FAQ: Google Ads and GDPR

You should seek independent legal advice relating to your obligations under the GDPR, as only a lawyer can provide you with legal advice specifically tailored to your situation. Please bear in mind that nothing on this website is intended to provide you with, or should be used as a substitute for legal advice.

Introduction to GDPR

  • What is the General Data Protection Regulation and what locations does it affect?

    The General Data Protection Regulation (GDPR) is an evolution of EU privacy law. It came into force on 25th May 2018. Though an EU law, it applies to anyone collecting or processing personal data from consumers in the European Economic Area, so its scope is not limited to EU businesses only. The EEA comprises the EU Member States and Iceland, Liechtenstein, and Norway.

  • What are the key areas to think about in relation to GDPR?

    We are committed to complying with the GDPR and would encourage you to check in on compliance plans within your own organisation. Key areas to think about:

    • How does your organisation ensure user transparency and control around data use?
    • How does your organisation explain to the users the benefit of sharing data?
    • Are you sure that your organisation has the right consents in place where these are needed under the GDPR?
    • Does your organisation have the right systems to record user preferences and consents?
    • How will you show to regulators and partners that you meet the principles of the GDPR and are an accountable organisation?
  • What types of data does GDPR apply to in relation to online Ads?

    The GDPR expanded the definition of personal data to include online identifiers such us cookie identifiers, internet protocol addresses and device identifiers. For more information and specifically tailored to your situation, you should seek independent legal advice.

  • What types of data does Google collect and process?

    If you want to find out more about the types of information that Google collects, see our Privacy Policy. For out processor Ads services, see privacy.google.com/businesses/adsservices.

GDPR and Google Ads

  • What are the key changes to Google Ads that I need to be aware of?

    Under Google’s updated EU User Consent Policy, you have a responsibility to make certain disclosures to your users in the European Economic Area (EEA) and obtain their consent where necessary. This includes the use of cookies, where legally required, and for the collection, sharing and use of personal data for ads personalisation. This policy reflects the requirements of the EU ePrivacy Directive and the General Data Protection Regulation (GDPR).

    We have also updated our Help Page for the EU User Consent Policy to address questions we have received from our customers. Please note that there are other implications based on the products that you use, and for more information on how we support our Google Ads customers in their GDPR compliance journey, see Helping advertisers comply with the GDPR.

  • I already have a cookie consent notice on my site, so does anything change?

    We cannot advise on the sufficiency of your consent notice, but generally speaking, GDPR creates requirements beyond the existing cookie banners used today. For more information, please visit cookiechoices.org, which includes suggested consent language that may be appropriate for the consent message that you present to your users. But it will depend on how you use our services, any 3rd party vendors you choose to enable, or other partners you use. It’s important that you seek advice from your own legal counsel on what is appropriate for your site or app.

  • Am I able to share my marketing data with Google Ads?

    Google Ads features, such us Remarketing and Customer Match, give you the ability to build or upload audience lists for targeting on Google media and third party sites. Under our EU User Consent Policy, advertisers that implement remarketing tags or upload data files to create Customer Match audiences are required to obtain consent from users for the collection of data for personalized ads. In addition, advertisers that implement conversion tags for measurement purposes are required to obtain consent for the use of cookies.

    To find out more about how we use data in Google Ads, see:

  • Am I able to delete, and control the membership of, my audience / remarketing lists?

    For information about data deletion and data retention, see the ‘Data collection, deletion and retention controls’ section in Helping advertisers comply with the GDPR.

    For additional questions that relate to the implications of GDPR, we strongly suggest discussing them with your legal advisor. While you will appreciate that we can’t give you legal advice, we are happy to explain our policies and how our products can facilitate your requests and preferences.