Google is adding encryption and other data-security measures to a core ad product, which is meant to give advertisers more control over their customer information at a time when data handling is being watched closely by regulators.

On Thursday, Google introduced a confidential way for advertisers to use Trusted Execution Environments to protect their first-party data from prying eyes, rivals or tech platforms. A Trusted Execution Environment is a computing platform that isolates sensitive data and enables encryption to securely work with data. Google's new product was dubbed “confidential matching,” bringing technology that already applies to other parts of Google’s business into the ads platform. Confidential matching will be applied to “customer match” data, the program in which brands share lists of customers to Google to find targets for their ad campaigns. Brands often share email lists and other consumer data with platforms, such as Google, to finetune their ad campaigns and measure how accurately they found their intended targets. Marketers, however, have become more fastidious about sharing such data, and the internet advertising world is evolving to meet new regulatory standards.

“The idea [is] that when you bring your data in, that you’re able to process it and match it without anyone else who is playing getting more access to the information,” said Kamal Janardhan, Google’s senior director of product. “Think about it as if, I bring a set of data into a system and I want to confidentially match it with another piece of data, that effectively Google has, I’m able to do this in a Trusted Execution Environment, in such a way that no one, not even Google, has access to that information.”

Google will also allow brands to analyze “enhanced conversions” through a Trusted Execution Environment, but not right away, Google said in its announcement. Enhanced conversions are similar to customer match in that brands send first-party data to Google, but in this case the data is used to generate reports about campaign results. Brands could be looking for a more secure way to work with the data they need to track conversions.

Also read: Google pulls Gemini AI demo video 

Google has already provided Trusted Execution Environments for brands through Google Cloud, where brands import data to analyze and mix-and-match it with third-party data, without mingling data in unsecure ways. Confidential Matching is the first use of the trusted environments within ad products, Janardhan said.

Also read: Google’s ad tech business may be too big to sell

Trusted Execution Environments, data clean rooms, privacy-enhancing technologies and other safe computing environments are becoming more essential to ad tech platforms. Brands are pickier with how they share their data with major platforms and other brands that use those same platforms, and the consumer mood has shifted toward privacy. The ad tech industry is still trying to figure out ways to provide highly personalized advertising while respecting when consumers opt into, and out of, sharing their data. 

Google has been trying to lay the ground work for an ad platform that is less reliant on open flows of data between brands and the ad tech they use. But Google has had setbacks in that area too. It recently had to end a plan to kill cookies, the invasive trackers on Chrome browsers, after its alternative called Privacy Sandbox was having trouble gaining traction. Meta, as well, has developed new types of “privacy-enhancing technologies,” which use encryption and aggregates of data to obscure personal information. The more-private tools are meant to keep marketing viable without spilling proprietary information from the brand or the platforms. Still, consensus about privacy-first tech has been hard to come by in the industry.

Just last week, IAB Tech Lab, a part of industry trade group IAB, presented new protocols for how brands should handle consumer data online, defining best practices to label data correctly and denote when it has the consent of consumers to be used. These involve complex technical specifications that the industry still has a hard time coalescing around. There has been a proliferation of data clean rooms, which marketers use to import data from multiple parties to conduct calculations and ad functions without divulging personally identifiable information. Brands have been dinged in the past for failing to get proper permissions for their data and misusing it. The Federal Trade Commission has gone after data brokers known for collecting consumer information. The general climate has made brands skittish.

Brands have used Google’s Confidential Space within Google Cloud for data operations. For instance, AstraZeneca used that product to encrypt data from computerized medical devices, Google said in its announcement. That Confidential Space tech is now part of Google Ads, using a Trusted Execution Environment that can encrypt data before it leaves a marketer’s computer server, according to Google. “That is bringing confidential computing … into the ads ecosystem,” Janardhan said.

Google has said its new system for encryption allows brands to audit that their data was used correctly, generating "attestations"—or “receipts”—that confirm it was properly handled.