Google is removing a step that has quietly haunted first-party data uploads. From November 16, 2026, Google Ads Data Manager will no longer require advertisers to hash customer lists with SHA-256. Encrypted data becomes the default, and Google says it will decrypt, normalize and match records inside a hardware-isolated trusted execution environment, or TEE.
The notice reached public view on October 18 when Anthony Higman, founder and CEO of ADSQUIRE, shared a copy of the email on LinkedIn. It applies to accounts that use Data Manager for Customer Match and enhanced conversions, across CRM connections, cloud storage imports, direct file uploads and the Data Manager API.
Why hashing quietly broke your match rates
SHA-256 is unforgiving. A capital letter, a trailing space or a phone number missing its country code produces a completely different hash. That meant a list could be failing before it reached Google, with no clear signal on which rows were rejected for formatting rather than missing a Google account.
Google says the update will improve match accuracy using privacy-enhancing technology and reduce errors caused by formatting issues before hashing. By taking over normalization inside the TEE, Google moves the formatting step off the advertiser’s side and into its own sealed environment.
This is not a brand-new privacy idea
The TEE has been part of Google’s stack since confidential matching launched in September 2024. Encryption for Data Manager was documented when the API went live in December 2025, though it was optional. What changes on November 16 is that hashing stops being mandatory and encrypted input becomes the default.
The strategic shift is bigger than the technical detail. The advertiser’s pre-processing work, and some of the control, now sits inside Google’s pipeline. Hashing was never anonymization, as the FTC has warned, but it did let businesses say plain-text identifiers never left their systems. Under the new model, encrypted raw identifiers leave your side and are decrypted inside Google’s TEE.
What to do before the switch
For many teams, this could be good news: cleaner normalization may lift Customer Match audience sizes and enhanced conversion counts, which feed Smart Bidding. But the email leaves practical questions open, including whether existing hashed uploads keep working, whether the change is optional, and how the environment can be verified.
Before November 16, smart advertisers should:
- Audit your upload paths. Confirm which routes send hashed data today and who owns formatting.
- Baseline your match rates. Capture current Customer Match and enhanced conversion performance so you can measure any improvement.
- Review data governance. Check privacy assessments and client agreements that assumed only hashed values were shared.
- Ask for attestation. Request documentation on how the TEE is verified and what happens to unmatched records.
Google has not published match-rate figures for the encrypted route. The only claim on record is that accuracy improves. That makes the before-and-after comparison entirely yours to run.
Source: PPC Land
