A passkey requirement for Google Ads sensitive actions is circulating with a specific enforcement date, August 19, and a second date derived from it, August 12. Google’s own help page states neither. A separate requirement does trace back to Google: Search Engine Land reported on July 27, citing a Google Ads developer blog post, that a rollout requiring a passkey to generate new OAuth refresh tokens through the Google Ads API begins August 5 and expands to all users over subsequent weeks.
When is the Google Ads passkey deadline?
Google’s help page on passkeys for sensitive actions names no enforcement date; it says instead that advertisers get an email and in-product notice if the requirement applies to their account. Trade outlet Cittago reports August 19, 2026 as the enforcement date and derives August 12 by subtracting Google’s longest stated waiting period, seven days, from it. Treat August 19 as trade reporting and August 12 as arithmetic performed on that reporting, not as dates Google has published.
Three waiting periods on one page
The help page gives three separate waiting-period statements and does not say they describe the same thing. New passkeys “take about one to 2 days to pair with Ads.” Separately, it tells advertisers to “wait 48 hours before using your new passkey to authorize sensitive tasks, such as updating billing or user permissions.” Separately again, it warns new passkeys “may be subject to a 7-day security delay.”
August 12 comes from taking the longest of the three and counting back from August 19. That subtraction also drops the sentence that follows it: “You should be able to complete actions using other authentication workflows.” The page hedges twice, in that the delay “may” apply and other workflows “should” still work. That is not the language of a hard cutoff. Nor is August 19 settled: ppc.land reported in May that the requirement would start “from July 15,” and later reporting moved that to August 19. The help page carries no date either way, so neither report checks against a Google-published one, only against each other.
The covered actions are examples, not a closed list: “account linking updates or user access changes,” elsewhere “adding new users or changing billing information, among others.” Cittago names four: new users, permission changes, manager-account links, payment information.
The date with a Google source behind it
Compare that to what Search Engine Land reported July 27, sourced to a Google Ads developer blog post: passkeys become required for generating new OAuth 2.0 refresh tokens through the Google Ads API, with the rollout beginning August 5 and expanding to all users over subsequent weeks. That date has a primary source behind it and five days already elapsed.
The scope is narrow: “Existing OAuth refresh tokens will continue to work and won’t require reauthorisation.” In our reading, the requirement surfaces only when a token is generated fresh, when a reporting script gets rebuilt or a connector reconnected, a moment that doesn’t announce itself the way a login prompt does.
| Date | What changes | Source |
|---|---|---|
| August 5, 2026 | Generating a new OAuth refresh token via the Google Ads API requires a passkey. Rollout begins August 5, expanding to all users over subsequent weeks; existing tokens keep working. | Google Ads developer blog, via Search Engine Land, July 27 |
| August 12, 2026 | Not a Google date. Derived by trade press by counting the 7-day security delay back from the reported enforcement date. | Cittago, August 6 (calculation) |
| August 19, 2026 | Reported enforcement date for passkeys on sensitive account actions. Absent from Google’s own help page. | Cittago, August 6 (trade reporting) |
Where the three tracks are heading
A passkey is tied to an individual Google Account, not a login a team passes around, which is what makes Search Engine Land’s August 6 report on a separate, existing pilot the more consequential piece. Google is testing a rule blocking users signed in with free email domains, Gmail and Yahoo, from completing sensitive actions; they keep the ability to view reports and make routine campaign edits, “depending on their permissions.” Accounts with three or more active administrators may trigger a multi-party approval step when a corporate user is added or admin privileges change. Google calls this “currently being piloted for a subset of advertisers,” with no rollout date or phase-out timeline published.
Set the three tracks side by side and a direction holds even without the disputed date. Passkeys for sensitive actions, passkeys for new API tokens, and a pilot treating a Gmail sign-in as weaker than a corporate one are the same move from different angles: the ad account is becoming a verified corporate identity. Saved Meridian dashboard links run on the owner’s access, putting every viewer on one credential; Google Ads is moving the other way. Anyone who has watched a reporting value move from a silent property-level default to something the import has to state for itself, the way the GA4 cost-import currency field did, should recognize the shape. If this requirement goes wrong, it is unlikely to look like a locked door and more likely to look like numbers that quietly stop updating.
Sources: Google Ads Help, “Use a passkey to complete sensitive actions”; Search Engine Land, “Google makes passkeys mandatory for Google Ads API users”.