Data Manager will stop requiring hashed customer data from 16 November

What changed

Anthony Higman has highlighted a Google Ads Data Manager notice that says the product will stop requiring customer data to be SHA-256 hashed from 16 November 2026.

The notice, shown in the screenshot, describes customer data as being encrypted by default before it is handled through Data Manager. It refers to CRM connections, cloud imports, direct-file uploads and the Data Manager API. Google says data would be decrypted, normalised and matched inside a hardware-isolated trusted execution environment.

For advertisers and data teams, the practical implication may be a change to preparation workflows for eligible Data Manager imports. It should not, however, be read as a statement about every Google Ads customer-data upload route. The supplied evidence only concerns Data Manager and the named connection and import methods.

Important implementation details remain unconfirmed. The evidence reviewed does not establish whether existing hashed-input workflows will continue unchanged, which accounts or regions are eligible, or whether any further consent, policy or configuration requirements apply. It also does not provide direct official documentation beyond the email image.

PPC Land coverage dated 18 October was reviewed separately and credited Higman. The exact publication date of Higman’s LinkedIn post is unresolved, so this is best treated as a provisional notice-led update rather than a claim of first reporting.

Week 43 source and practical context

A Google notice says that from 16 November Google Ads Data Manager will accept encrypted rather than SHA-256-hashed customer data by default for CRM connections, cloud imports, file uploads and the API, with decryption, normalisation and matching done inside a hardware-isolated trusted execution environment; it applies to Customer Match and enhanced conversions. The confidential-matching help page still tells you to hash, and the notice does not say how existing hashed uploads, key custody or opt-outs work. Do not change an existing hashed-input pipeline until the current documentation and the account’s own notice clarify compatibility and requirements.

The effective date in the notice and the 18 October coverage date serve different purposes: one is a planned implementation milestone, the other locates the report. Keep the notice with the import specification and confirm the applicable route before changing how customer data is prepared.