For businesses with a presence or advertising efforts in Europe, understanding the General Data Protection Regulation (GDPR) is crucial. This set of rules, introduced by the European Union, aims to enhance the online personal data protection of EU residents. Approved on April 27, 2016, the regulation took full effect across the EU on May 25, 2018. It’s been dubbed “the most important change in data privacy regulation in 20 years.” While we’ve discussed the impact of these stringent data privacy laws on Facebook Advertising, today, we’ll focus on Google Ads (formerly known as Google AdWords).

The Basics

Simple intent-based search doesn’t necessitate personally identifiable information. At present, a search query isn’t considered “personal,” regardless of its content.

As long as you’re not utilizing remarketing or conversion tracking, no action is required from your end. Google, as the controller (the entity handling personal data), manages the data processing, with no involvement of a processor (an entity that processes data for a controller). Your role is essentially passive. This setup is beneficial for large-scale branding campaigns like those run by Coca-Cola, where impressions are the primary metric. However, it’s less advantageous for small businesses.

The situation becomes more complex when you aim to extract insights or segment audiences based on the concrete business value generated by the clicks you’re paying for.

Cookies, Remarketing, and RLSA

Do you utilize Google Analytics, Tag Manager, or the Google Ads Remarketing code on your website to build high-value, bottom-of-the-funnel audiences? (Hopefully, the answer is yes…)

If you do, obtaining user consent is mandatory. Per Google, “Advertisers utilizing AdWords are required to secure consent for cookie usage where legally mandated, as well as for the gathering, sharing, and use of personal data for tailored advertisements targeting users in the EEA. This encompasses the use of remarketing and conversion tags. When required by law, advertisers must also transparently identify all parties that might gather, receive, or utilize the personal data of end users.” To put it simply, if you employ any Google product to monitor the on-site behaviors of potential customers to deliver personalized ads later, obtaining their consent beforehand is essential.

Exceptions: Customer Match and Store Sales

There are two scenarios – Customer Match and uploaded Store Sales data – where Google acts as both a controller and a processor of personal data. This means they determine how data is used while also processing data that you control. Their official statement on this is (keep in mind that you are considered “the customer” in this context): “In cases where we handle end user personal data, both the customer and Google function as independent controllers under the GDPR**, with the exception of the Customer Match and Store sales (direct upload) features, where Google operates as the customer’s processor for customer-provided personal data**.” Consequently, in these situations, you bear the responsibility of ensuring that the data Google processes adheres to GDPR regulations. Customer Match is a feature that allows you to upload a CSV file containing customer data for targeting specific groups within Google Ads.

Given that you’re relying on far-from-anonymous data to build your Customer Match audience (email, phone number, name, and zip code are all quite identifying), demonstrating that you obtained explicit, opt-in consent from each individual in your database is crucial; this responsibility lies solely with you, not Google. Store Sales refers to the capability of importing offline transaction details into Google Ads. Google then matches this data with Google Ads user information to create potent audiences for optimization, upselling, and cross-selling.

Besides the same personally identifiable information used in Custom Audiences, Store Sales data might include financial details. Therefore, acquiring informed consent under GDPR is unequivocally necessary. While the majority of advertisers don’t utilize these valuable tools, those who do must be prepared to prove to potential auditors that the information provided to Google for processing on their behalf is compliant.

Moving Forward

The GDPR represents one of the most comprehensive and ambitious consumer protection initiatives ever undertaken. Although the implementation of the GDPR might pose greater challenges for some businesses than others (such as large companies offering “big data” products), it’s vital to remember that this legislation aims to safeguard user rights at a time when virtually every aspect of our lives is stored online – making it susceptible to breaches and exploitation. The regulations came into effect on May 25th. If you haven’t begun preparing your Google Ads account (and landing pages) for these changes, it’s highly recommended that you start now.

The Complete Guide to the GDPR for Advertisers

For more guidance on…

• Understanding the GDPR
• The Impact of GDPR on Google Ads
• The Impact of GDPR on Facebook
• Acquiring Consent from Paid Traffic