• Badge: ⚠️ Caution
• Red Flags:
  • RF1 — Own advertising / cross-service profiling
  • RF2 — High-risk third-country exposure without meaningful mitigation
• Risk Indicators:
  • Own-purpose data use (advertising); intrusive tracking; high-risk international transfers

Key Facts: Google Ads tags (conversion tracking, remarketing) transmit visitor data to Google for its own advertising ecosystem, building cross-publisher audiences. CNIL fined Google €325 million (Sep 2025) for showing promotional ads in Gmail without prior consent and for manipulative consent design. EU User Consent Policy mandates consent before personalised ads; Consent Mode v2 mandatory since Mar 2024. US transfer via DPF (contested: CJEU C-703/25 P pending).

Framework Note (v2.2): FRAMEWORK NOTE (v2.2): RF2 (high-risk third-country exposure) is recorded here as a significant risk factor and lowers the domain E score. Under the revised framework, RF2 alone does not trigger Caution — the Caution badge for this service is driven by RF1 / RF3 / RF4 (as noted above). The US transfer risk (where applicable) is covered by DPF participation and/or SCCs, which GDPR treats as a compliant transfer mechanism.

Quellen:

• Google Ads Terms of Service
• EU User Consent Policy (support.google.com/adspolicy)
• CNIL Google fine (€325M
• Sep 2025, cnil.fr)
• Google Privacy Policy.

• Support marketing analytics
• Receive personalised marketing offers
• Customise online ads (non-TCF)

• TPP Notified?: Not yet notified
• Decision Contested?: [nicht dokumentiert]