Google Ads Data Manager: goodbye mandatory hashing starting November 16

Have you ever lost half of your matches on Google Ads because a phone number had an extra space? Starting November 16, 2026, Google takes care of that problem — but you need to update your data feeds before the change kicks in.

Does this change really affect me, or can I ignore it?

If your company uploads customer lists or offline sales data to Google Ads — even through a CRM or an automated integration — this update concerns you directly and you have a precise deadline: November 16, 2026.

Google Ads Data Manager is the tool companies use to send their first-party data to Google — meaning the data you collected directly: customer email addresses, phone numbers, in-store purchases. Until now, before sending that data, you had to turn it into an unrecognizable code string through a process called SHA-256 hashing (a mathematical function that turns an email into a fixed 64-character string). As of November 16, this step is no longer mandatory.

The change affects anyone who uses Customer Match (the system that turns your customer list into a Google user audience) or the enhanced conversions (the system that attributes a sale to an ad click even when cookies aren't enough). If you use one of these tools, you have a data pipeline to review.

What changes exactly starting November 16?

Google stops requiring data to be already turned into code before sending: it receives them encrypted, opens them in a secure environment, and handles the format cleanup itself.

Until November 15th, the process worked like this: you (or your developer, or your CRM) had to take every email and phone number, apply a series of precise formatting rules — all lowercase, no spaces, phone numbers in the international E.164 format like +393331234567 — and then turn the result into a hash code. Only then could you send it to Google.

Starting November 16, Google accepts data in format encrypted — meaning locked with a key only you own — and processes them inside a Trusted Execution Environment (TEE), an isolated hardware computing environment where not even Google can read the plain-text data. Inside there, the system decrypts, cleans up the format, and looks for matches with Google accounts.

The practical difference: before, an email with one extra capital letter produced a wrong hash and the match failed silently. Now Google handles that cleanup internally, reducing the invisible errors that lower the match rate.

What’s a TEE and why should I trust it?

The Trusted Execution Environment is a hardware enclave certified by independent auditors: not even Google can read the data inside it during processing.

A TEE is a section of the processor physically separated from the rest of the system. The code running inside it is verifiable: anyone can check that it does exactly what it claims, nothing more. Google built its own system — called Confidential Matching — on Google Cloud Confidential Space, which has undergone independent security auditing by the NCC Group, as documented in the official Google Ads Data Manager support .

The encryption key remains in the advertiser's possession. As the Google Ads team stated, "no one, not even the infrastructure provider or Google Ads, has access to the data" — it reports AdExchanger in the coverage of the Confidential Matching launch in September 2024. The TEE was already active for Data Manager since that year: the November change doesn't introduce a new technology, but moves encryption from an option to a default setting.

Why did hashing cause errors and how many matches were lost?

Hashing is intolerant to format errors: a capital letter or an extra space produce a completely different code, and the match fails without you even knowing it.

SHA-256 is a one-way mathematical function: it turns an email into a 64-character string. The exact same email always produces the exact same string — and that is precisely what allows matching with Google data. The problem is that any difference in the input, even a tiny one, produces a completely different string. [email protected]and [email protected]they turn into two hashes that look nothing alike.

According to Google data reported in Customer Match best practices , the typical match rate falls between 29% and 62%. This means that in many cases almost half of your list doesn't find a match — and part of that loss is due to silent formatting errors, not the user's absence on Google.

Using multiple match keys — email, phone, and address together — improves the match rate by 35% compared to using just one. With TEE's automatic normalization, even records with minor formatting errors can be recovered, further expanding your reachable audience. To learn more about how to optimize campaigns in this context, also read our guide on Google Ads Customer Lifecycle Goals .

Three concrete scenarios: what changes for an Italian company?

The impact depends on how you currently built your data submission flow: those using automatic integrations have more work, those uploading files manually have less.

Illustrative examples: numbers are meant to show the reasoning, they are not real customer data.

What tools and paths do you have to adapt?

Google offers three main ways to send data: manual upload, direct CRM connection, and API. Each has different implications for updating.

Google has launched the Data Manager API on December 9, 2025, consolidating data sending for Google Ads, Google Analytics, and Display & Video 360 into a single point. The codeless tool has already served tens of thousands of advertisers. If you haven't centralized your data flows yet, this update is a great time to do it. To understand how it fits into your broader campaign strategy, also read how Google Ads manages priorities and budget allocation by channel .

Are there any risks to my customers' privacy?

The new system is designed to boost protection: data travels encrypted and is processed in an environment not even Google can read.

The fair worry is this: if data used to arrive already hashed (meaning unrecognizable), now it arrives encrypted—and it gets decrypted inside the TEE. This means that, technically, there is a moment when the data is in plain text inside the system. Google addresses this worry with two guarantees: the encryption key stays with the advertiser, and the TEE is a walled-off environment that third parties can verify.

The system is built on Google Cloud Confidential Space , certified by the NCC Group with an independent review. Anyone can verify that the running code only does what it claims. Mismatched data is dropped inside the TEE and never leaves. You can dive deeper into the technical workings in the official documentation on Confidential Matching .

From a GDPR perspective (the European data protection regulation), the processing remains the responsibility of the advertiser as the data controller. Changing the technical format doesn't change your obligations regarding privacy notices and consent from your customers.

Why is Google making this change right now?

The advertising market is shifting toward first-party data — meaning data collected directly by the company — and Google wants to make using them easier and more accurate.

The context is clear: third-party cookies are fading away, and companies that want to run precise ads need to figure out how to use their own data. Over the past two years, Google has built a complete setup for this: first Confidential Matching (September 2024), then the Data Manager API (December 2025), and now encryption by default. Every step lowers the tech barrier for businesses and moves the heavy lifting inside Google's systems.

In September 2026, Google also introduced the metric Data Strength Uplift , which shows the advertiser how many extra conversions they recovered thanks to the first-party data setup. According to the official Google Ads blog , those using Google Tag Gateway see an average +14% increase in tracked conversions; for Demand Gen campaigns, the uplift is over 20%.

This update is part of a series of changes reshaping how Google advertising works. We have already analyzed how Google Ads Local Customer Optimization is changing retail campaigns and how the Google Universal Cart is modifying the direct purchase journey from search . All these updates point in the same direction: more first-party data, more automation, more attribution. You can find a complete overview in the section Marketing and ADV performance .

Where do you concretely start to update your data feeds?

The first step is to understand how you are sending data today: only then can you decide what to change and in how much time.

What are the most common mistakes made in these technical updates?

The most common mistake is waiting for the change to happen on its own: many integrations don't update automatically and keep sending data in the old format.

Here are the issues that crop up every time Google changes data format requirements:

• Assuming that the CRM updates itself. Many CRM-Google Ads connectors apply client-side hashing. If the vendor doesn't release an update, the flow keeps sending hashes instead of encrypted data.
• Don't test before the deadline. November 16 is not an immediate deprecation date with visible errors: the system might keep accepting data, but with a lower match rate. The only way to notice is to actively monitor.
• Forgetting about offline conversions. Those who focus only on customer lists often overlook in-store sales import flows, which use the same mechanisms and require the same updating.
• Don't document the change. If you update the export script without documenting it, the next colleague who touches it might put hashing back in thinking it was missing.

How do you know if the new workflow is working properly?

The most direct sign is the match rate in Google Ads Data Manager: if it goes up after November 16, the system is working better than before.

So, is it really worth updating your data feeds for your business?

It is worth it if you use Customer Match or offline conversions and have an active data stream: updating is a must to avoid losing match rate and attribution. The potential upside—up to a +35% match rate with three keys, +26% incremental ROAS—more than justifies the technical effort.

A middle ground you have a connected CRM but do not manage the integration directly: contact your provider right now to figure out if the update is automatic or needs your action. Do not wait until November 16 to find out.

Not yet if you do not use Customer Match or import offline conversions: this update does not affect you directly. But it is a good time to evaluate whether you are leveraging your first-party data — because those who do get measurable results.

How we see it at SHM

For us, this update confirms a direction we've been following with our clients for a while now: first-party data is the most valuable asset a company has in digital campaigns, and technical complexity shouldn't get in the way of using it right.

We believe that AI and automation should be integrated to free companies from technical routine — like manual hash management — giving time and focus back to strategy. Moving data normalization inside Google's TEE is exactly that: less manual work, fewer silent errors, more measurable results.

In the campaigns we manage, we have repeatedly seen how a low match rate didn't depend on the quality of the customer database, but on small formatting errors accumulated over time. This change removes a source of loss that often went unnoticed.

If you want to audit your data flows before November 16, or want to figure out how to set up a first-party data strategy that works in the long run, you can start with our services for strategic AI integration , by Google Ads campaign management or of Data processing and business intelligence . For an assessment of your specific situation, Write to us .

Frequently Asked Questions

The real problem isn't hashing or encryption: it's how many customers you're losing every month because your data isn't reaching its destination cleanly.