Daily Marketing News, October 19, 2026: Google Ads will stop requiring hashed customer lists
Starting November 16, 2026, Google is dropping the requirement for advertisers to hash customer lists before uploading them to Google Ads. Meta, 12 days before its new terms take effect, has kept a clause that lets its bots copy business websites. And a story that leaves you uneasy: ads from a vendor on Google's list delivered spyware to 45 devices, and nobody had to tap anything.
Story of the day: Google Ads will stop requiring hashed customer data on November 16
Data Manager is the Google Ads tool for uploading an advertiser's own data: customer lists and offline sales, meaning purchases that happened in a store or over the phone rather than on the website. On October 18, 2026, it became known that the upload rules change on November 16. Anthony Higman, founder and CEO of the agency ADSQUIRE, posted Google's undated letter on LinkedIn.
Until now, customer emails and phone numbers had to be turned into an irreversible code using the SHA-256 standard before upload. This is called hashing. According to Google's help docs, an email is normalized first: all letters lowercase, no extra spaces. Only then is it hashed. An extra space or a capital letter produced a different code, and the customer simply wasn't found in Google's database.
Starting November 16, 2026, Data Manager accepts data encrypted rather than hashed by default. Google decrypts it and matches it against its own users inside a trusted execution environment (TEE), a hardware-isolated part of the server. The change covers 4 upload methods: CRM connections, cloud storage, file uploads and the Data Manager API.
2 products are affected:
- Customer Match, which shows ads to your own customers based on their contact details;
- enhanced conversions, which match leads and purchases against buyer contact details to measure ad returns accurately.
Google promises better ad performance and fewer formatting errors. The letter doesn't say what happens to files that advertisers already hash.
It sounds like Google is doing us a favor. The normalization work that tripped up every other CRM export, Google now takes on itself. But along with it, the readable version of your list goes to Google too. Before, the company received an irreversible code. Now it receives data that it decrypts on its own side. For a business with a lawyer and a personal data processing policy, that's a different conversation.
What to do before November 16:
1. List every place customer data flows into Google Ads from: CRM, storage, manual files, API.
2. Show the letter to your lawyer and answer the question of where readable customer data is now processed.
3. Don't break hashing that works until Google explains what happens to files that are already hashed.
More news, October 19, 2026
The commercial terms are the contract for everyone who uses the company's services for business. The previous version, dated March 6, 2024, had no such clause. Now Meta can use software and test accounts to visit websites connected to its products, copy, cache and recrawl them, and use the content to train its products. PPC Land captured the UK preview page of the terms on October 18 at 20:44 UTC, about 30 hours after The Verge published its story, and the wording was identical. Business use is explicitly defined to include not only ads but also page management, marketing messages, product catalogs, Ads Manager and Meta Business Suite. Consent is passive, and there's no partial opt out. The company's liability is capped at $100 or fees paid over 12 months, whichever is greater. According to Meta, you can block the crawler in robots.txt.
The story is based on an October 15 report from Citizen Lab, a research lab at the University of Toronto. The researchers concluded with high confidence that targeted ads bought by the Israeli company Discover-Tech installed the Candiru spyware on devices belonging to Al Jazeera staff. The victims didn't have to tap anything. The technique was named "AdFection," and the researchers say no earlier public case has confirmed spyware delivery through targeted ads with zero clicks. Discover-Tech had been on Google's vendor list since 2020. From March to June 2026, before it was cut off, it won 441,950,000 impressions. The takeaway for anyone buying ads: targeting in programmatic, the automated impression auctions, can be aimed at specific people. Platforms will most likely start vetting vendors more strictly.
Demand Gen is a Google Ads campaign type that runs on YouTube, Discover and Gmail. Data Strength is a score for how fully an advertiser shares its own data with Google. On October 13, Google rewrote the help page for this score. Then on October 19 at 03:00 UTC, according to a PPC Land roundup, PPC News Feed reported the new metrics inside the campaigns themselves. At the same time, Data Manager, the tool for uploading first party data, started working with Display & Video 360, Google's buying platform for programmatic ads, and with Google Analytics. Enhanced conversions are available in both. The direction is the same as in the hashing story: Google's optimization leans more and more on the advertiser's own data. If you run Demand Gen, open the Data Strength score in your account and see what data it asks you to connect.
LinkedIn showed new ways for creators to earn money on October 15. Now they're built right into this panel, next to the stats. There are 3 ways to earn: ads in videos, brand partnerships and paid one on one consultations. So a creator sees in one place how their posts perform and decides which of the 3 options fits. If you run an expert or B2B blog on LinkedIn, the practical step is simple. Open Dashboard, check which ways to earn are already available to your profile, and compare them with your stats: consultations make more sense to sell to people who read your posts, and video ads make sense where people already watch your videos.
What advertisers, creators and site owners should do
- If you upload customer lists or offline conversions to Google Ads through a CRM, files or the API, check your Data Manager settings before November 16, 2026, and talk to your lawyer about the switch from hashing to encryption.
- If your business has a page, a catalog or ads in Meta's services, decide before October 30, 2026, whether to let the company's crawler onto your site. You can block it in robots.txt.
- In Demand Gen, open Data Strength and connect enhanced conversions: without your own data, Google campaigns will have a harder and harder time.
Writes about: SMM, paid boosts, ads, traffic, suppliers, the market from the inside, daily news
