According to PPC News Feed, citing a post by Anthony Higman, Google Ads will stop requiring hashed customer data in Data Manager from 16 November 2026, supporting an encrypted format. Data that previously required SHA-256 hashing will be handled in a trusted execution environment (TEE). It affects those importing offline data, such as customer matching and enhanced conversions. The report doesn’t detail technical requirements, and there’s no link to official documentation.
What changes, according to the report
PPC News Feed reported, on 23 October 2026, that Google Ads will update Data Manager to stop requiring hashed customer data. The change starts on 16 November 2026. Data will be supported in encrypted format and, according to the article, data that previously required SHA-256 hashing will be handled in a trusted execution environment (TEE).
The declared aim is to simplify data import for advertisers. It affects those importing offline data, with specific reference to customer matching and enhanced conversions tools.
What hashing is and why it existed
Hashing is a transformation that converts a datum (for example an email) into a string of characters that can’t be read directly. Advertisers applied it before sending customers’ emails and phones, so the platform only saw transformed versions. It was a privacy protection and a technical requirement.
The new model, according to the report, replaces that step with encrypted handling in a closed environment. In practice, the advertiser no longer has to hash, but security comes to depend on how the new environment works, and that’s what you should understand before adopting.
Customer data in Google Ads
Until now
- SHA-256 hashing required
- Advertiser applies hashing
- Frequent formatting errors
From 16 November
- Encrypted format supported
- Handling in a trusted environment (TEE)
- GDPR obligations remain
What the report doesn't clarify
The article doesn’t detail technical requirements, migration steps or whether the change affects other tools. It also has no link to Google’s official documentation, and the information comes from a third-party publication citing a post by Anthony Higman. Search Engine Roundtable’s recap of 22 October mentions the same post.
So treat the information as a notice to confirm. Before 16 November, consult official Data Manager and Google Ads documentation, and confirm with whoever implements integrations in your company.
Privacy and compliance: legitimate questions
For a company in Portugal, GDPR continues to apply. Sending customer data to Google, hashed or encrypted, is a sharing of personal data that requires a legal basis, transparency and, in many cases, consent. The technical change doesn’t alter the controller’s obligations.
Questions to ask whoever handles data protection: what do we tell customers about this use? Do we have appropriate consent? What data do we send, and is it the minimum necessary? Where does it stay, and for how long? How do we answer a deletion request?
Technology changes. Obligations towards customer data don't.
What to do before 16 November
1. List the integrations that send customer data to Google (lists, enhanced conversions, offline imports). 2. Confirm who manages them and how they work. 3. Read the official Data Manager documentation as soon as it’s available. 4. Confirm consent and the privacy policy. 5. Decide whether to keep the current process (with hashing) or adopt the new one.
Don’t change anything at the last minute, in the middle of Black Friday. If the integration is critical for sales, test the change before or after the peak.
Who benefits most
Those who struggle to apply hashing correctly (many imports fail due to formatting errors) may benefit from a simpler process. SMEs with a CRM without native integration, who upload files manually, may save time. Shops using enhanced conversions may have less technical friction.
But simplifying the sending doesn’t make the data more or less sensitive. Care with quality, consent and minimisation remains yours.
An illustrative example
A Portuguese online shop exports, once a month, a list of the last year’s customers and uploads it to Google for Customer Match, after applying hashing in a spreadsheet. With the change, it may upload without that step, but must keep cleaning the list, confirming consent and removing those who asked to opt out. The gain is time and fewer errors; responsibility remains.
The example is hypothetical and simplifies, but shows the point: technology changes, obligations don’t.
Questions for your manager
Which integrations send customer data to Google? Who manages them? Have you seen the Data Manager documentation? What consent do we have? Will we adopt the new format, and when? How do we avoid problems during Black Friday?
A manager careful with data answers with an inventory and a plan. If you want help mapping your integrations and preparing the transition, I can do it with you.
Frequently asked questions
Is the information official?
The report cites a post by Anthony Higman and has no link to Google documentation. Confirm in official documentation before acting.
Can I keep using hashing?
The report says it will no longer be required, not that it’s prohibited. Confirm in the documentation whether the current process remains supported.
Does GDPR still apply?
Yes. The change is technical. Legal basis, transparency and consent remain your responsibility.
Sources consulted
Keep reading
- Safari 27 blocks firms that turn emails into identifiers: what changes for remarketing and measurement
- Google Ads reduced data retention on 1 June: export your history before you lose it
- Targeted ads that delivered spyware to 45 devices: what the Discover-Tech case teaches those who buy online advertising