YouTube Ads GDPR Compliance: A Guide for EU Businesses

YouTube ads GDPR compliance in the EEA is mostly decided in Google Ads, because that is where YouTube campaigns are bought, measured and targeted. The consent rules for the tags on your own website are the same as for any Google Ads campaign, and our Google Ads GDPR settings guide covers that setup. This article covers what is different on YouTube: audiences built from your channel viewers, Customer Match lists on YouTube inventory, made-for-kids content and the ban on personalised ads to minors, and where brand safety stops and privacy starts.

1. Who is responsible for what

Most confusion about YouTube and GDPR comes from not knowing which part is yours. Google publishes two sets of data protection terms for its ads products. Google Ads in general runs under the Google Ads Controller-Controller Data Protection Terms, while Google Ads Customer Match is listed as a processor service under the Google Ads Data Processing Terms. That split matters: for Customer Match you are the controller of the list and Google processes it for you; for most other features, Google is a controller in its own right.

Task	Your job (advertiser)	Google / YouTube's job
Consent for the Google tag, conversion tracking and remarketing on your website or app	Collect legally valid consent, keep records, pass consent signals	Adjust tag behaviour to the signals you send
Customer Match lists used on YouTube	Controller: lawful basis, consent where needed, consent signals for EEA users	Processor under the Data Processing Terms
Personalisation of ads for people watching YouTube	Choose audiences that respect Google's personalised advertising policy	Its own relationship and settings with the viewer
No profiling-based ads to minors	Do not try to work around the restrictions	Platform duty under DSA Article 28(2) and Google's own policy
Where ads appear (brand safety)	Choose inventory type and exclusions	Classify content and enforce the settings
What the ad says	Accurate, lawful claims and disclosures	Ad policy review

Google's EU user consent policy applies to the properties you control. It requires legally valid consent for cookies or other local storage where the law requires it and for the use of personal data to personalise ads, records of that consent, clear information on how to revoke it, and identification of each party that may collect or use the data. Google's help page for the policy also asks you to link to Google's Business Data Responsibility site (business.safety.google/privacy) so visitors can see how Google uses the data.

2. Consent mode signals and YouTube measurement

A YouTube campaign has no separate consent setup. The conversions credited to a video ad are still recorded by the Google tag on your site or the SDK in your app, so they follow the same consent state. If that state is wrong for Search, it is wrong for YouTube too.

What matters for video teams is knowing what each signal controls. Google's consent mode has four main parameters:

• ad_storage: whether advertising cookies can be stored.
• ad_user_data: whether user data related to advertising can be sent to Google.
• ad_personalization: whether data can be used for personalised advertising, which includes remarketing.
• analytics_storage: whether analytics cookies can be stored.

Google states that consent is required for users in the EEA, the UK and Switzerland, and that you must collect consent and share consent signals with Google to keep using its tags for measurement, ad personalisation and remarketing on that traffic. In the basic version of consent mode, Google tags do not load until the visitor interacts with the banner. In the advanced version, tags load straight away and send cookieless pings while consent is denied, which Google uses for modelling. Which version fits your risk appetite is a decision for you and your adviser, not a default to accept unread.

The practical consequence for YouTube: if ad_personalization is denied, that visitor should not end up in a website remarketing segment you then target on YouTube. Test this with Google Tag Assistant by rejecting cookies on your own site and checking that the consent state reads denied before you make a choice.

3. Audiences built from your channel viewers

Once a YouTube channel is linked to a Google Ads account, you can create data segments from people who interacted with your channel or videos and target them, or exclude them, in campaigns. You manage links in Google Ads under Tools, then Data manager, then YouTube. You build the segment in Audience manager (under Tools, Shared library) by adding a new segment and choosing YouTube users.

Google sets these rules for YouTube data segments, as of October 2026:

• A segment needs at least 100 active users before it can serve.
• Membership lasts at most 540 days.
• Videos marked as made for kids are not eligible, and neither are videos with sensitive content.
• The videos must comply with Google's personalised advertising policy.

The privacy point that is easy to miss: the viewer data stays with Google, but you decide what the segment is used for. Google's personalised advertising policy bans advertiser-curated audiences for sensitive categories such as health, religious beliefs, sexual orientation, negative financial status and political affiliation, among others. Advertisers in those categories cannot use advertiser-curated audiences, such as data segments or Customer Match, although Google's predefined audiences remain allowed. So a clinic, a debt adviser or a gambling operator should not build remarketing from its channel viewers for those ads, however tempting the subscriber list looks.

Two habits help. First, mention in your privacy notice that you advertise on YouTube using audiences based on interactions with your channel and website. Second, keep a short internal note of each segment, its purpose and its membership duration. Shorter durations are easier to justify than the 540-day maximum.

4. Customer Match on YouTube

Customer Match lets you upload your own customer data, such as email addresses, and reach those people on Google properties including YouTube. Because you are the controller, the lawful basis is yours to prove.

Since March 2024, Google has required consent signals for EEA users in Customer Match. For uploads through the API or an upload partner, both consent fields, ad_user_data and ad_personalization, must be set to granted. Google treats missing values as not consented, so that data is not processed. If you send denied for either field, the upload returns an error and the data cannot be used for personalisation. If a partner tool uploads lists for you, it is your job to make sure it passes these signals.

Before you upload a list for a YouTube campaign, check three things:

1. The consent you collected covers sharing the data with Google for advertising. A newsletter opt-in that said nothing about ads on other platforms probably does not.
2. Known under-18 customers are removed. Google's policy says users under 18 are not eligible for personalised advertising of any kind.
3. The list does not come from viewers of child-directed content. Google's personalised advertising policy prohibits uploading customer information from those viewers.

Customer Match lists also have a 540-day membership limit, and a list needs at least 100 members added or updated in that window to stay eligible. Refresh lists from your current consent records rather than re-uploading an old export.

5. Made-for-kids content and minors

Article 28(2) of the Digital Services Act says providers of online platforms must not show ads based on profiling, using a user's personal data, when they are aware with reasonable certainty that the user is a minor. That obligation sits with the platform, not with you. Article 28(3) adds that platforms do not have to process extra personal data just to work out whether someone is a minor.

Google's own rules go further than the minimum and apply to you as an advertiser:

• Users under 18 are not eligible for personalised advertising of any kind, including Google's predefined audiences.
• On content set as made for kids, and for supervised accounts, personalised ads, remarketing and other personalised targeting are prohibited. Only contextual ads are allowed, based on the content being watched, current searches and general location.
• Ads on that content may not use third-party trackers or otherwise try to collect personal information.
• Whole categories are banned there, including food and beverages, beauty and weight loss, dating, political ads and regulated products.

What this means in practice: you cannot reach teenagers on YouTube through audience targeting, and you should not try to rebuild that reach through lookalike tricks or by targeting your own young customers. If your product is aimed at families, plan contextual campaigns and accept that measurement on that inventory will be limited.

6. Brand safety is not a privacy setting

Content suitability settings decide where your ads appear. Google offers three inventory types for video: Expanded, Standard (the default for all accounts) and Limited, which applies stricter rules, especially for inappropriate language and sexual suggestiveness. Some content is excluded whatever you choose, such as heavy profanity, nudity in thumbnails, drug-related content and terrorism. You set the inventory type and excluded content types and labels at account level under Campaigns, then Audiences, keywords, and content, then Content, then the Settings tab.

These controls protect your brand. They do not make tracking lawful, and a perfect consent setup does not stop your ad from running next to unsuitable videos. Treat them as two separate checklists. There is one useful overlap: contextual choices such as topics, keywords and placements do not depend on audience lists you supply, so they keep working when many EU visitors reject cookies.

7. The ad text still carries risk

Privacy settings say nothing about what your video ad promises. For Demand Gen video ads, Google allows headlines up to 40 characters (shown in the skippable in-stream format), long headlines and descriptions up to 90 characters, and a business name up to 25 characters, and Google asks for at least three unique headlines, long headlines and descriptions. On YouTube Shorts, any of these can appear as the description, so every line must stand on its own.

Keep remarketing copy neutral. A line such as "Still thinking about the course you watched?" tells the viewer, and anyone beside them, that they were tracked. It also reads badly if the viewer never agreed to remarketing in the first place. Invite, do not reveal.

Common mistakes

• Assuming the YouTube channel and the Google Ads account are separate for privacy purposes once they are linked.
• Building remarketing segments from a health, debt or gambling channel for ads in those categories.
• Uploading a Customer Match list without consent signals for EEA users and wondering why match rates collapsed.
• Keeping the 540-day maximum on every segment by default.
• Expecting to reach under-18s with audience targeting, or adding tracking pixels to campaigns that run on made-for-kids content.
• Treating Limited inventory as a substitute for a working consent banner.

What to do this week

1. Open Data manager in Google Ads and list every linked YouTube channel. Unlink any you do not use for advertising.
2. Review every YouTube data segment: purpose, membership duration and whether your ads fall into a sensitive category.
3. Reject cookies on your own site and confirm in Tag Assistant that all four consent parameters read denied on the first page load, before you make a choice.
4. Check that your consent banner or privacy notice links to Google's Business Data Responsibility site.
5. Confirm your Customer Match uploads send ad_user_data and ad_personalization for EEA users, and that the underlying consent covers advertising.
6. Set an account-level inventory type on purpose rather than leaving the default unexamined.
7. Read your current video headlines and descriptions for lines that reveal tracking or make claims you cannot back up.

For the wider framework, see our complete guide to GDPR-compliant marketing for European SMEs, our article on GDPR retargeting and our practical guide to cookie consent.

Where Adverizeo fits

Adverizeo does not make video ads. It writes the text around them, such as YouTube headlines, long headlines and descriptions within the format limits, and gives each text ad a compliance score with suggestions, as a risk check rather than a legal guarantee. You can test existing copy with the free GDPR ad checker, read how the check works on our GDPR page, or create a free account.

This article is general information, not legal advice.