Google Ads Data Manager Will Stop Requiring Hashed Customer Data From 16 November

What changed, and when

On 18 October 2026, PPC Land reported an email Google sent to advertisers. The email says that from 16 November 2026, Google Ads Data Manager will stop requiring hashed (SHA-256) customer data. Today, advertisers usually hash emails and phone numbers before they reach Google. Under the new approach, Google receives the data encrypted by default. It then decrypts and normalises it inside a trusted execution environment (TEE) and matches it to Google accounts there.

According to the report, the change applies to Customer Match and enhanced conversions uploads. Google gave better match performance and its privacy-enhancing technology as the reasons.

The TEE itself isn't new. Google's confidential matching help page says Customer Match data sent through Data Manager's direct connections is already processed this way, by default and at no cost. What's new is that the hashing step before upload becomes optional.

What isn't known yet

• Whether hashed files keep working. The report doesn't say. "No longer required" is not the same as "rejected", so assume hashed uploads continue unless Google says otherwise.
• Which upload paths change. Data Manager covers file uploads, cloud storage imports, CRM connections and the Data Manager API. Google's current API encryption guide, last updated in September, still tells developers to hash values first and then encrypt them.
• A public help page. As of this morning we found no Google Ads Help article or Data Manager release note that mentions 16 November. We'll update this page when Google publishes one.

Why this matters for UAE clinics

Most clinics don't run Customer Match, and for good reason. Google's Health in personalized advertising policy says advertiser-curated audiences, including Customer Match, can't be used when promoting in sensitive health categories. Those categories include invasive procedures such as cosmetic surgery and injections, pregnancy and infertility treatment, and mental health care. The Customer Match policy also bans ads that imply you know sensitive information about the person seeing them.

Enhanced conversions are different. Many clinics send a lead's email or phone number back to Google Ads so a form fill, WhatsApp chat or booking can be matched to the ad click. That is the main way conversion tracking stays accurate as cookies disappear. If your clinic does this through Data Manager, a CRM connector or an agency script, this change affects the pipe your data travels through.

Healthcare data also carries local rules. Under Federal Law No. 2 of 2019 on the use of ICT in health fields, UAE health data may only be processed or transferred outside the country in cases set by the health authorities, as Al Tamimi explains. Whether a lead's phone number counts as health data depends on what is attached to it and where it came from. Hashing was never a full answer to that question, and unhashed-but-encrypted uploads won't be either.

What clinics and healthcare advertisers should do now

1. List every place customer data leaves your systems for Google. Check Data Manager connections, CRM integrations (Salesforce, HubSpot, Zoho and others), Google Tag Manager enhanced conversions and any offline conversion uploads.
2. Send the minimum. Matching needs an email, a phone number or a click ID. It never needs the treatment, department, doctor or appointment reason. Make sure no field or file name reveals a condition.
3. Don't switch off hashing yet. Keep your current setup until Google publishes documentation and confirms how each upload path behaves after 16 November.
4. Check your privacy notice and consent. Google requires your privacy policy to disclose that you share customer data with service providers, and consent where the law requires it. Have your compliance lead confirm this covers ad measurement.
5. Keep Customer Match out of health campaigns. Use keywords, location targeting and Google's own audiences for treatment campaigns. They remain allowed under the health personalised advertising policy.
6. Watch match rates after the switch. If Google's matching improves, you may see more conversions recorded in late November. Note the date so a jump in reported leads isn't mistaken for a jump in real bookings. See how to spot bad-quality leads.

Not sure what your clinic's account sends to Google? Ask Access One for a tracking and data check.

Frequently asked questions

Do I have to stop hashing my uploads on 16 November?

No. The reported change is that hashing will no longer be required. Nothing reported so far says hashed uploads will be rejected. Keep your current setup working until Google publishes full documentation.

Does this affect clinics that don't use Customer Match?

Possibly. The change was reported for Customer Match and enhanced conversions uploads through Data Manager. Clinics that send lead emails or phone numbers back to Google Ads for conversion tracking should check how their connection sends that data.

Can a UAE clinic use Customer Match with patient lists?

Usually not for health services. Google's Health in personalized advertising policy says advertiser-curated audiences such as Customer Match can't be used when promoting in sensitive health categories, which include cosmetic surgery and injections.

Is unhashed data less safe?

Google says the data will arrive encrypted and be processed inside a hardware-isolated trusted execution environment, the approach it already uses for confidential matching in Customer Match. Clinics should still send only the minimum fields needed, never treatment details.

Does UAE law allow sending patient contact data to Google?

That depends on your data, consent and setup. Federal Law No. 2 of 2019 limits processing or transferring UAE health data outside the country except in cases set by the health authorities. Get your compliance lead's sign-off before uploading any patient data.

Sources

• PPC Land: Google Ads Data Manager stops requiring hashed customer data November 16 (18 October 2026)
• Google Ads Data Manager Help: Confidential matching
• Google for Developers: Data Manager API, encrypt user data
• Google Advertising Policies Help: Health in personalized advertising
• Google Advertising Policies Help: Customer Match policy
• Al Tamimi & Company: exemptions to restrictions on transferring health data outside the UAE

Published 19 Oct 2026 · Access One