Analytics Tools

Google Ads Data Manager Drops the SHA-256 Requirement on November 16: Google Will Normalize Customer Data Inside a TEE

Marcus Chen By Marcus Chen ·
Server racks in a data center with a glowing padlock shield and binary digits, toned in wine red

A Google Ads email titled “Encryption in Google Ads Data Manager” says that starting November 16, 2026, Google will no longer require SHA-256 hashed customer data in Data Manager and will support encrypted customer data by default. The email lists four routes: CRM connections, cloud storage imports, direct file uploads, and the Data Manager API. For that data, it says Google Ads decrypts, normalizes, and matches this data with Google account data inside a hardware-isolated trusted execution environment. The screenshot shows no send date. We read it from the screenshot in Anthony Higman’s LinkedIn post, published on October 18.

What changes in Google Ads Data Manager on November 16?

According to the email, Google Ads Data Manager stops requiring SHA-256 hashed customer data on November 16, 2026, and supports encrypted customer data by default. The email says data ingested through CRM connections, cloud storage imports, direct file uploads and the Data Manager API will be processed in an encrypted format through a trusted execution environment (TEE), where Google decrypts, normalizes and matches it. The stated reasons are that the change “improves match accuracy” and “minimizes errors caused by formatting discrepancies prior to hashing”. The visible text gives no figure for the improvement.

The email and the help pages describe different models

Here is the email next to the Google pages a reader can open on October 19. Each text is quoted as it stands.

What the email says

  • Starting on November 16, 2026, we will no longer require hashed customer data (SHA-256) for Google Ads Data Manager and will instead support encrypted customer data by default.
  • The routes it names: CRM connections, cloud storage imports, direct file uploads, and the Data Manager API.

What Google’s documentation says on October 19

  • The Confidential matching page: Encryption is not required to use confidential matching.
  • The same page, on data sources: it may be complex or infeasible to use encryption if your preferred data source is not an object store.
  • The encryption guide lists Hash and encrypt personally identifiable information (PII) data fields. as an overview step, and says Today, confidential matching supports data encrypted using customer-owned encryption keys managed by Google Cloud Key Management Service (GCP KMS).
  • The Data Manager API formatting guide, last updated October 14, 2026: Hash using the SHA-256 algorithm and encode the hash bytes.
See also  Google's Amended SerpApi Complaint Leans on Copyrights It Doesn't Own

Both help pages treat encryption as optional, and the encryption guide describes it as something the advertiser sets up, with customer-owned keys in Google Cloud KMS. The email says data from all four routes will be processed in an encrypted format through a trusted execution environment (TEE). The TEE itself is not new on the help pages, which say that Confidential matching is built using Google Cloud’s Confidential Space product, a TEE. What the email adds is the end of the SHA-256 requirement, encrypted data as the default, and a date.

What the visible email does not say

The visible email has no link, no opt-out and no action item. It does not say who encrypts the data on a CRM connection or a direct file upload, who holds the keys on each route, or what happens to hashed uploads after November 16. “No longer require” is not “no longer accept”.

The email names two uses. It says the recipient’s account uses Data Manager to import first-party offline customer data for Customer Match and enhanced conversions. The visible text says nothing about Google Analytics. That matters because the same API also carries analytics events: Google’s What’s new in Google Analytics page says, in its May 7, 2026 entry, that Data Manager API provides you with an alternative to Measurement Protocol (MP) for sending recommended and custom events directly to your Google Analytics property. Whether the new default touches that path is not stated anywhere we found.

PPC Land reported that confidential matching was introduced in September 2024, and raised several of the same open questions (existing hashed uploads, the key holder per route), plus whether the change is optional and which API versions it covers. Read the full PPC Land report for those. For a contrast in how another ad platform handles hashing field by field, see our piece on the ChatGPT Measurement Pixel, where five of nine user fields are hashed and four geography fields are not.

See also  Zeta Rebuilds Its Data Cloud on Palantir Foundry: The Governance Layer Agentic Marketing Was Missing

What to record before November 16

This part is our advice, not Google’s. Google’s confidential matching page says that If you do not see the badge, confidential matching may not be available for the use case you have selected. It gives three places to look for the badge:

  1. Customer Match via Audience manager: Tools, Shared library, Audience manager, select a segment under “Your data segments”, open the 3-dot menu, Edit list, then Manage in the “Connection” section. If confidential matching is being used, the badge sits in the upper-right of “Manage connection”.
  2. Customer Match via Data manager: Tools, Data manager, “Connected products”, Manage & link, “Manage connection”. If confidential matching is being used, the badge sits in the upper-right.
  3. Enhanced conversions: Goals, Conversions, Settings, Enhanced conversions. Per the page, a badge appears there if confidential matching is being used.

Note which connections show the badge today. The page says confidential matching is currently available for Customer Match when you use the “direct connection” option and also gives the enhanced conversions path, so expect it to differ by connection.

Then save a baseline: current Customer Match list sizes and enhanced-conversion counts, dated. The email dates the change to November 16. If your numbers step after that date, the baseline is how you tell a matching change from campaign performance. If you already add Data Manager uploads to Google tag conversions, our piece on multi-source conversions and where GA4 imports stand covers how those counts are combined.

Leave the hashing step in your pipeline for now. The API formatting guide, last updated October 14, still says to hash with SHA-256, and the visible text of the email does not say hashed uploads will be rejected.