The General Data Protection Regulation (GDPR) is an evolution of EU privacy law. It came into force on 25th May 2018. Though an EU law, it applies to anyone collecting or processing personal data from consumers in the European Economic Area, so its scope is not limited to EU businesses only. The EEA comprises the EU Member States and Iceland, Liechtenstein, and Norway.

We are committed to complying with the GDPR and would encourage you to check in on compliance plans within your own organisation. Key areas to think about:

• How does your organisation ensure user transparency and control around data use?
• How does your organisation explain to the users the benefit of sharing data?
• Are you sure that your organisation has the right consents in place where these are needed under the GDPR?
• Does your organisation have the right systems to record user preferences and consents?
• How will you show to regulators and partners that you meet the principles of the GDPR and are an accountable organisation?

The GDPR expanded the definition of personal data to include online identifiers such us cookie identifiers, internet protocol addresses and device identifiers. For more information and specifically tailored to your situation, you should seek independent legal advice.

If you want to find out more about the types of information that Google collects, see our Privacy Policy. For out processor Ads services, see privacy.google.com/businesses/adsservices.

Under Google’s updated EU User Consent Policy, you have a responsibility to make certain disclosures to your users in the European Economic Area (EEA) and obtain their consent where necessary. This includes the use of cookies, where legally required, and for the collection, sharing and use of personal data for ads personalisation. This policy reflects the requirements of the EU ePrivacy Directive and the General Data Protection Regulation (GDPR).

We have also updated our Help Page for the EU User Consent Policy to address questions we have received from our customers. Please note that there are other implications based on the products that you use, and for more information on how we support our Google Ads customers in their GDPR compliance journey, see Helping advertisers comply with the GDPR.

We cannot advise on the sufficiency of your consent notice, but generally speaking, GDPR creates requirements beyond the existing cookie banners used today. For more information, please visit cookiechoices.org, which includes suggested consent language that may be appropriate for the consent message that you present to your users. But it will depend on how you use our services, any 3rd party vendors you choose to enable, or other partners you use. It’s important that you seek advice from your own legal counsel on what is appropriate for your site or app.

Google Ads features, such us Remarketing and Customer Match, give you the ability to build or upload audience lists for targeting on Google media and third party sites. Under our EU User Consent Policy, advertisers that implement remarketing tags or upload data files to create Customer Match audiences are required to obtain consent from users for the collection of data for personalised ads. In addition, advertisers that implement conversion tags for measurement purposes are required to obtain consent for the use of cookies.

To find out more about how we use data in Google Ads, see:

• How Google uses Customer Match data
• How Google uses remarketing data

• How Google uses conversion event data

For information about data deletion and data retention, see the ‘Data collection, deletion and retention controls’ section in Helping advertisers comply with the GDPR.

For additional questions that relate to the implications of GDPR, we strongly suggest discussing them with your legal advisor. While you will appreciate that we can’t give you legal advice, we are happy to explain our policies and how our products can facilitate your requests and preferences.