Google Updates Advertising Products for Upcoming 2025 State Data Privacy Laws

Google recently announced important updates for three of its advertising programs (AdSense, AdMob, and Ad Manager) to address compliance with state data privacy legislation in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey, each of which come into effect in January 2025.

Beginning on November 15, 2024, restricted data processing (“RDP”) is one of the key features that will be extended to these five states, allowing program users to limit how an individual’s data is processed for specific regions. When RDP protections are enabled, Google will only serve non-personalized ads to individuals.  Non-personalized ads are not based on a user’s past behavior.  Instead, user ads are targeted using contextual information, like a user’s current location or the content on the current site or app or current query terms.  RDP will not allow interest-based targeting, including demographic and user list targeting.

When the RDP mode is enabled using the network control or when a RDP signal is passed in the tag, Google restricts the following for programmatic transactions:

• Ads that serve do not use information based on the user’s past behavior.
• Google does not record information against user identifiers for the purposes of personalized ads measurement or targeting.
• No ads serve using interest-based audience targeting (including demographic targeting and remarketing list targeting).
• Ads served via Google Ads and Display & Video 360 will only use contextual and placement targeting. These ads may use IP address for very coarse level geo-targeting (city-level) and to prevent invalid activity. These ads also use cookies for frequency capping, aggregated ad reporting, and to combat fraud and abuse.
• Restricted data processing ad requests are sent to third party real time bidders if they are selected in the ‘Review your ad partners” list.

In response to the upcoming effective dates, Google is also supplementing its existing Data Processing Terms and its Controller-Controller Data Protection Terms.  No action is required from users to accept the revised terms if they have already agreed to the respective terms – meaning the changes will automatically take effect to align with the new state laws.