Customer Match is a Google Ads feature that lets an advertiser upload a list of its own customers, identified by email addresses, phone numbers, postal addresses or other keys, and then show ads to those people, or keep ads away from them, when they are signed in to Google services. The data is hashed before it is compared, and only people Google can tie to an account join the resulting audience. It exists because a business knows more about its customers than any cookie does. A loyalty member or a phone buyer leaves no browsing trail on Google, yet the advertiser holds their contact details. Customer Match turns that record into an audience across Search, Shopping, YouTube, Gmail, Display, Demand Gen and Performance Max.

How a list becomes an audience

The process has five steps. The advertiser first exports a file from a customer relationship management (CRM) system or an ecommerce platform. Second comes normalisation: email addresses are trimmed of whitespace and lowercased, and phone numbers are written in the E.164 international format, with a country code and no symbols. Third, each value is hashed with SHA-256, a one-way cryptographic function, so the readable address never needs to leave the advertiser. Google hashes plain-text files uploaded through its interface.

Fourth, Google compares the hashes against hashed data from its own signed-in accounts. Name and address fields only work as a set: first name, last name, country and postal code are matched together. Since September 12, 2024, this comparison has run by default through Confidential Matching, which processes uploads inside trusted execution environments, hardware-isolated enclaves designed, according to Google, so that not even Google can read the data inside. Fifth, matched users join a list that can be attached to campaigns. Processing is not instant, and Google's help centre warns that it can take up to 48 hours.

The share of records that find an account is the match rate. It varies with list quality and with how many customers use Google while signed in. A low rate hurts exclusion as much as targeting: if only 40% of a 50,000-name file matches, 30,000 existing customers remain eligible to see acquisition ads.

Uploads reach Google by four routes: a file in the Google Ads interface, a scheduled transfer, a partner connector from a customer data platform (CDP), or an application programming interface (API). The API route changed in 2026. Google required Customer Match uploads to move to its Data Manager API by April 1, 2026, with limits of 10,000 audience members per request and up to 10 identifiers per member. Display & Video 360 (DV360), Google's demand-side platform (DSP), also accepts Customer Match lists for YouTube and partner inventory, and its API added support for the feature.

What advertisers do with it

A list can play three roles. As targeting, it restricts a campaign to known customers, for example an upgrade offer shown only to existing subscribers on Search. As observation, it leaves reach unchanged but reports on, and allows bid adjustments for, the listed users. As exclusion, it removes them, the basis of a suppression audience that stops acquisition budgets paying for people who already buy.

Automated campaigns now consume lists less visibly. In Performance Max a list serves as an audience signal, a hint rather than a boundary. Google's new customer acquisition goal uses uploaded lists to decide who counts as new, and the win-back modes announced in April 2025 bid higher for lapsed customers that the advertiser defines through Customer Match. Lists also feed Smart Bidding as a signal, and they can seed Lookalike segments in Demand Gen, Google's surviving version of lookalike modelling.

Policy, eligibility and limits

The Customer Match policy sets the rules. Advertisers may upload only data collected in a first-party context, must disclose in their privacy policies that information is shared with third parties for advertising, and must offer a way to opt out. The policy also falls under Google's personalised advertising rules, which bar targeting based on sensitive categories such as health conditions or financial hardship.

Eligibility has been tiered. Google's policy reserves full targeting for accounts with a good history of policy compliance and payment, at least 90 days of history and more than 50,000 US dollars in lifetime spend. Since a June 2021 expansion, any compliant account can use lists for observation and exclusion. Enforcement became more predictable with a January 2025 update, after which Google warns accounts seven days before suspending Customer Match access for violations.

Size and time limits shape usefulness. In December 2025 Google set one minimum of 100 active users across Search, Display and YouTube, down from 1,000 on Search for most segment types. Membership is finite: from April 7, 2025, Google capped list membership at 540 days, applying the cap retroactively. A member drops out unless re-uploaded, so a list built once and left alone decays into a dormant asset.

In the European Economic Area (EEA), consent is the gating condition. Google's EU user consent policy for Customer Match obliges advertisers to obtain consent for sharing personal data with Google and for personalised advertising, and, since March 2024, API uploads have carried two consent fields, ad_user_data and ad_personalization, for EEA users, according to Google's FAQ for upload partners. The mechanism mirrors Consent Mode on the tagging side.

Regulators have looked at what happens before the upload. Norway's data protection authority, Datatilsynet, fined two Elkjop companies NOK 20 million, about 1.85 million euros, in a decision dated June 1, 2026, partly because Elkjop planned to reuse loyalty club data for Customer Match without assessing whether the new purpose was compatible with the original one.

Origin and evolution

Google announced Customer Match on September 28, 2015, for Search, Gmail and YouTube, according to Fortune. It accepted email addresses only, with a 1,000-address minimum. Facebook had launched its equivalent, Custom Audiences, three years earlier. In November 2017 Google added phone numbers and mailing addresses as match keys, according to Search Engine Land, widening reach for businesses whose customers transact offline.

The feature gained weight as other signals weakened. Apple's App Tracking Transparency, enforced from April 2021, and browser limits on third-party cookies pushed advertisers towards first-party data. Google removed similar audiences in 2023, blocking new use from May 1 and deleting them on August 1, which left uploaded lists as one of the few advertiser-supplied audience inputs still under direct control.

The plumbing then changed. The Data Manager API, launched on December 9, 2025, combined separate pipelines for Customer Match, conversions and DV360 audiences. On May 28, 2026, it began accepting IP addresses as a Customer Match key, but not for DV360.

Why it matters

For search marketers, Customer Match is the main way to connect what happens in a CRM with what happens in an auction. It lets a subscription business stop paying for clicks from people who already subscribe. As bidding automates, the list increasingly works as an input to Google's systems rather than a targeting switch.

It is also a test of how first-party data travels. The same hashed file now moves to Google, Meta, Amazon, Microsoft and, since 2026, OpenAI, and each platform applies different minimums, retention windows and consent rules. Identity resolution and clean rooms form the wider infrastructure.

Limitations and disputes

The privacy claim behind hashing is contested. An unkeyed SHA-256 hash of a common email address can be recomputed by anyone holding the address, which is how the match works. The US Federal Trade Commission (FTC) warned on July 24, 2024 that hashed data is not anonymous, and European regulators treat such values as personal data.

Measurement is opaque. Google reports match rates and list sizes but not which users matched, so advertisers cannot audit accuracy. Its claim that IP addresses would lift match rates had not been backed by published data as of October 2026. The eligibility threshold also favours larger spenders: an account below 50,000 dollars can exclude its customers but not target them.

Control is shrinking as automation grows. In Performance Max a list is a signal Google may look beyond, and in Demand Gen, Lookalike segments seeded from lists moved from hard thresholds to suggestions in March 2026.

Not the same as

Meta Custom Audiences. Meta's list-upload product, launched in 2012, works on the same hash-and-match principle but against Facebook and Instagram accounts, with its own minimums and terms. OpenAI also uses the Custom Audiences name for customer list uploads in ChatGPT ads.

Amazon DSP audience upload. Amazon accepts hashed advertiser audiences through its Ads data manager and CDP integrations, matching them to Amazon shopper accounts rather than Google users.

Lookalike audiences. A lookalike finds new people who resemble a seed list. Customer Match reaches only the people on the list itself.

Match type. Keyword match types control which search queries trigger an ad. They share a word with Customer Match and nothing else.

Microsoft Advertising uses the name "customer match" for its own hashed-list feature, which works similarly on the Microsoft Search Network.

Recent developments

In September 2026 Google extended IP matching to Google Ads file uploads, excluding users in the 32 countries of the EEA, the UK and Switzerland. Google Ads API version 25, released on July 22, 2026, removed the lifecycle goal resources behind retention and win-back settings. Competing destinations are multiplying: LiveRamp connected brands' customer lists to ChatGPT ads in 11 markets on September 28, 2026. As of October 2026, Customer Match runs through a single API, with tighter retention and wider inputs than at any point since its 2015 launch.

Timeline

  • September 2012 - Facebook launches Custom Audiences for hashed customer files.
  • September 28, 2015 - Google launches Customer Match on Search, Gmail and YouTube, email only, 1,000-address minimum.
  • November 2017 - Phone numbers and mailing addresses become match keys.
  • June 2021 - Compliant accounts below the spend threshold gain observation and exclusion use.
  • May 1, 2023 - Google blocks new use of similar audiences; they are removed on August 1, 2023.
  • March 2024 - Consent fields required for EEA users in API uploads.
  • September 12, 2024 - Confidential Matching becomes the default for Customer Match.
  • January 2025 - Customer Match policy update introduces a seven-day warning before suspension.
  • April 7, 2025 - 540-day membership cap takes effect.
  • December 2025 - 100-user minimum standardised across Search, Display and YouTube.
  • December 9, 2025 - Data Manager API launches.
  • April 1, 2026 - Customer Match uploads must use the Data Manager API.
  • May 28, 2026 - Data Manager API accepts IP addresses for Customer Match.
  • June 1, 2026 - Datatilsynet fines Elkjop NOK 20 million, partly over planned Customer Match reuse.
  • September 2026 - IP matching extends to Google Ads file uploads.

Summary

Who: Google operates Customer Match; advertisers, agencies, CDPs and onboarders supply the lists; regulators such as the FTC and Datatilsynet police how the data is collected and shared.

What: A feature that matches hashed customer identifiers, such as emails, phone numbers, addresses and now IP addresses, to signed-in Google accounts for targeting, observation and exclusion.

When: Launched on September 28, 2015, expanded to phone and address in 2017, opened more widely in 2021, capped at 540 days from April 2025 and moved to the Data Manager API on April 1, 2026.

Where: Search, Shopping, YouTube, Gmail, Display, Demand Gen and Performance Max in Google Ads, plus YouTube and partner inventory in DV360.

Why: Advertisers hold contact details that cookies cannot replicate, and as tracking signals weaken, uploaded lists are one of the few audience inputs Google still lets them supply directly.