Personalized Advertising Restrictions

What it is

The policy prohibits the use of sensitive personal data categories, including health status, sexual orientation, religious beliefs, political affiliation, racial or ethnic origin, and financial difficulties, for personalized ad targeting through Google's platforms.

Why it matters (compliance & governance perspective)

This provision restricts advertiser use of sensitive data categories for audience targeting, establishing platform-level limitations on targeting functionality that interact with data protection law prohibitions on processing sensitive personal data.

Consumer impact (what this means for users)

The agreement prohibits advertisers from using health conditions, sexual orientation, religious beliefs, political affiliation, racial or ethnic origin, or financial difficulties as targeting criteria for personalized ads. This restriction applies to both first-party and Google-provided audience targeting mechanisms.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 9, which prohibits processing of special category personal data including health data, racial or ethnic origin, religious beliefs, sexual orientation, and political opinions without explicit consent or another narrowly defined legal basis. The FTC has taken enforcement action against companies using sensitive data categories for ad targeting without adequate disclosure or consent. CCPA and CPRA provide additional protections for sensitive personal information categories including health data, sexual orientation, and racial or ethnic origin. The FTC's commercial surveillance rulemaking may further constrain sensitive data targeting practices. 2) GOVERNANCE EXPOSURE: High. This provision is operationally significant for advertisers using audience segments, remarketing lists, or data management platform segments that may incorporate sensitive category signals. Advertisers using health-related keywords or site retargeting on health-related content should assess whether resulting audience profiles incorporate health condition signals prohibited by this provision. 3) JURISDICTION FLAGS: GDPR applies to all EU and EEA users; the prohibition on processing special category data without explicit consent applies regardless of the advertiser's location if EU users are targeted. Illinois BIPA and similar state biometric laws may also interact with certain audience creation mechanisms. CPRA has expanded California's sensitive personal information category protections effective 2023. 4) CONTRACT AND VENDOR IMPLICATIONS: Data management platforms, audience data providers, and CRM onboarding vendors used in Google Ads campaigns should be assessed to confirm that audience segments they provide do not incorporate prohibited sensitive category signals. Vendor agreements should include representations about data category compliance. 5) COMPLIANCE CONSIDERATIONS: Legal teams should audit first-party audience lists and remarketing segments used in Google Ads campaigns to confirm that prohibited sensitive category signals are not incorporated. GDPR compliance documentation should confirm that no special category data is processed for ad targeting without explicit consent. US advertiser compliance programs should assess CPRA sensitive personal information obligations as they relate to audience targeting data.

Applicable agencies

Provision details

Other risks in this policy

• Prohibited Content: Counterfeit Goods high
• Prohibited Content: Dangerous Products and Services high
• Prohibited Practices: Data Collection and Use Violations high
• Prohibited Practices: Circumventing Systems high
• Restricted Content: Healthcare and Medicines high
• Restricted Content: Financial Products and Services high