Encrypt user data

  • Encrypting data for the Data Manager API involves setting up the Google Cloud command line interface, creating a key in Cloud KMS, creating a workload identity pool provider, and encrypting the data using a data encryption key (DEK) that is itself encrypted by your Cloud KMS key.

  • The setup process includes installing the gcloud CLI, enabling Cloud KMS in a recommended separate project, and setting the project in your environment.

  • Creating a key requires creating a key ring and then creating the key within that key ring, specifying its purpose and rotation details.

  • Setting up a workload identity pool provider involves creating a workload identity pool and a provider, and then granting the key decrypter role to the WIP provider and potentially to a specific Google service account for event data.

  • Data encryption requires formatting and hashing values, then encrypting the hashed values using a DEK, encoding the encrypted output, and finally setting the encryption_info and encoding fields in the API request.

The Data Manager API supports encrypting data using the following key management services:

Support for some use cases differs by key management service (KMS):

Category Use case Google Cloud KMS AWS KMS
Audiences Send audience members
Events Offline conversions or enhanced conversions for leads
Events Google Ads store sales conversions
Events Google Ads multi-source conversions
Events Google Analytics multi-source events

Set up Google Cloud KMS

Here are the steps to set up Google Cloud KMS resources for encryption.

Set up the Google Cloud command line interface

  1. Install and initialize the Google Cloud command line interface.

  2. To select or create a new Google Cloud project and enable the Cloud Key Management Service, click Enable Cloud KMS.

    Enable Cloud KMS

  3. To set your project in your environment, use the gcloud config set command. To check if the project is already set in your environment, run gcloud config list.

    If no project is set, or you want to use a different project for your key, run gcloud config set:

    gcloud config set project PROJECT_ID

Create a key

For more information, see the Cloud Key Management Service overview.

  1. Create a key ring.

    gcloud kms keyrings create KEY_RING_NAME \
    --location KEY_RING_LOCATION

    For more information, see Create a key ring.

  2. Create a key in the key ring. The ROTATION_PERIOD indicates the interval to rotate the key, and the NEXT_ROTATION_TIME indicates the date and time when the first rotation should occur.

    For example, to rotate the key every 30 days and perform the first rotation in 1 week, set ROTATION_PERIOD to 30d and NEXT_ROTATION_TIME to $(date --utc --date="next week" --iso-8601=seconds).

    gcloud kms keys create KEY_NAME \
    --keyring KEY_RING_NAME \
    --location KEY_RING_LOCATION \
    --purpose "encryption" \