ReferenceGoogle Ads disapproval
Unacceptable information sharing
Google does not allow personally identifiable information, such as an email address, to reach it through remarketing tags, conversion tags or product feeds. Its example is an email address in a URL that a remarketing tag reads. Use the URLs in Google's breach notice email to find the source, take the detail out of those URLs, then tell Google through its response form.
At a glance
- Where it shows
- The Status column on the Ads & assets page for affected ads. Lists built from the tag show their own status in the account.
- What stops
- The ad stops serving, and remarketing lists built from the non-compliant tag are disabled.
- How serious
- Medium. Disabled lists stop targeting. Google warns at least 7 days before any account suspension under this policy.
- How long
- Google says it confirms the fix, or says the detail is still being shared, within two weeks of the response form.
What it means
Google does not allow personally identifiable information to be sent to Google through remarketing tags, conversion tracking tags or product data feeds tied to ads. The policy's example is an email address sent through a URL that has a remarketing tag.
The exemption matters. The rule does not apply to Google Ads services covered by the Google Ads Data Processing Terms, which the policy lists as Enhanced Conversions, Customer Match and store sales. Sending a customer's details through one of those services is a different case from sending them through a tag.
What actually triggers it
A web form submitted with GET
A form sent with the GET method puts every field it collects, the email address included, into the URL of the next page, where a remarketing or conversion tag reads it. Google names web forms as a frequent source and POST as the fix.
A login page with the visitor's details in the URL
A login or account page carries the visitor's email address or other identifier in its address. Google's fix is to replace it with a unique site-specific ID.
Email campaign links that carry the recipient's address
Links in a marketing email add the recipient's email address as a URL parameter so the site can tell who clicked. Google names custom email campaign parameters as a source.
Personal details in a product data feed
A product feed tied to ads carries a customer's personal details, which the policy covers alongside tags.
Fix it in this order
- Open the breach notice email from Google and list the URLs it names. Those URLs show where the detail leaks.
- Switch any web form among them to submit with POST rather than GET, so its fields stay out of the next page's URL.
- On login pages and in email campaign links, replace the email address or other personal detail with a unique site-specific ID or a unique user ID.
- If the detail is needed for matching, send it through a Google Ads service the data processing terms cover, such as Enhanced Conversions or Customer Match, rather than through a tag.
- Fill out Google's response form to say the issue is fixed. Google checks the site and sends another notice within two weeks.
When to appeal
The route here is the response form, sent after the detail is out of every URL the notice named. If the next notice says the detail is still shared, check the URLs again rather than resubmitting. The exemption covers the listed services, not a tag that carries a raw address.
Often confused with
Unauthorized cookies on Google domains
Folded into this page, since it sits on the same policy page. Google does not allow any entity other than Google to set a cookie on a Google domain, such as doubleclick.net or googlesyndication.com, or to enable any other entity to set such a cookie. Google's page gives no fix beyond its general steps for a disapproved ad, so the practical check is the site's scripts and tags: find the one that writes a cookie on those domains and remove it.
European user consent
Consent for EEA and UK visitors, on the same policy page. This page is about personal data sent through tags. That policy is about consent before personalized ads.