What Google’s GDPR update means for Google Ad accounts

Yesterday, Google issued an email out to all accounts who are using Google Ads about updates on GDPR compliance. Here’s the simple explanation and what it means to marketers.

What did the email say?

The August 2020 email said that Google will be moving to Standard Contractual Clauses (SCCs) when moving online advertising and measurement personal data out of the Europe Economic Area, Switzerland and the UK, due to current ‘Privacy Shield’ being invalid. This will apply from August 12, 2020.

Why is the ‘Privacy Shield’ invalid?

Currently, companies like Google are allowed to transfer data in the US, by proving that they were protecting data to the same standard as in the EU. This was called the EU-US Data Privacy Shield. Though a user may be based in Germany, a company with headquarters in London could be processing and storing the user’s data in the US. The Privacy Shield was meant to give European users the same rights or ‘adequate protection’ when their data is transferred in the US.

It has been overturned as The Court of Justice said the US does not “grant data subjects actionable rights before the courts against the US authorities.” This means as there are no adequate or equal US to EU protection, the Data Privacy Shield is now invalid.

Why is US data protection unequal to the EU?

Certain surveillance programs do not have any limitations on the data they can collect in the US. The user or ‘data subject’ does not have actionable rights before courts. This differs from the EU, where under GDPR, individuals can take action for misuse of data. 

Is this good for consumers?

Yes. It means those in the EU will still have equivalent protections. Companies will need to continue to use Standard Contractual Clauses (SCCs) that the EU set up. These are terms and conditions which the sender and the receiver of personal data both sign up to which make sure that the user is protected under GDPR laws. This is an explicit contract rather than the Data Shield where the company only had to prove ‘adequate protection’, you can see the clauses here.

Google has no additional rights over the collection or use of data, and a user can still request their data and enact the right to be forgotten. 

How does it impact marketers?

For marketers it means more reviewing of data protections including how companies like Google are using SCCs. It is also a good time for marketers to make sure that users’ preferences meet the requirements of EU User Consent Policy. 

The full impact for consumers and marketers is yet to be seen – sign up here to keep updated.

What happens next?

Google are adapting the following with SCCs: 

We’re following if there are additional updates.