Enhanced conversions and your privacy policy: update both together

If you turn on enhanced conversions in Google Ads, your website starts sending a hashed email address and phone number to Google with each enquiry, and your privacy policy needs to say so. A policy written for a basic analytics setup often says the opposite. We found this on a client site on 7 October 2026, while setting up the tracking for a new Google Ads campaign, and it is now part of every Ads setup we do. This is a practical note, not legal advice.

What enhanced conversions do

Normally a conversion is recorded by a tag on your site when someone submits a form or taps a phone number. Enhanced conversions add the details the person typed, hashed first so the raw text is not sent. Google compares the hash with the accounts of people who clicked your ad, which helps it connect more conversions to the click that caused them. For a small account with few conversions, this can matter.

The data going to Google is the point of the feature. That makes it a disclosure.

What the template said

The privacy page on our site template was written once, for sites with Google Analytics and nothing else. Two sentences were the problem.

• It said no information is shared beyond the email service that delivers contact form messages.
• It said analytics "does not identify you personally".

With enhanced conversions on, the first is no longer true, because Google receives hashed contact details. The second becomes hard to defend for the advertising data. Google's customer data terms, which whoever runs the Ads account accepts under Goals, then Settings, ask the advertiser to disclose this use. The page had not been looked at since it was first cloned to the other sites, and nobody re-reads a privacy page when Ads measurement changes.

What we changed

For a builder whose campaign was about to launch, the privacy page was updated in the same deploy as the tracking:

1. A "who we share it with" line saying that hashed contact details submitted in an enquiry are sent to Google for advertising measurement.
2. A heading change from "Analytics" to "Analytics and advertising".
3. Two links: Google's page on how it uses data from partner sites, and the Ads personalisation settings page where a person can turn off personalised ads.

The same deploy also truncates tracking fields rather than rejecting a form over them, so an unusually long tracking value can never block a real enquiry. Both changes shipped together, because the page and the behaviour should never disagree for even a day.

A setting that is easy to switch on without noticing

When you create a new conversion action in the Ads wizard, the last step can pre-tick "Turn on enhanced conversions" next to an "Agree and finish" button that accepts Google's terms. If you click through, the feature is on and the terms are accepted. On the account above we unticked it until the decision had been made, and then turned it on deliberately.

Related features carry the same issue. Uploading offline conversions, for example marking which enquiries became real jobs, sends customer details to Google again. That one also waits for a deliberate yes from the account owner, and a policy change with it.

A short checklist

1. Find out what is on. In Goals, then Settings, check whether enhanced conversions for leads is enabled and who accepted the customer data terms.
2. Read your privacy page against what your site actually sends: analytics, ad tags, remarketing, enhanced conversions, offline uploads.
3. Change the wording to match, in plain language. Name Google, say what is sent and why.
4. Ship the page and the tracking together.
5. Re-read it whenever you change how Ads measures conversions.
6. Ask a lawyer if your business has specific obligations, for example in health or finance. Our privacy policy post covers the basics for a small site.

Where this fits

This is part of setting up tracking properly. The other halves are making sure the conversions are real (see Google Ads says 284 conversions, we counted about 30 real leads) and that the tags are not blocked by your own site (see Google Ads tracking breaks without anyone noticing). For accounts under our Ads management add-on, at $549 a month in AUD month to month, with your own Google Ads account and spend paid to Google directly, the privacy update is part of the setup. See pricing or get started.