Google Ads Enhanced Conversions: GDPR Legality

Technical Brief : Google Ads Enhanced Conversion

Google Ads Enhanced Conversions operates by augmenting standard conversion pings with first-party customer data—primarily email addresses, physical street addresses, and phone numbers. Advertisers implement this mechanism either through automated Document Object Model (DOM) scraping, Google Tag Manager (GTM) data layer variables, or direct server-to-server API pipelines. Before transmission to Google endpoints (e.g., googleads.g.doubleclick.net), the client script normalizes and hashes this data using the SHA-256 cryptographic algorithm.

A pervasive compliance misconception across e-commerce engineering teams is that cryptographic hashing converts personal data into anonymous data, thereby bypassing Regulation (EU) 2016/679 (GDPR). Under established European case law—specifically CJEU Case C-582/14 (Breyer) and EDPB Guidelines 05/2020—SHA-256 hashes remain pseudonymous personal data under Article 4(1) GDPR. Because Google retains reverse lookup tables generated from its logged-in user base of billions of accounts, Google can readily match incoming SHA-256 hashes against internal identity matrices.

European Data Protection Authorities, including the French CNIL (under Deliberations 2020-091 and 2020-092) and the Irish Data Protection Commission (DPC), have clarified their enforcement priority: capturing form input fields to enrich ad measurement profiles constitutes tracking and processing for targeted advertising. As a consequence, this processing requires explicit, prior consent under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive ↗ (Directive 2002/58/EC). Any deployment operating under the guise of 'legitimate interest' (Article 6(1)(f)) exposes the data controller to administrative fines under Article 83 GDPR ↗ up to €20,000,000 or 4% of annual global turnover.

Technical Deep Dive : Google Ads Enhanced Conversion

Enhanced Conversions functions under two technical modes: automatic DOM detection and manual code integration (JavaScript/GTM or Google Ads API). Under automatic detection, Google tag scripts inject mutation observers and form listeners to harvest submitted input values matching common regex patterns for email formats and telephone numbering plans. This automated scraping frequently introduces substantial regulatory liability by collecting user data before or independently of any consent determination.

Client-Side JavaScript Payload Construction

When implementing manual integration via the Global Site Tag (gtag.js), strings must be lowercased, trimmed of leading/trailing whitespace, and encoded using SHA-256. The following production-grade script illustrates a compliant, defensive implementation. It actively checks Consent Mode v2 status before executing the SHA-256 hashing routine and passing parameters to the tracking payload:

<script>
// Forensic implementation: SHA-256 client hashing gated behind consent
async function hashUserData(str) {
  if (!str) return null;
  const normalized = str.trim().toLowerCase();
  const msgUint8 = new TextEncoder().encode(normalized);
  const hashBuffer = await crypto.subtle.digest('SHA-256', msgUint8);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

async function dispatchCompliantEnhancedConversion(orderPayload) {
  // 1. Mandatory Gate: Verify explicit ad_user_data consent state
  if (window.google_consent_state?.ad_user_data !== 'granted') {
    console.warn('[CookieDetox Audit] Execution halted: ad_user_data consent denied.');
    return;
  }

  // 2. Hash sensitive identifiers independently
  const hashedEmail = await hashUserData(orderPayload.email);
  const hashedPhone = await hashUserData(orderPayload.phone);

  // 3. Dispatch enhanced conversion payload to Google Ads
  gtag('set', 'user_data', {
    'sha256_email_address': hashedEmail,
    'sha256_phone_number': hashedPhone,
    'address': {
      'first_name': orderPayload.firstName ? await hashUserData(orderPayload.firstName) : undefined,
      'last_name': orderPayload.lastName ? await hashUserData(orderPayload.lastName) : undefined,
      'postal_code': orderPayload.postalCode,
      'country': orderPayload.countryCode
    }
  });

  gtag('event', 'conversion', {
    'send_to': 'AW-123456789/AbCdEfGhIjK',
    'value': orderPayload.value,
    'currency': orderPayload.currency,
    'transaction_id': orderPayload.orderId
  });
}
</script>

In the network tab, this manual dispatch generates a request to googleads.g.doubleclick.net/pagead/viewthroughconversion/. The parsed body contains the serialized query parameter em holding the string tv.1~em.[HEX_SHA256_STRING]. If this parameter transmits without an upstream opt-in confirmation flag (`gcd` parameter confirming `ad_user_data=granted`), the payload constitutes direct non-compliance.

Regulatory Risk Matrix : Google Ads Enhanced Conversions

Article 6(1) GDPR provides six lawful bases for processing personal data. Ad-tech platforms often suggest that conversion tracking qualifies under legitimate interest (Article 6(1)(f)) because accurate measurement protects the advertiser's economic viability. European jurisprudence systematically rejects this defense for advertising optimization and deterministic audience profiling.

Statutory Evaluation Matrix: Tracking Configurations

Under EDPB Guidelines 8/2020 on the targeting of social media users, combining customer lists or hashed profile attributes with advertising identifiers to track subsequent behavior cannot proceed without consent that is freely given, specific, informed, and unambiguous (GDPR Art. 4(11)). Joint controllership provisions under GDPR Art. 26 also bind the advertiser to Google Ads Controller-Controller Data Protection Terms, leaving the site operator directly liable for illegal upstream ingestion.

Implementation Protocol : Google Ads Enhanced Conversions

To eliminate legal liability while using Enhanced Conversions, follow this technical verification roadmap using your browser's Developer Tools and Google Tag Manager.

Step 1: Disable Automatic Data Collection in Google Ads UI

1. Navigate to Tools & Settings > Measurement > Conversions.
2. Click the conversion action configured for Enhanced Conversions.
3. Expand the Enhanced Conversions accordion.
4. Select Google Tag or Google Tag Manager and click Next.
5. Under configuration options, ensure Automatic collection (detect data on webpage) is unchecked. Rely solely on validated GTM variables or manual API triggers.

Step 2: Gate GTM Triggers Behind Consent Mode Signals

Ensure that the conversion tag does not execute on unconditioned triggers like 'Page View' or bare 'Form Submission'. Configure an updated trigger with specific condition checks:

// Trigger Condition in GTM:
// Event equals 'purchase'
// AND {{Consent State - ad_user_data}} equals 'granted'
// AND {{Consent State - ad_storage}} equals 'granted'

Step 3: Forensic Verification Protocol via DevTools

To inspect payloads before they reach production, run an end-to-end checkout execution while monitoring HTTP activity:

1. Open the browser's Network Tab and set filter to: googleads.g.doubleclick.net/pagead/viewthroughconversion/.
2. Inspect the URL Query Parameters on the POST or GET request.
3. Locate the gcd (Google Consent State) parameter. A compliant payload sent when consent is rejected will read gcd=13r3r3r2r5 (where 'r' denotes rejected/denied states). Under these conditions, the em parameter must be absent entirely.
4. Locate the em parameter when consent is granted. Verify that the parameter contains a 64-character hexadecimal SHA-256 hash preceded by the formatting prefix (e.g., em=tv.1~em.a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3). If you observe plain-text emails or non-standard characters in the query string, raw personal data is leaking into server logs, establishing an immediate Article 33 breach.

Strategic Verdict : Google Ads Enhanced Conversions

Enhanced Conversions offers measurable recovery of lost attribution signals across safari/WebKit ITP configurations and cookie-restricted environments. However, deploying the feature without strict architectural controls exposes organizations to substantial legal risks under European data protection law.

Technical leaders and DPOs must adopt three strategic rules for compliant operations:

• Never deploy Automatic DOM Collection: Automated DOM scrapers do not distinguish between users who consented to tracking and those who rejected it, leading to silent, non-consensual personal data collection across form elements.
• Strictly tie GTM Data Layer pushes to Consent Mode v2: Configure the Data Layer so that variables containing hashed emails (user_data.email_address) populate exclusively when ad_user_data is set to granted. If the user withholds consent, these variables must evaluate to undefined or null.
• Audit Data Processing Addenda (DPAs): When using server-side Enhanced Conversions (Google Ads API), you operate under the Google Ads Controller-Controller Terms. This status demands an up-to-date Transfer Impact Assessment (TIA) under CJEU Schrems II, since user-level data processed by Google LLC may be accessible to foreign intelligence authorities under FISA Section 702.

Adhering to these strict separation layers lets European brands protect ad performance while remaining fully compliant with GDPR and ePrivacy requirements.