Google Ads (AdWords) Remarketing Privacy Policy: What Google Requires You to Disclose

Published October 22, 2026 · Checked against Google's help and policy pages on that date

If you run Google Ads remarketing, which Google now calls "your data" segments, your privacy policy must include four things listed in Google's help article "What to include in your privacy policy for your data segments": a description of how you use your data to advertise online, a statement that third-party vendors, including Google, show your ads on sites across the Internet, a statement that those vendors use cookies and/or device identifiers to serve ads based on someone's past visits, and instructions for opting out of Google's use of cookies or device identifiers.

AdSense, AdMob and Google Analytics carry their own, overlapping privacy policy obligations, and Google's EU user consent policy adds consent duties for visitors in the EEA, the UK and Switzerland. This guide names the policy behind each requirement and ends with a disclosure block you can adapt. It is not legal advice.

Which Google Products Require a Privacy Policy Disclosure

Each obligation comes from a specific Google document you accepted when you opened the account. A site that runs Google Ads remarketing tags and Google Analytics, or an app that shows AdMob ads, is usually bound by two or three of them at once.

Google product	Policy that sets the requirement
Google Ads remarketing ("your data" segments)	The Restricted targeting in Personalized advertising policy, section "Data collection and use in personalized advertising", which points to the help article "What to include in your privacy policy for your data segments".
AdSense	AdSense Program policies, which incorporate the Google Publisher Policies section "Privacy disclosures", plus the AdSense help article "Required content".
AdMob (and Ad Manager)	The same Google Publisher Policies, "Privacy disclosures" under Privacy-related policies.
Google Analytics	Google Analytics Terms of Service, Section 7 ("Privacy"); if you turn on advertising features, also "Policy requirements for Google Analytics Advertising Features".
All of the above, for EEA, UK and Swiss users	EU user consent policy.

The Exact Disclosures Each Product Requires

Google Ads remarketing ("your data" segments)

How you use the data: "an appropriate description of how you're using your data to advertise online."
Third-party vendor notice: that third-party vendors, including Google, show your ads on sites across the Internet.
Cookie and identifier notice: that third-party vendors, including Google, use cookies and/or device identifiers to serve ads based on someone's past visits to your website.
Opt-out: how visitors can opt out of Google's use of cookies or device identifiers by visiting Google's Ads Settings. Google allows two alternatives: a third-party vendor's opt-out page, such as the Network Advertising Initiative opt-out, or the user's device settings for device identifiers.

If you use Google Marketing Platform pixels, Google's article says your policy can direct people to opt out of "Google Marketing Platform's use of cookies" through the GMP opt-out page or the NAI opt-out page.

AdSense and the DoubleClick cookie

The AdSense "Required content" article lists three statements for your privacy policy:

"Third party vendors, including Google, use cookies to serve ads based on a user's prior visits" to your website or other websites.
"Google's use of advertising cookies enables it and its partners to serve ads to your users" based on their visits to your sites and/or other sites on the Internet.
"Users may opt out of personalized advertising by visiting" Ads Settings, or opt out of a third-party vendor's cookies at www.aboutads.info.

Older AdSense templates told publishers to disclose "Google's use of the DART cookie" or "the DoubleClick cookie". Google retired the DoubleClick brand in 2018, and the current wording is "Google's use of advertising cookies". Google's cookie page names the cookie involved: the "IDE" cookie is used to show Google ads on non-Google sites and, when personalized ads are on, to personalize them. If you have not blocked third-party ad networks in AdSense, you must also name the other vendors serving ads on your site, link to their websites, and tell users how to opt out of their cookies.

Google's help pages still link Ads Settings at google.com/settings/ads; Google's own cookie page now sends users to My Ad Center (myadcenter.google.com) to turn off personalized ads. Linking either reaches the same controls.

AdMob and Ad Manager

The Google Publisher Policies require a privacy policy that "clearly discloses any data collection, sharing and usage" resulting from your use of Google products. It must disclose the technologies used, such as cookies, web beacons, IP addresses or other identifiers, and that third parties may place and read cookies on users' browsers or use web beacons or IP addresses to collect information as a result of ad serving. In an app the identifier is the device's advertising ID, so name it and explain the device-level opt-out (on Android, Settings > Privacy > Ads; on iOS, the App Tracking Transparency prompt and Settings > Privacy & Security > Tracking). If the app is in Google Play's Families program, see the children's privacy rules that restrict ad SDKs and identifiers.

Use the SDK disclosure generator to list what the AdMob and Firebase SDKs collect before you write this section.

Google Analytics

Section 7 of the Google Analytics Terms of Service requires a privacy policy that gives notice of your use of cookies that collect data, and states: "You must disclose the use of Google Analytics, and how it collects and processes data." Google accepts a prominent link to its page "How Google uses data when you use our partners' sites or apps" (policies.google.com/privacy/partners) as one way to do this. Section 7 also bars sending Google personally identifiable information.

Turning on Advertising Features (remarketing with Google Analytics, Google Display Network Impression Reporting, Demographics and Interest Reporting, or integrated services that collect data for advertising) adds three disclosures: which features you implemented, how you and third-party vendors use first-party cookies (such as the Google Analytics cookie) and third-party cookies or identifiers together, and how visitors can opt out, for example through Ads Settings or the NAI consumer opt-out.

One US law that overlaps: CalOPPA

California's Online Privacy Protection Act (Cal. Bus. & Prof. Code 22575) requires a commercial website collecting personally identifiable information from California residents to post a privacy policy that states how it responds to browser Do Not Track signals and whether other parties may collect personally identifiable information about users' online activities over time and across different websites. Remarketing is that cross-site collection, so add both statements alongside Google's required wording.

Google's EU user consent policy applies to end users in the European Economic Area, the UK and Switzerland. For properties you control, you must:

obtain end users' legally valid consent to the use of cookies or other local storage where legally required, and to the collection, sharing and use of personal data for personalization of ads;
retain records of consent given;
give users clear instructions for revocation of consent;
clearly identify each party that may collect, receive or use their personal data as a consequence of your use of a Google product, with prominent information about that use.

Failing to comply can lead Google to limit or suspend your use of the product or terminate your agreement. Two implementation rules follow from it:

Publishers (AdSense, Ad Manager, AdMob): to serve personalized ads, you must use a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework. Google set this for the EEA and UK from January 16, 2024, and for Switzerland from July 31, 2024.
Advertisers (Google Ads, Google Analytics): consent is passed through consent mode as the ad_user_data and ad_personalization signals. For Customer Match lists created since March 2024, Google treats missing signals as not consented and will not use EEA users' data for ad personalization.

Your privacy policy should say which consent tool you use and how a visitor reopens it to withdraw consent. To check whether GDPR reaches a non-EU business at all, see when GDPR applies to companies outside the EU.

Copy-Ready Google Advertising Disclosure Block

This block covers the Google Ads, AdSense, Publisher Policies and Google Analytics wording above. Replace the bracketed items and delete paragraphs for products you don't use.

Advertising and analytics section (copy and edit)

Advertising, Remarketing and Analytics

Remarketing. We use Google Ads remarketing to advertise [our
products / our app] online. When you visit [site/app name], we may
add you to an audience list so that our ads can be shown to you
later.

Third-party vendors, including Google, show our ads on sites across
the Internet. Third-party vendors, including Google, use cookies
and/or device identifiers to serve ads based on your past visits to
our website [and other websites].

[If you show ads with AdSense, AdMob or Ad Manager:] Google's use of
advertising cookies enables it and its partners to serve ads to you
based on your visits to our site and/or other sites on the Internet.
Third parties may place and read cookies on your browser, or use web
beacons, IP addresses [or your device's advertising ID] to collect
information as a result of ad serving. [Name each other ad network
that serves ads here, with a link to its site.]

Google Analytics. We use Google Analytics to understand how visitors
use our [site/app]. It uses cookies [and app instance identifiers]
to collect usage data. Learn how Google uses this data:
https://policies.google.com/privacy/partners
[If Advertising Features are on:] We use [Remarketing with Google
Analytics / Demographics and Interest Reporting]. We and third-party
vendors, including Google, use first-party cookies (such as the
Google Analytics cookie) and third-party cookies (such as Google
advertising cookies) together to [inform, optimize and serve ads
based on past visits].

Your choices. You can opt out of personalized advertising from
Google at https://www.google.com/settings/ads (My Ad Center), and
out of many third-party vendors' cookies at
https://www.aboutads.info/choices/ or
https://optout.networkadvertising.org/. On mobile, you can reset or
delete your advertising ID in your device settings. You can also
use the Google Analytics Opt-out Browser Add-on.

Do Not Track. Our site [does not respond / responds as follows] to
browser Do Not Track signals: [describe]. Other parties, including
Google, may collect information about your online activities over
time and across different websites when you use our site.

Visitors in the EEA, UK and Switzerland. We ask for your consent
before setting advertising or analytics cookies and before using
your personal data to personalize ads, using [consent tool name].
You can withdraw consent at any time by [reopening the cookie
settings link in our footer].

The rest of your policy still needs the data you collect, retention and user rights. In the free privacy policy builder, select AdMob or the Firebase SDKs you use under SDKs & Permissions, then choose Personalized ads or Remarketing under Ads & Analytics.

Frequently Asked Questions

What is remarketing in Google AdWords?

Remarketing lets you show ads to people who have already visited your website or used your app, as they browse other sites and apps. Google renamed AdWords to Google Ads in 2018, and remarketing lists are now called "your data" segments in the Google Ads interface.

What is Google Ads' privacy policy?

Google's handling of data from its ad products is covered by the Google Privacy Policy and its "Advertising" page at policies.google.com/technologies/ads. That is Google's own policy. As an advertiser, your obligation is the separate list in "What to include in your privacy policy for your data segments", which goes in your own policy.

Is it a legal requirement to have a privacy policy on a website?

Often, yes. CalOPPA requires one from commercial websites collecting personally identifiable information from California residents, and GDPR Articles 13 and 14 require this information to be given to people in the EU whose data you collect. Separately, Google Ads, AdSense, AdMob and Google Analytics all require one by contract. See whether your website legally needs a privacy policy.

Are targeted ads an invasion of privacy?

Views differ, and the law handles it through notice and choice. In the EU, the ePrivacy rules and GDPR generally require consent before non-essential advertising cookies are set. In California, the CCPA as amended by the CPRA lets consumers opt out of sharing personal information for cross-context behavioral advertising. Google's policies require you to disclose remarketing and offer an opt-out wherever you use it.

This page summarizes Google's policies as of the date above; it is not legal advice. Sources: What to include in your privacy policy for your data segments, Restricted targeting in Personalized advertising, AdSense required content, Google Publisher Policies, Google Analytics Terms of Service, Google Analytics Advertising Features policy, EU user consent policy, Google-certified CMP requirement.