Helping advertisers, publishers, and partners comply with US states privacy laws
Google has a long history of taking a user-first approach in everything we do. As a part of our commitment to users, we never sell personal information and we give users transparency and control over their ad experiences via My Ad Center, My Account and several other features to help you manage your account. Per our Personalized advertising policy, we never use sensitive information like health, race, religion, or sexual orientation to personalize ads. We also invest in initiatives such as the Coalition for Better Ads, the Google News Initiative and ads.txt in order to support a healthy, sustainable ads ecosystem.
In May 2018, we launched several updates to help advertisers and publishers comply with the General Data Protection Regulation (GDPR) in the EEA and the UK.
In 2019, we began offering restricted data processing to help advertisers, publishers, and partners manage their compliance with the California Consumer Privacy Act (CCPA). Starting in January 2023, we are expanding the operation of restricted data processing to help customers and partners comply with the new US states privacy laws as described further below.
About restricted data processing
Restricted data processing is intended to help advertisers, publishers, and partners meet their compliance needs. With restricted data processing, Google restricts how it uses certain unique identifiers, and other data processed in the provision of services to you, to only undertake certain business purposes. With respect to data to which restricted data processing applies, these business purposes include ad delivery, reporting and measurement, security and fraud detection, debugging, and improving and developing features for the products we offer you. Subject to the terms of our U.S. State Privacy Laws Addenda, we will act as your service provider (or processor) with respect to data processed while restricted data processing is enabled.
Restricted data processing operates differently across our products. Advertisers, publishers, and partners should ensure that use of Google products and services, including restricted data processing, meets their US states compliance requirements. For products where action is required to enable restricted data processing, partners must decide for themselves when and how to enable it. Some may decide to enable restricted data processing on a per-user basis (for example, following a user opt-out by clicking on a “Do Not Sell My Personal Information” link). Alternatively, for products that support it, some partners may decide to enable restricted data processing for all users in applicable US states.
Finally, partners who have implemented the Global Privacy Control may choose to enable restricted data processing when they receive a GPC opt-out signal.
Restricted data processing does not extend to the sending or disclosure of data to third parties that you may have enabled in our products and services, and you should ensure that you’ve taken all measures with respect to such third parties as required to meet your compliance needs. If you have shared data from one Google product with another via product integrations or through other means, data will be subject to the terms of the recipient product once shared.
Updates to restricted data processing and CCPA service provider status (July 2023)
Starting July 1, 2023 Google will no longer act as your service provider (in California) under the California Privacy Rights and Enforcement Act of 2020 for cross-context behavioral advertising. This means restricted data processing will no longer be offered for impacted functions, which include the use of customer-provided data for personalized advertising. Impacted features include the following
- Any feature that entails uploading customer data for purposes of matching with Google or other data for personalized advertising (e.g., Customer Match)
- Any feature that entails targeting user lists obtained from a third party (e.g., Audience Partner API)
- Any feature that entails creating, adding to, or updating user lists using first-party customer data (e.g., audience building with floodlight tags and audience-expansion features in DV360)
These changes will be reflected in the existing U.S. State Privacy Laws Addendum to the Google Ads Data Processing Terms and the Google Ads Controller-Controller Data Protection Terms.
The following products already operate using restricted data processing*:
- Ads Data Hub
- Analytics, Analytics 360**
- Audience Partner API
- Authorized Buyers
- Campaign Manager
- Customer Match
- Display & Video 360
- Enhanced Conversions
- Google Customer Reviews
- Google Opinion Rewards for Publishers
- Looker Studio
- Offline Conversion Import
- Open Bidding Buyers
- Optimize, Optimize 360
- Search Ads 360
- Store sales measurement, Store sales (direct upload) measurement
- Tag Manager, Tag Manager 360
- Waze Ads
These products already operate using restricted data processing. No actions are required by users of these products. Note that if you have shared data from one Google product with another via product integrations or through other means, data will be subject to the terms of the recipient product. For example, if you build an audience with Analytics or ADH, and you export to DV360 or Customer Match, restricted data processing may not be available.
*Starting July 1, 2023, restricted data processing will not be available in California where the advertiser engages in cross-context behavioral advertising (e.g. Customer Match, Audience Partner API and cross-context behavioral advertising in Display & Video 360).
** Where data sharing with Google products and services is disabled.
The following products require action to enable restricted data processing:
Note that when operating under restricted data processing, certain features and functionalities will not be available.
- Ad Manager and Ad Manager 360
- Google Ads (other than Google Ads services listed above)
For more details on a specific product, please see the product-specific help center by following the link for that product in the lists above, as well as the details below:
Ad Manager, Ad Manager 360, AdMob, AdSense
When Google Ad Manager, Google Ad Manager 360, AdMob, or AdSense operate under restricted data processing, Google will restrict how it uses certain unique identifiers and other data processed in the provision of services. For example, Google will not create or update profiles for ads personalization or use existing profiles to serve personalized ads relating to data to which restricted data processing applies.
See the product help centers (Ad Manager, AdMob, AdSense) for more information, including how to enable restricted data processing for these products.
When Google Ads operates under restricted data processing, Google will restrict how it uses certain unique identifiers and other data processed in the provision of services. For example, Google will disable adding to or updating remarketing lists using data to which restricted data processing applies. Ads with third-party ad tracking or third-party ad serving will continue to serve under certain circumstances as detailed in the Google Ads help center. Third-party click tracking will continue to operate as usual, with no changes when restricted data processing is enabled. Note that you should ensure that you’ve taken any measures with respect to such third parties as required to meet your compliance needs. Additionally, conversion tracking will continue to operate when restricted data processing is enabled.
See the Google Ads help center for more information, including with respect to conversion tracking, and information on how to enable restricted data processing.
Subject to the U.S. State Privacy Laws Addenda, Google Analytics will act as a service provider (or processor) where you have disabled sharing with Google products and services. Google Analytics offers a collection of tools that enable you to control how data is collected, and whether it is used for advertising personalization. For example, you will be able to restrict data processing for your entire property, for traffic only from certain locations, or for individual events. To learn more, please visit the Google Analytics help center.