Close-up of rows of comma-separated numbers on a screen, fading out of focus

Audiences

Do I still need to hash my customer list before uploading it to Google Ads Data Manager?

By The Tofu team ·

Not if you import through Data Manager's own connections or file upload: Data Manager already SHA-256 hashes email, phone and names for you. Through the Data Manager API, yes, for now. A Google email to Data Manager users, made public on October 18, 2026, says that from November 16, 2026, Data Manager will stop requiring hashed data and will take encrypted data by default, matched inside a trusted execution environment. Google's help and API docs don't show that change yet, so keep API code hashing until they do.

As of November 2026.

What changed

Google emailed advertisers who use Data Manager "to import first-party offline customer data for Customer Match and enhanced conversions." Anthony Higman, CEO of the agency ADSQUIRE, posted a screenshot of the email on LinkedIn on October 18, 2026, and PPC Land reported it the same day. The email is undated, and the screenshot ends partway through, so it isn't clear whether the email asks advertisers to do anything. It says: "Starting on November 16, 2026, we will no longer require hashed customer data (SHA-256) for Google Ads Data Manager and will instead support encrypted customer data by default."

The email says data sent through Data Manager "(including CRM connections, cloud storage imports, direct file uploads, and the Data Manager API)" will be processed in encrypted form in a trusted execution environment (TEE). There, Google "decrypts, normalizes, and matches this data with Google account data." Google's reason: the change "improves match accuracy" and "minimizes errors caused by formatting discrepancies prior to hashing." It gives no numbers.

Before November 16, 2026From November 16, 2026 (Google's email)
HashingRequired. Data Manager hashes email, phone and names with SHA-256 for you, or you upload a file you hashed yourselfNo longer required
Default data formatSHA-256 hashedEncrypted
Formatting (lowercase, trimmed spaces)Done before hashing, by Data Manager or by youDone by Google inside the TEE
Where matching happensConfidential matching in a TEE, the default for Customer Match direct connectionsA hardware-isolated TEE
Data Manager APIYou must format and SHA-256 hash email, phone and names. Encryption is optional and goes on top of the hashNamed in the email, but the API docs don't yet say what changes
Products namedCustomer Match and enhanced conversionsCustomer Match and enhanced conversions

What Google hasn't said yet

  • Whether hashed uploads keep working. "No longer require" suggests they will, but the email doesn't confirm it.
  • What "encrypted by default" means for a CRM connection. Google doesn't say whether you have to set anything up.
  • How the Data Manager API changes. Its formatting and encryption guides, last updated October 21, 2026, still say to hash, and the encryption guide says "Don't encrypt unhashed values."
  • Where the official notice is. As of November 1, 2026, Google has published no help article, blog post, Data Manager announcement or Data Manager API release note on this change. Its Data Manager help pages still describe SHA-256 hashing.

Is it safe to send customer data that isn't hashed?

Google's case rests on confidential matching. Its help center says confidential matching finds the overlap between your list and Google's data inside a TEE, "a special configuration of computer hardware and software" that keeps the processing confidential and prevents tampering. It is built on Google Cloud's Confidential Space, and Google says it limits how the data can be used and who can access it. Google says it's on by default, at no cost, for Customer Match through a "Direct connection" in Data Manager or Audience manager.

Google also says Customer Match data files are used only to match your customers to Google accounts and check policy compliance, aren't shared with third parties (except to meet legal requirements), and are marked for deletion after matching and policy checks. Uploads travel over TLS.

For extra assurance, you can encrypt the data yourself with a key you control in Google Cloud KMS and require attestation, a cryptographic proof that only confidential matching code can decrypt and process it. Google says this is optional. It also publishes the confidential matching code on GitHub for review.

Whether that is safe enough for your company is a call for your legal and security teams. Google's Customer Match policy requires your privacy policy to say that you share customer data with third parties to perform services for you, and requires consent for that sharing where the law or Google's policies call for it. According to PPC Land, the email doesn't mention any change to Google's customer data terms.

Who it affects

  • Advertisers who use Data Manager to send customer lists for Customer Match or offline data for enhanced conversions. That is who Google emailed.
  • B2B teams with a CRM connected directly. HubSpot, Salesforce, Zoho CRM and ActiveCampaign are on Google's list of supported data sources, as are BigQuery, Google Cloud Storage, Amazon S3, Snowflake, Google Sheets and SFTP. Typical uses are customer exclusion lists, Customer Match audiences and offline conversions from closed deals.
  • Developers and tools that call the Data Manager API.

If you don't use Data Manager, the email doesn't apply to you. If a third-party tool (a CDP, a CRM sync app or an agency script) sends your data, ask its maker whether it uses Data Manager and what it will change.

What to do now

  1. Change nothing that works before November 16. Until then, if Data Manager hashes for you, it keeps doing so. If you hash yourself, keep going. Google's help says that when you upload a hashed file, Data Manager pushes your hashed data to the API.
  2. List your connections. In Google Ads, select the Tools icon, then Data manager. Under "Connected products," click Manage & link on each connection. If you see the confidential matching badge under "Manage connection," that connection already matches in a TEE.
  3. Keep API integrations hashing. Follow the Data Manager API guides as they stand: format, then SHA-256 hash email, phone and names. Change your code only when Google updates those guides.
  4. Brief your privacy or legal team now. Tell them that, according to Google's email, the default moves on November 16 from hashed data to encrypted data matched in a TEE, and send them Google's confidential matching article. Check that your consent wording covers sharing customer data with Google for advertising.
  5. If your company must hold its own encryption key, read Google's "Confidential matching with encryption" guide. It uses Google Cloud KMS and a workload identity pool, and needs Cloud KMS Admin and IAM Workload Identity Pool Admin permissions. Google warns that encryption can be "complex or infeasible" when your data source isn't an object store such as Google Cloud Storage.
  6. After November 16, compare results. Check match rates for each Customer Match list and conversion counts for each enhanced conversions action against the weeks before. Google says the change improves match accuracy; see whether it does for you.
  7. Watch Google's pages. Check the Data Manager help center, its announcements page and the Data Manager API guides for the official version of this change.

Dates to watch

DateWhat happens
September 12, 2024Google adds confidential matching to Data Manager
October 18, 2026Google's undated email about the change is posted on LinkedIn and reported by PPC Land
October 21, 2026Data Manager API guides last updated; they still require hashing
November 16, 2026Google's email says Data Manager stops requiring SHA-256 hashed data and supports encrypted data by default
After November 16, 2026Look for updated help and API docs, and compare match rates

Sources

Ask Tofu next

Pick a question and Tofu Ads Agent answers it in chat.

Related answers

More on

Let an agent build your next campaign.

Tofu Ads Agent reads your CRM, plans the funnel, builds the audience and creative, and stages full campaigns across LinkedIn, Google and Meta for your approval.

Try it free Get a demo