Google Ads Enhanced Conversions: Is a Hashed Email Still Personal Data Under KVKK?

When you turn on the “Enhanced conversions” setting in Google Ads, the email address, phone number and address of the person who fills in the form or makes a purchase are hashed and sent to Google. Most explanations stop here and conclude with “there’s no problem because it’s hashed.” In this article we look at which parts of that sentence are right and which are incomplete. Our sources were Google’s help pages, the KVKK Authority’s regulation and the EDPB’s guidelines.

Short Answer

Hashing is a way to transport data securely, but there is no strong basis for treating it as anonymization. Because the hash of an email address can be reproduced and matched by anyone who knows the address, it most likely remains personal data. So when enabling enhanced conversions, you need to make sure your consent infrastructure (banner, Consent Mode) and your privacy notice cover this flow.

What exactly do enhanced conversions do?

According to Google’s help page, the feature supplements your existing conversion measurement by sending hashed first-party conversion data to Google. The data that can be used includes the customer’s email address, name, home address and phone number. Matching is done by comparing the hashed data with signed-in Google accounts.

The goal is simple: when a cookie or click ID alone isn’t enough, to be able to link a conversion to an ad click using the real customer information on the order page. There are two types. Enhanced conversions for web complement the conversion tag on the site, while the version for leads improves offline conversion import.

How does hashing work?

Before data is sent, Google asks for leading and trailing whitespace to be removed, text to be converted to lowercase, phone numbers to be formatted in E.164, and dots before the domain to be removed from gmail.com and googlemail.com addresses. Hexadecimal SHA256 is then applied. Google describes this as a one-way algorithm.

Here’s the detail: you don’t necessarily have to do the hashing yourself. If data is collected using the Google tag or GTM’s automatic collection method, hashing is done on Google’s side. If you prepare a user_data object with custom code in GTM, you can either hash the data in advance or leave it to Google. Whichever route you choose, the rules are the same.

“One-way” doesn’t mean “anonymous”

Being one-way means you can’t work backwards from the hash to compute the email. But the problem isn’t reversing, it’s matching. The same email address produces the same hash every time. Someone who already knows the email can hash the addresses on their own list in the same way and find the person by comparison. This is also how enhanced conversions work: Google matches the hash with the people in its own accounts.

The KVKK criterion is decisive at this point. According to Article 10 of the Regulation on the Deletion, Destruction or Anonymization of Personal Data, anonymization means making data impossible to link with an identified or identifiable natural person, even when matched with other data. The same article requires that this result be achieved even if the data controller or recipient uses all of the reversal and matching techniques. It is hard to argue that a flow based on matching meets this criterion.

There is a similar line in Europe. In the pseudonymisation guidelines adopted at the EDPB’s January 2025 plenary, it states that pseudonymised data that can be linked to a person with additional information remains personal data. The text was published for public consultation, and the consultation period ended on 28 February 2025. We recommend checking the final version. One more note: these guidelines are for the GDPR and do not bind the KVKK. What we are doing here is showing that the two frameworks point in the same direction. We could not find a KVKK Board decision specifically on enhanced conversions, so we are not saying “the Authority said this.” This article is not legal advice; it is our own reading.

How is consent tied in on Google’s side?

According to Google’s privacy disclosure, user data is not collected unless the terms of service are accepted and the required consent parameters are set to “granted.” If Consent Mode is applied, the same page states that the advertising cookie depends on the ad_storage consent status. All data that cannot be linked to a conversion is deleted. To enable the feature, you must accept the Google Data Processing Terms for Google Ads and comply with the customer data policies.

This means Consent Mode must already be set up correctly. Turning on enhanced conversions on a site whose default values are wrong, or whose banner is not connected to the tags at all, increases the risk. We covered the topic in detail in our Consent Mode v2 article. Google's page gives no detail on the cookie consent interface shown to users; that part is up to you and your legal counsel.

What to check for KVKK compliance

• Privacy notice: State that data such as email and phone number is hashed and transferred to Google for ad measurement. A sentence like "We use cookies" does not describe this data flow.
• Legal basis and consent: Decide on what basis the data is processed. For advertising-related flows, clarify this with your lawyer. If you rely on consent, the data of a person who declines must not be sent.
• Transfer abroad: Google processes data outside Turkey. KVKK's provisions on cross-border transfers apply to this flow as well. Which mechanism you use here depends on your contract and consent structure.
• Sensitive categories: According to Google's documentation, conversions related to sensitive categories cannot be used in enhanced conversions. If you work in fields such as healthcare, don't enable this feature at all, or ask an expert first.
• Don't send unnecessary fields: If an email is enough without name and address, collect only that.

Setup and verification

In Google Ads, go to Goals, Conversions, Settings, open the "Enhanced conversions for web" section, enable the feature and accept the compliance statement. On the tag side, the options are the Google tag, GTM or the Google Ads API. Menu names may change with the interface, so check the current path on Google's help page.

To verify, check whether the em or pn parameters in the browser's network requests carry a hashed value. If you see a plain email, the setup is faulty. Google's diagnostics report appears after about 48 hours. Seeing a "processing" status in the first few days is normal.

If you want to track jobs closed via WhatsApp after the sale on the Meta side, see our article on ctwa_clid and the Conversions API for a similar approach.

Is it worth enabling?

This is a measurement quality decision. Google says the feature improves accuracy, but we can't know in advance how much difference it will make in your account, so we don't give figures. It is worth trying for sites that collect leads through forms or sell online and have a meaningful monthly ad budget. If your consent setup isn't solid yet, fix that first, then enable it. In this order, the data comes in cleaner and you also end up with a setup you can defend.

FAQ