Helping advertisers, publishers, and partners comply with the California Consumer Privacy Act (CCPA)
Google has a long history of taking a user-first approach in everything we do. As a part of our commitment to users, we never sell personal information and we give users transparency and control over their ad experiences via My Account and several other features to help you manage your account. Per our Personalized advertising policy, we never use sensitive information to personalize ads. We also invest in initiatives such as the Coalition for Better Ads, the Google News Initiative and ads.txt in order to support a healthy, sustainable ads ecosystem.
Today, we’re building on that feature set by offering restricted data processing, which will operate as set forth below, to help advertisers, publishers, and partners manage their compliance with the California Consumer Privacy Act (CCPA).
About the California Consumer Privacy Act
The California Consumer Privacy Act (CCPA) is a new data privacy law that establishes various rights for California state residents. The law applies to companies that do business in California and meet one of several criteria related to revenue, data processing, and other factors. CCPA requires giving residents the right to opt out of the “sale” of their “personal information” (as the law defines those terms), with the opt-out offered via a prominent “Do Not Sell My Personal Information” link on the “selling” party’s homepage. CCPA does recognize certain exceptions to the definition of “sale,” such that not all transfers of personal information are “sales.” For example, transferring personal information to a “service provider” under the law is not a sale.
About restricted data processing
Restricted data processing is intended to help advertisers, publishers, and partners meet their CCPA compliance needs. With restricted data processing, Google restricts how it uses certain unique identifiers, and other data processed in the provision of services to you, to only undertake certain business purposes. With respect to data to which restricted data processing applies, these business purposes include ad delivery, reporting and measurement, security and fraud detection, debugging, and improving and developing features for the products we offer you. Subject to the terms of our CCPA service provider addendum, we will act as your service provider with respect to data processed while restricted data processing is enabled.
Restricted data processing operates differently across our products. Advertisers, publishers, and partners should ensure that use of Google products and services, including restricted data processing, meets their CCPA compliance requirements. For products where action is required to enable restricted data processing, partners must decide for themselves when and how to enable it. Some may decide to enable restricted data processing on a per-user basis (for example, following a user opt-out by clicking on a “Do Not Sell My Personal Information” link). Alternatively, for products that support it, some partners may decide to enable restricted data processing for all users in California.
Restricted data processing does not extend to the sending or disclosure of data to third parties that you may have enabled in our products and services, and you should ensure that you’ve taken all measures with respect to such third parties as required to meet your CCPA compliance needs. If you have shared data from one Google product with another via product integrations or through other means, data will be subject to the terms of the recipient product once shared.
The following products already operate using restricted data processing:
- Ads Data Hub
- Audience Partner API (formerly known as DoubleClick Data Platform)
- Authorized Buyers
- Campaign Manager (formerly known as DoubleClick Campaign Manager)
- Display & Video 360 (formerly known as DoubleClick Bid Manager)
- Funding Choices
- Google Ads Customer Match (formerly known as AdWords Customer Match)
- Google Ads Store sales (direct upload) (formerly known as AdWords Store sales (direct upload))
- Google Analytics, Analytics 360, and Analytics for Firebase*
- Google Customer Reviews
- Google Data Studio
- Google Opinion Rewards for Publishers
- Google Optimize, Google Optimize 360
- Google Tag Manager, Google Tag Manager 360
- Open Bidding Buyers (including products formerly known as Exchange Bidding and Network Bidding)
- Search Ads 360 (formerly known as DoubleClick Search)
- Waze Ads
* Where data sharing with Google products and services is disabled.
These products already operate using restricted data processing. No actions are required by users of these products.
The following products require action to enable restricted data processing:
Note that when operating under restricted data processing, certain features and functionalities will not be available.
For more details on a specific product, please see the product-specific help center by following the link for that product in the lists above, as well as the details below:
Ad Manager, Ad Manager 360, AdMob, AdSense
When Ad Manager, Ad Manager 360, AdMob, or AdSense operate under restricted data processing, Google will restrict how it uses certain unique identifiers and other data processed in the provision of services. For example, Google will not create or update profiles for ads personalization or use existing profiles to serve personalized ads relating to data to which restricted data processing applies. Under restricted data processing, programmatic ads won't be served if they utilize third-party ad tracking or third-party ad serving and bid requests will not be sent to third-party programmatic buyers.
All services and features of Funding Choices operate under restricted data processing. In addition, Funding Choices intends to provide a CCPA solution for publishers (including user opt-out gathering and communicating that decision to ad tags) in Q1 2020. You can learn more about it here.
When Google Ads operates under restricted data processing, Google will restrict how it uses certain unique identifiers and other data processed in the provision of services. For example, Google will disable adding to or updating remarketing lists using data to which restricted data processing applies. Ads with third-party ad tracking or third-party ad serving will continue to serve under certain circumstances as detailed in the Google Ads help center. Third-party click tracking will continue to operate as usual, with no changes when restricted data processing is enabled. Note that you should ensure that you’ve taken any measures with respect to such third parties as required to meet your CCPA compliance needs. Additionally, conversion tracking will continue to operate when restricted data processing is enabled.
See the Google Ads help center for more information, including with respect to conversion tracking, and information on how to enable restricted data processing.
Google Analytics, Analytics 360, and Google Analytics for Firebase
Subject to the CCPA service provider addendum, Google Analytics will act as a service provider where you have disabled sharing with Google products and services. Google Analytics offers a collection of tools that enable you to control how data is collected, and whether it is used for advertising personalization. For example, you will be able to restrict data processing for your entire property, for traffic only from certain locations, or for individual events. To learn more, please visit the Google Analytics help center.