ReferenceGoogle Ads disapproval
Inadequate data security
Google Ads disapproves a destination that collects card numbers, bank details, national or tax IDs, or Social Security numbers over a page without a valid SSL certificate. Move the page to HTTPS, or stop collecting those details there, then edit the ad and save to resubmit it. Check every page that asks for them, not only the homepage.
At a glance
- Where it shows
- The Status column on the Ads & assets page, as Disapproved.
- What stops
- That ad stops serving until the destination is secure and reviewed.
- How serious
- Violations do not cause immediate suspension. Google gives a warning at least 7 days before any suspension.
What it means
Google expects advertisers to handle personal information with care. The data security part of the policy covers sensitive details collected over a page that is not encrypted. A form on an http address sends what the visitor types without protection, so the policy treats the page as unsafe.
The check follows the page where the data is typed. A secured homepage that sends the visitor to an unsecured booking or payment page is the case to check, because that page is the one collecting the data.
What actually triggers it
A payment form on an http page
A checkout or payment page without a valid SSL certificate, so its address starts with http rather than https.
An ID or tax number form on an unsecured page
A form asking for a national ID, tax ID or Social Security number on a page without SSL.
A secured landing page that hands off to an unsecured form
Not on Google's help page
The ad lands on a secure page, but the form that collects the data is on an unsecured address. Google's page speaks of the destination, so check the page where the data is typed.
Fix it in this order
- Open Campaigns, then Ads, find the Disapproved ad, and note its destination address.
- Open every page that collects card, bank, ID or Social Security details, including forms the destination links to, and check that each address starts with https.
- Either move the form to a secure page with a valid SSL certificate, or stop collecting those details on that page.
- Hover over the ad, select Edit, and select Save to resubmit it for review.
When to appeal
The page describes no formal appeal. For policy questions it recommends contacting Google Ads Support.
Appeal only when the form already sits on a valid HTTPS page and the flag still stands. An unsecured form cannot be argued past this rule.
Often confused with
Compromised sites is about code someone else added to the site. Inadequate data security is about the owner's own form collecting sensitive data over an unsecured connection. The policy page also covers personal information passed in URLs, which is a separate fix: move that data into a form posted with POST.