For ten years, third-party cookies were the spine of digital advertising audiences. Retargeting, lookalikes, behavioural segments — all built on third-party data Google or Meta could see across the open web.
That spine is collapsing. Safari's ITP killed most third-party cookie tracking. Firefox blocks by default. Chrome's deprecation has been delayed but is coming. iOS's privacy framework strips most cross-app tracking. And consent banners are killing what's left in jurisdictions where they're enforced.
Customer Match — Google Ads' first-party audience tool — is the workaround that quietly became the centrepiece. The accounts I've worked on that take Customer Match seriously are growing audience-based campaigns 3-4x faster than the ones still relying on Google's automatic audiences.
Here's how to build a first-party audience strategy in 2026.
The TL;DR: Customer Match lets you upload your CRM lists (emails, phone numbers, addresses, hashed) into Google Ads. Google matches them to logged-in users and creates audiences for targeting, suppression, and lookalikes. Match rates, segmentation quality, and server-side ingestion are the three levers that separate accounts that get value from this and those that don't.
Why Customer Match matters more now than ever
Three things have happened in parallel:
- Third-party cookies are dying across browsers and devices.
- Google Ads automatic audiences (in-market, affinity) are less precise because they rely on signals that are also weakening.
- First-party data is the only data that fully survives privacy changes.
Customer Match takes data you already own — purchase history, signups, bookings — and turns it into a Google Ads audience. Because the matching happens against logged-in Google users, it doesn't depend on cookies at all.
Customer Match isn't a privacy workaround. It's the first-party version of audiences that survives every privacy change Google rolls out.
Three uses every account should have running
1. Suppression
Stop showing acquisition ads to people who already converted. Sounds obvious. Most accounts don't do it.
Build a Customer Match list of:
- Past 90-day purchasers.
- Active subscription holders.
- People who've already booked the service you're running ads for.
Add this list as a negative audience on your acquisition campaigns. Stops wasted spend on people who don't need the ad.
2. Remarketing with sharper segmentation
Generic "all website visitors" remarketing is dead. With Customer Match, you can build segmented lists by behaviour:
- Cart abandoners with email captured at checkout entry.
- High-LTV customers for cross-sell campaigns.
- Lapsed customers (no purchase in 180+ days) for win-back.
- Demo requesters who didn't convert for B2B re-engagement.
Each segment gets a different campaign with different ad copy and different bid strategy. Generic remarketing under-performs segmented Customer Match by typically 30-60% in the accounts I've migrated.
3. Lookalike-style targeting (Optimised Targeting)
Google removed "Similar Audiences" in 2023, but the underlying capability lives in Optimised Targeting. Upload a high-value customer segment, enable Optimised Targeting in your campaign, and Google will find users similar to your seed list.
The quality of the lookalike depends entirely on the quality of the seed. A list of every customer you've ever had is too broad. A list of your top 20% LTV customers from the last 12 months is gold.
Match rate is the metric that matters
Google can only target users it can match to your uploaded data. If you upload 10,000 emails and only 4,000 match to logged-in Google users, you have a 40% match rate.
Most accounts I audit have match rates in the 35-50% range. Best-in-class is 70-80%.
What drives match rate
- Data freshness. Old emails go stale fast. Lists older than 12 months degrade rapidly.
- Hashing accuracy. Customer Match requires SHA-256 hashing of lowercased, trimmed inputs. A trailing space or uppercase character means no match.
- Field coverage. Uploading email-only gives a lower match rate than email + phone + first name + last name + zip combined.
- Audience source. Logged-in app users have higher match rates than newsletter subscribers.
- Consent. Customer Match requires explicit consent for marketing use of the data. Stale or unclear consent leads to lower match acceptance.
How to improve match rate
- Clean the list before upload. Lowercase everything. Trim whitespace. Validate email format. Remove obvious test data.
- Upload multiple identifiers per user. Email + phone gives a higher match rate than either alone.
- Refresh lists weekly. Old data degrades fast. Automate the upload from your CRM.
- Segment by recency. Recent customers match better than long-dormant ones. Build separate lists by recency and use them for different campaigns.
Server-side upload via the Google Ads API
Manual list uploads through the UI are fine for small accounts. For anything serious, server-side uploads via the API are the standard.
The benefits:
- Automated freshness — daily or weekly sync from CRM.
- Multi-field matching — easier to upload email + phone + address in one call.
- Audit trail — your data engineering team controls what's uploaded and when.
A bare-bones flow:
```python
Pseudocode
from google.ads.googleads.client import GoogleAdsClient import hashlib
def hash_field(value): return hashlib.sha256(value.lower().strip().encode()).hexdigest()
def upload_customer_match(customers, user_list_id): client = GoogleAdsClient.load_from_storage() service = client.get_service("OfflineUserDataJobService") # ... build add_user_data_operations with hashed fields # ... submit job, poll for completion ```
Most CRMs (HubSpot, Salesforce, Segment, RudderStack) have either built-in Customer Match destinations or can be wired up via Zapier or Fivetran. Pick the path that requires least ongoing maintenance.
Consent and compliance
Customer Match has real legal requirements. Don't shortcut these.
- You must have a lawful basis for processing the customer data (consent, contract performance, legitimate interest).
- In the EU/EEA, this almost always means consent for marketing use, captured at signup with an explicit opt-in.
- Google's terms require you to have the right to share the data with Google for the purpose of Customer Match.
- Honour deletions. When a customer asks to be removed, remove them from the next Customer Match upload. Don't just stop adding them.
Document your consent flow. Auditors love documentation.
Use case: a multi-brand subscription business
A composite based on patterns I've seen.
A subscription business with three product lines was running Google Ads acquisition campaigns broadly across all three brands' websites. No suppression. No segmented remarketing. Single "all website visitors" remarketing list.
We rebuilt the audience strategy:
- Suppression list 1: anyone with an active subscription (cross-brand). Excluded from all acquisition campaigns.
- Suppression list 2: anyone who cancelled within the last 90 days. Excluded from acquisition (different campaign for win-back).
- Remarketing segments: cart abandoners by brand, demo requesters by brand, content downloaders by topic.
- Lookalike seed: top-quartile LTV customers from the last 12 months, refreshed monthly.
Match rates improved from 41% (baseline) to 67% (after we added phone numbers and address to the upload).
Results over 90 days:
- Acquisition campaign CAC dropped 22% (no more wasted impressions on existing customers).
- Cross-sell campaign revenue grew 38% (segmented remarketing converted dramatically better than generic).
- Win-back campaign brought back 12% of recently-cancelled customers at a 4x ROAS.
- Total Google Ads ROI improved by 31% on the same total budget.
The campaigns didn't get smarter. The audiences did.
Common mistakes
- Uploading lists once and forgetting. Lists go stale. Refresh weekly or daily.
- Email-only uploads. Multi-field uploads have dramatically higher match rates.
- Skipping suppression. Showing acquisition ads to existing customers is the easiest waste to eliminate.
- Generic remarketing. "All website visitors" segment is too broad. Segment by behaviour, recency, value.
- Ignoring match rate. If your match rate is below 50%, fix the data hygiene before doing anything else.
- Treating consent as a checkbox. GDPR and similar laws have teeth. Build the consent flow properly.
Bottom line
In a cookieless world, your CRM list is your most valuable advertising asset. Customer Match is the bridge that turns it into a Google Ads audience.
- Run suppression lists on all acquisition campaigns to stop wasting spend on existing customers.
- Build segmented remarketing audiences by behaviour, recency, and value.
- Use top-LTV segments as lookalike seeds for Optimised Targeting.
- Push match rates above 60% by uploading multi-field data and refreshing weekly.
- Automate via the API so the lists stay fresh without manual work.
Sources and further reading: