PIPELINEGuide
Google Ads and data protection: what GDPR requires
As soon as personal data is processed in Google Ads, clear obligations apply. What these are specifically, what is almost always missing in practice, and what actually suffices.
As soon as personal data is processed in Google Ads, you need a legal basis, purpose limitation, defined deletion periods, information for data subjects, and a data processing agreement with every service provider involved. In practice, the same three points are almost always missing: the deletion period, the notice at the point of collection, and clarification of whether the provider uses the data for its own training.
01 — Data Protection
What GDPR requires
As soon as personal data is processed — and that happens faster than expected, for instance as soon as someone enters a name or phone number — the usual obligations apply: name the legal basis, define the purpose, maintain data minimization, define retention periods, inform data subjects.
In practice, this means for Google Ads: a data processing agreement with every service provider involved, checking where processing takes place, a documented deletion period, and a clear section in the privacy policy. Three things are almost always missing in practice: the defined deletion period, the notice at the point where data is collected, and clarification of whether the provider uses the data for its own training.
A data protection impact assessment is only required when there's likely high risk — not for most projects of this type. The review itself should still be documented so that if questions arise, it's clear why it was omitted.
02 — Contract
What needs to be clarified in writing
- Ownership of data and access. They belong to the client. If a provider won't clearly confirm this, that's the most important information from the conversation.
- Handover upon termination. In what format, within what timeframe, at what cost.
- No minimum term without consideration. Lock-in is justifiable if something is delivered in return — otherwise not.
- What a later change costs. The total cost isn't determined by the project price, but by the hourly rate in year three.
- Documentation as a deliverable. Not as a promise, but as a line item in the proposal.
03 — Risks
What can go wrong
- The system answers incorrectly. Containable by having it work exclusively from verified content and escalate when uncertain rather than guess. This is a configuration decision, not a property of the technology.
- The effort is underestimated. Most common reason: unclear starting situation. An honest assessment of the current state before the proposal prevents this more reliably than any buffer.
- No one maintains it. The biggest risk of all — and the most easily avoidable.
- Data protection gaps. Almost always arise from missing deletion deadlines and unclear responsibility, rarely from the technology itself.
- Vendor lock-in. Avoidable if access credentials, data, and documentation contractually remain with the client.
04 — Questions
Frequently asked questions
Can we adjust the budget at any time?
Yes, at any time and without notice. Ads can also be paused completely, for example if you're fully booked and don't want additional inquiries.
Can't we do this ourselves?
In principle, yes. The point where it breaks down is measurement: without proper tracking of inquiries, the automation optimizes for clicks, and then it gets expensive. If you set it up correctly once, you can continue much of it yourself.
What are the most common budget drains?
Missing exclusions — search queries with “free”, “DIY”, “jobs”, or place names outside your service area. And ads that lead to the homepage instead of a relevant page.
What happens to the budget on weekends or holidays?
That can be controlled — for some industries (trades, B2B), it makes sense to pause ads there because hardly anyone searches with purchase intent at those times. For others (hospitality, leisure), that's exactly the most important time.
How quickly will we see results?
First clicks on the same day, reliable insights after three to four weeks. Before that, the numbers are too small to draw conclusions from.
What's the difference from social media advertising?
Google Ads reaches people actively searching for something — purchase intent is usually already there. Social media advertising generates interest among people who haven't searched for it yet. Both have their place, depending on the goal.
Is it worth it alongside SEO?
Both together usually make sense: ads work immediately and can be turned off, SEO works slowly and persists. If you need inquiries today, start with ads; if you want to be more independent in two years, invest in content in parallel.
Next step
Initial assessment, no obligation.
Briefly describe what you need. You'll get an honest answer about what's realistic and what it will roughly cost.