Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“these Data Processing Terms do not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.”
“Customer instructs Google to process Customer Personal Data only in accordance with applicable law: (a) to provide the Processor Services and any related technical support; (b) as further specified via Customer's use of the Processor Services...”
“Google will allow Customer or a third party auditor appointed by Customer to conduct audits (including inspections) to verify Google's compliance with its obligations under these Data Processing Terms”
“Google will delete such Customer Personal Data from its systems as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.”
“each party will comply with the obligations applicable to it under Applicable Data Protection Legislation with respect to the processing of Customer Personal Data.”
“Subject to any provisions applicable to data transfers set out in the Additional Terms, Google may process Customer Personal Data in any country in which Google or its Subprocessors maintain facilities.”
These Terms govern how Google Ads handles the personal data Customers provide, requiring Google Ads to use that data only as instructed, delete it within 180 days, and never sell or share it. Customers can appoint an auditor to verify Google Ads' compliance. Importantly, these protections do not cover personal data processed through any Additional Products the Customer uses.
These Data Processing Terms establish Google Ads as a processor of Customer Personal Data, obligating it to process that data only in accordance with applicable law and the Customer's instructions through permitted purposes. The Terms impose a maximum 180-day deletion deadline, a prompt data incident notification obligation, and an absolute prohibition on selling or sharing Customer Personal Data. Google Ads retains full liability for Subprocessors' acts and omissions, and cross-border transfers of Customer Personal Data are authorized across any country where Google or its Subprocessors maintain facilities, subject to transfer solutions required under European Data Protection Legislation. Both parties bear independent compliance obligations under Applicable Data Protection Legislation, and the Terms explicitly do not extend to personal data processed in connection with Additional Products.
For a business customer, this document means Google Ads is contractually bound to process your customer personal data only as you instruct, to delete it within 180 days of the end of the relationship (unless law requires otherwise), and to notify you promptly if a data incident occurs. You retain the right to appoint a third-party auditor to verify Google Ads' compliance with these Terms. Be aware that any personal data you move outside Google's and its Subprocessors' systems loses the protection of these Terms, and any personal data processed through Additional Products is not covered at all.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
“these Data Processing Terms do not apply to the processing of personal data in connection with the provision of any Additional Product used by Customer, including personal data transmitted to or from that Additional Product.”
“Customer instructs Google to process Customer Personal Data only in accordance with applicable law: (a) to provide the Processor Services and any related technical support; (b) as further specified via Customer's use of the Processor Services...”
“Google will allow Customer or a third party auditor appointed by Customer to conduct audits (including inspections) to verify Google's compliance with its obligations under these Data Processing Terms”
“Google will delete such Customer Personal Data from its systems as soon as reasonably practicable and within a maximum period of 180 days, unless applicable laws require storage.”
“each party will comply with the obligations applicable to it under Applicable Data Protection Legislation with respect to the processing of Customer Personal Data.”
“Subject to any provisions applicable to data transfers set out in the Additional Terms, Google may process Customer Personal Data in any country in which Google or its Subprocessors maintain facilities.”
“If Google becomes aware of a Data Incident, Google will: (a) notify Customer of the Data Incident promptly and without undue delay; and (b) promptly take reasonable steps to minimise harm and secure Customer Personal Data.”
“Google will not sell or share any Customer Personal Data that it obtains from Customer in connection with the Agreement”
“Google has no obligation to protect Customer Personal Data that Customer elects to store or transfer outside of Google's and its Subprocessors' systems.”
“Google is a processor of Customer Personal Data; (c) Customer is a controller or processor, as applicable, of Customer Personal Data”
“remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor.”
“If Customer Personal Data is transferred to any other country, and European Data Protection Legislation applies to the transfers (“ Restricted European Transfers ”), then: (a) if Google has adopted an Alternative Transfer Solution for any Restricted European Transfers, then …”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
Google Ads has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle 30-day advance notice required before Term changes take effect and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.