve (e.g. on the Google Display Network), will serve unless disabled by a publisher. Google’s contractual commitments regarding restricted data processing do not apply to such third-party tracking and serving vendors. You should ensure that you’ve taken appropriate measures with respect to such third parties as required to meet your CCPA compliance needs. For ads serving via cross-exchange for display, Google will not bid on bid requests where a publisher has sent an opt-out signal.
|Product||Enable restricted data processing|
Google Ads offers you two options to enable restricted data processing:
For further details, including examples, please see this article.
|Google Analytics, Google Analytics for Firebase||
If you are a Google Analytics or Google Analytics for Firebase customer, subject to the CCPA service provider addendum, Google Analytics will act as a service provider where you have disabled sharing with Google products and services.
If you export data from Google Analytics or from Google Analytics for Firebase to other products (like Google Ads) as a result of product integrations, that data is subject to the terms of services of those products.Google Analytics offers a collection of tools that enable you to control how data is collected, and whether it is used for advertising personalization. To learn more, please see the Audience list sharing section below or visit the “Advertising Personalization” section in the Google Analytics help center.
If you measure app conversions using the Google Analytics for Firebase SDK, you have two options:
|Google Tag Manager||A new “Enable Restricted Data Processing” field is available in the Google Ads tags (Conversion and Remarketing) in Google Tag Manager. Follow these instructions to set it up.|
*Note: Customers currently using the allow_ad_personalization_signals parameter to enable restricted data processing can continue to do so. However, Google may require use of the restricted_data_processing parameter in the future.
If restricted data processing is enabled in Google Ads, it only applies to audience lists created with the Google Ads tag. If you have audience lists shared with Google Ads from either Google Analytics, Display & Video 360, or Search Ads 360, you’ll need to go to those products to enable restricted data processing for the data that is exported to Google Ads. See the table below for additional details:
Enable restricted data processing for the data that is exported to Google Ads
|Product||How to enable restricted data processing for the data that is exported to Google Ads|
You can control whether your Google Analytics data is used for ads personalization with the following options:
|Display & Video 360||
If you want to disable audience list sharing to Google Ads from Display & Video 360 you have three options in Display & Video 360:
|Search Ads 360||Search Ads 360 does not currently enable exporting audiences to Google Ads for Search. In addition, users located in California won't be added to search-to-display and social-to-display remarketing lists. You can learn more by reading this article.|
About IAB CCPA data processing
Google is not currently a signatory to the IAB Privacy’s Limited Service Provider Contract. We have however integrated with the IAB CCPA Framework v1.0 Technical Specifications for the Google Ads remarketing and conversion tags to read the us_privacy string on advertisers' websites.
Advertisers who choose to use the IAB signal should follow the technical specification provided by the IAB Tech Lab to implement the us_privacy string on their pages. Our Google Ads tags will interact with the advertisers page to retrieve the us_privacy string and apply restricted data processing when the string indicates a user has opted out.
- When the IAB string indicates a user has not opted out, there will be no changes to behavior.
- When the IAB string indicates a user has opted out, Google will enable restricted data processing.