Google Ads Tag: What Data It Collects and the Privacy Risk
At a glance
Google Ads
Privacy riskWhy High?
High- Category
- Advertising / conversion tracking and remarketing
- Sends data to
- Still in use?
- Yes
- Collects hashed PII?
- Yes, with enhanced conversions (check your account setting)
- DataTrue detects it as
Google Ads ConversionRemarketingMeasurement
Summary
The Google Ads tag tracks conversions and builds remarketing audiences for Google’s ad network. It stores a click identifier (GCLID) and first-party cookies to connect an ad click to what a visitor does on your site. With enhanced conversions on, set per account, it also sends hashed customer data such as email to Google. Its privacy risk is high.
What is the Google Ads tag?
Google’s ad network, where the tag’s audiences are retargeted, includes Search, YouTube, and the Display Network.
What does the Google Ads tag collect?
It stores cookies containing information about the ad interaction and a unique identifier for the user or the ad click, the GCLID (Google Click Identifier). When a visitor converts, the conversion tag reads this cookie and sends it back to Google Ads with the conversion. With enhanced conversions turned on, it also sends hashed customer data, such as email, to Google, and automatic collection can pick up that data from your pages.
Where does the data go?
To Google, where it is used to attribute conversions, build and match remarketing audiences, and target advertising across Google’s network.
With and without consent
The tag fires on page and conversion events, and its behavior before and after consent depends on Google Consent Mode and your setup. Enhanced conversions send hashed customer data once they are turned on at the account level, and new conversion actions inherit that setting. Check each conversion action’s setting rather than assuming it is off.
Privacy risk:High
The Google Ads tag rates high. Its purpose is cross-site advertising and remarketing through Google’s ad platform, it can send hashed personal data through enhanced conversions, and it ties an ad click to on-site behavior. Its base mode is click-ID and cookies rather than personal data you hold, which is why the risk sits in how it is configured and how consent is handled. Whether a specific use is compliant depends on your setup and region. For EEA traffic used for ad personalization and measurement, Google requires Consent Mode v2 signals, and it sets that requirement in its own policy. See the Privacy & Compliance resources for the legal question.
Privacy risk is rated on four factors: breadth and sensitivity of data collected, hashed PII, third-party sharing and reach, and documented enforcement or litigation exposure. It is a data-and-exposure read to help prioritize what to check, not a legal determination.
Is the Google Ads tag still in use?
Yes. Advertisers use it to measure conversions from Google ads and to build remarketing audiences.
How DataTrue detects the Google Ads tag
DataTrue recognizes its Google Ads tag types (Conversion, Remarketing, Measurement, Audience Tracker). Coverage tests find them across your site, and Simulation tests read what they send at each step and in each consent state, including whether enhanced conversions are sending hashed personal data. For how this works in the product, see the Web Analytics Testing page.
Questions
What data does the Google Ads tag collect?
A click identifier (GCLID) and first-party cookies that connect an ad click to what a visitor does on your site, plus, with enhanced conversions, hashed customer data such as email.
What is the GCLID?
The Google Click Identifier, a unique ID Google attaches to an ad click and stores in a cookie, so a later conversion can be attributed back to that click.
Does Google Ads send email addresses?
Yes, if enhanced conversions are on, in which case it sends them hashed. The setting is made at the account level and new conversion actions inherit it, so check each conversion action rather than assuming it is off.
Is the Google Ads tag a privacy risk?
High, because it drives cross-site remarketing to a major ad platform and can send hashed personal data. Whether a given setup is compliant is a separate legal question. Consent Mode v2 is a requirement Google sets in its own policy for EEA traffic used for ad personalization and measurement.
Sources: How Google Ads tracks website conversions, support.google.com/google-ads/answer/7521212. About enhanced conversions, support.google.com/google-ads/answer/9888656.
Know what your tags send, page by page
DataTrue runs real journeys on your site and checks each tag’s data against what you expect, field by field. A missing event or a wrong value shows up in a test before it reaches a report.
- Every page, with coverage scans
- Scheduled runs, with alerts when a result changes
- Full journeys, like checkout and signup, in each consent state
- What each tag sent, field by field
- PII detection with test personas
- iOS and Android app testing
- Pre-publish testing for GTM and Adobe Tags
- REST API, plus Slack and Jira alerts
The full platform, every feature, free for 30 days.
