Google Account Privacy Settings Guide for South Africa: What Each Toggle Really Shares

A practical map of Google's consumer privacy controls versus the data controls that live inside Google Ads and Analytics - and what South African advertisers should document for POPIA conversations.

Consumer vs Ads Privacy

Personal activity toggles and Ads-account data sharing are two different control surfaces.

What Each Toggle Does

My Activity, My Ad Center and third-party app access explained, including what changes and what doesn't.

Hygiene, Not Compliance

Privacy settings support POPIA conversations but do not replace lawful basis or consent records.

Published: 4 November 20265 min readGoogle Ads

Get a Quote

Professional google ads specialist management for companies south africa image

Add as a preferred source on Google

Hypothetical scenario: a Durban e-commerce brand hands Google Ads and GA4 access to a new agency. A staff member asks the obvious question - now that the agency is 'inside' Google, can it see my personal Gmail and YouTube history? Here is the honest answer, mapped layer by layer.

The Durban Scenario: A New Agency Gets Ads Access and the Team Asks What Else It Can See

A retailer agrees to grant a working agency access to its Google Ads account and GA4 property. Most of the team is relieved. One person is not: their personal Gmail address is also the login for the admin account. They want to know what a third party with Ads visibility can actually read.

The answer separates cleanly. Ads access does not open an inbox. But the same Google login surface hosts consumer privacy toggles, ads-account data sharing and admin visibility - and those are managed in different places by different people. Confusing them creates both privacy anxiety and genuine gaps.

The Privacy Surface Map: Three Layers of Google Data Control

Layer	What it governs	Where it lives	Typical owner
One - consumer activity	Personal search, YouTube, location and ad personalisation data	My Activity, My Ad Center	The individual
Two - ads and analytics governance	Ad account data, audience lists, product linking	Google Ads, GA4, Merchant Center	Marketing lead
Three - admin visibility	Who can see and export ad and audience data	User management and manager accounts	Business owner

Layer One: Consumer Activity Controls - My Activity, Web & App Activity, Location and YouTube History

At myactivity.google.com a user can pause Web & App Activity, YouTube History and Location History, review what has been saved, and set an auto-delete window. This governs personal data tied to that login - not ad account data.

Location History (surfaced as Timeline) affects how Google Maps personalises for that individual. It has only an indirect bearing on local marketing signals, and stopping it does not restrict what an advertiser can target.

What the Ad Personalisation Toggle in My Ad Center Actually Changes (And What It Does Not)

Inside My Ad Center, switching off personalised ads stops Google using that account's activity to target advertising. It does not stop ads appearing, and it does not touch a business's Google Ads account.

Separate consumer privacy from ad performance. Disabling personal ad personalisation does not materially damage a campaign's ROAS - Ads relies on its own signals and consented conversion data, not one employee's YouTube history.

Each 'Sign in with Google' grant carries scopes - read-only calendar access differs sharply from full Gmail or Drive access. Before approving, read the scope list. Full permission audits are a separate discipline; full permission audits sit on layer one and belong to the individual, not the ad account.

On layer two the question is not what Google stores about a person, but who inside the organisation can see customer lists, conversion values and audience segments. Google Ads roles range from read-only to admin, and manager accounts extend that access across properties. Analytics and Search Console links should be deliberate, not leftover from a past agency.

Customer Match is the sharpest edge: uploading a customer list is direct marketing under POPIA section 69, so consent and opt-out evidence must exist. Because Google's data centres sit offshore, section 72 cross-border transfer considerations apply.

Layer Three: Admin Visibility - Why User Management Is a Privacy Decision, Not Just an IT One

Anyone with user-management access can see ad and audience data and can grant it onward. That is an account-governance issue, not an inbox setting. Review the user list quarterly, remove stale agency logins, and prefer manager-account access over shared credentials.

Consent Mode governs how tags behave before a visitor consents, and matters most for EEA and UK audiences. A colleague switching off their personal ad personalisation is unrelated. If you serve European traffic, your conversion tracking and CRO setup needs Consent Mode configured alongside clean server-side tracking - not instead of it.

Privacy settings are hygiene, not compliance. They support a POPIA conversation; they do not create a lawful basis, safeguards or consent records on their own. Treat them as one input, not the answer.

How the Three Layers Map to Owner and Review Cadence

Control	Owner	Cadence
Web & App Activity, My Ad Center	Individual	Annually
Ads roles and product links	Marketing lead	Quarterly
Customer Match and consent records	Marketing lead + counsel	Per upload
User management access	Business owner	Quarterly

Comparing the Controls: What Each Setting Changes, Who It Applies To and What It Leaves Alone

Setting	Changes	Leaves alone
Web & App Activity off	Stops activity being saved to the account	Ad account performance data
Ad personalisation off	Stops activity-based targeting	Ads appearing; campaign delivery
Auto-delete window	Limits retention of personal activity	Ads audience lists; conversion history
Role removal in Ads	Revokes ad and audience visibility	Personal account settings

What a South African Team Should Document for a POPIA Conversation

Keep a simple register: which account holds which role, the lawful basis for each audience list, consent and opt-out evidence for Customer Match, and where conversion data is reported. Pair that with reporting that separates platform-reported conversions from verified outcomes so the data trail matches the story.

Building a Repeatable Privacy Review Into Your Ad Account Onboarding

Fold the review into onboarding rather than running it ad hoc. A workable checklist:

Confirm each individual's consumer privacy settings independently of business access
Assign minimum viable Google Ads roles
Document Customer Match consent per list before upload
Confirm Consent Mode status for any EEA/UK traffic
Record review dates in the account governance note

Sources

Get a Quote

Why Choose Us

Here's what sets us apart

500+ Expert Articles
A content hub covering SEO, paid media, CRO and web design for South African businesses.
200+ Success Stories
Campaigns and builds delivered across retail, services, B2B and ecommerce.
200+ Happy Clients
Businesses that trust Prebo Digital with their digital growth.
4.9 Average Rating
Rated 4.9 out of 5 across verified Google reviews.
24h Response Time
Questions answered within one business day, every time.
Google Premier Partner
Premier Partner status since 2022, placing us in the top 3% of agencies.
Amazon Verified Partner
One of the first verified Amazon Ads partners in South Africa.
Meta Business Partner
Certified to run paid social across Facebook, Instagram and beyond.

What Our Clients Say

Don't just take our word for it

Featured

“Great service and professional team.”

Emelda Schuster

Featured

“Shout out to Leesha @Prebo Digital for great diligence and care handling our Google Ads account. Other agencies take your money and do nothing until you ask. Not Leesha & Prebo Digital. They do what they say and show up with a friendly face. Work to fix issues. Highly recommended.”

Bradley Schmidt

Featured

“Excellent service and support.”

Des Brown

Featured

“Very skilled and knowledgeable in the digital industry and you understand the importance of budgets. Start-ups do not have hundreds of thousands to spend at first and you guys really make the most of every budget provided.”

Cat street

Featured

“Prebo will take your business to the next level. Extremely smart people, great service. Always go above and beyond.”

Mike Gray

Featured

“A dedicated, knowledgeable and enthusiastic team of individuals that are determined to see your brand grow!”

Alastair Waldeck

Featured

“A great agency to work with that always provides excellent service. Very professional and dedicated team.”

Lynelle van Niekerk

Featured

“In the 4 months since we joined hands with Prebo our leads quantity and quality has increased with much more direct impact on our target market. The team is on point and forever in contact with new ideas and solutions to maximize our potential within the set budget cap. Very innovative group of people!”

Rikus Booyens

Featured

“Great service from Prebo Digital team.”

Mothusi Calvin Mogorosi

Featured

“Great Agency - growth-minded, a diverse team of talented individuals with collaborative success at its heart”

David Delaney

Featured

“Outstanding digital marketing services.”

DUNCAN DUNSHAM

Featured

“Industry experts!”

Ricardo Banda

Featured

“Excellent work and professional service.”

Menzi Mohale

Featured

“Expertise, ethos, excellence”

Andrew Johnson

Featured

“Professional and reliable service.”

Ebert Du Plessis

5.0/ 5

15 reviews

Keep reading

Google Ads

Google Account Recovery Options in South Africa: A Restoration Playbook for Locked-Out Marketing Teams

The Pretoria Scenario: Locked Out of the Account That Owns the Campaign Picture a lean in-house marketing team in Pretoria running about R80,000 a month across Search, Shopping and Performance Max. This is an illustrative scenario, not a real client. Their single company Google account is the sole admin on the Google Ads account and the GA4 property, registered years ago against a personal recovery email and a prepaid SIM that has since been recycled. One Monday nobody can sign in. The ad account keeps spending, nobody can pause it, and conversion data feeding bid strategies starts to drift. This playbook is a decision tree for which recovery route fits your lockout, what breaks it in a South African context, and how to confirm spend and attribution survived. Google offers no paid or premium recovery tier and no route with a guaranteed outcome. Every method below helps you prove ownership, not override it. Recovery Is Not One Flow: The Five Routes Google Actually Offers Self-service password recovery via recovery email, recovery phone, or a device already signed in. "Try another way" to switch verification methods when the default prompt fails. The Account Recovery form when no standard method works, asking about recent passwords, creation date, devices and recovery contacts. Recovery options configured in advance, which only help if current. 2SV backup methods: backup codes, backup security key, device prompts or an Authenticator app. Two further routes matter for businesses: Workspace admin-assisted recovery, where a super admin resets a user password; and Google Ads access reinstatement, where an existing ad account admin grants entry even if your Google account is blocked. Which Recovery Route Fits Your Lockout? A Decision Table Lockout scenario Recommended route What breaks it Realistic effort Forgotten password, recovery phone/email active Self-service reset or "Try another way" Recycled prepaid SIM; dead recovery inbox Minutes 2SV prompt on a phone you no longer have Backup codes or backup security key Codes never exported to the team Minutes to hours Former employee held all recovery details Account Recovery form Weak answers on device history and old passwords Days, limited attempts Workspace user locked out, admin available Super admin password reset Admin unknown or also locked out Same day Ads access lost but Google account works Existing Ads admin reinvites you; Ads support You are the only admin Hours Scenario Guide: What Each Method Is Good For and What Breaks It Self-service reset is fastest and least forensic, working when recovery details still belong to the business and failing when they live on a personal handset or ex-staffer's inbox. The Account Recovery form is deepest and most fragile: Google weighs recent passwords, dates, devices and contacts, and repeated misfires weaken your signal. 2SV backups only exist if stored centrally. Workspace admin recovery bypasses the consumer flow but rests on someone holding the super admin role. Ads-side reinstatement is your lifeline when the ad account is fine and only your sign-in is dead. Consumer Account vs Google Workspace: Why the Route Changes Entirely A free Gmail-based account puts the burden on individual recovery details. A Workspace account on a .co.za domain brings governance: a super admin can reset without the user's old device. If the admin account itself is lost, a domain-verification-based Workspace admin recovery applies, which is why domain records must be owned by the business, not a departed web developer. Limiting this risk starts with good setup; our strategy consulting work routinely starts with who actually controls the domain.

Nov 5, 20266 min read

Google Ads

Google Account Security Tips for South Africa: Protecting Ad Spend, Data and Attribution

The Stellenbosch Scenario: How a Hijacked Google Account Drains an Ad Budget Picture a Stellenbosch online store selling outdoor gear. The owner runs Google Ads personally, pays via company EFT, and uses SMS as the second factor because it was the default. A SIM swap happens over a weekend. The attacker resets the login, adds a new admin, raises budgets on a display campaign pointing to an off-site checkout clone, and swaps the Merchant Center payment profile. By Monday, the first evidence shows up in the bank feed, not the inbox. For a business that buys media, a Google login is a spending instrument. It holds the billing card, the Merchant Center payment profile, the analytics pipeline and, through Search Console, the visibility data behind pricing decisions. Treating it as an email account with a password is where most South African risk begins. SMS-based 2FA is the weakest link in a SIM-swap environment. If that is your only factor, you are one port request away from a takeover. Why a Google Account Is a Financial and Data Asset, Not Just an Inbox Three things sit behind that login that owners rarely file under 'security': the ad budget, the payment instrument, and the conversion data the attribution model depends on. A takeover does not just lock you out - it corrupts the data that tells you which channels are profitable. The South African Threat Surface: SIM Swap, Load-Shedding Phishing and .co.za Admin Local threat patterns differ from global ones. SIM-swap fraud is a live operational risk that makes SMS 2FA a liability. Phishing emails imitating 'account suspended' or 'billing failed' notices spike around load-shedding and payment disruptions, when recipients expect payment problems and act quickly. And .co.za domain and hosting admin is often held by a contractor or former employee, so recovery routes lead outside the business entirely. Lock the Front Door: Passkeys, Authenticator Apps and Advanced Protection Move past SMS wherever possible. Passkeys bind access to a device you hold and are phishing-resistant by design. An authenticator app removes the SIM dependency while keeping recovery manageable. The Advanced Protection Program adds hardware-key enforcement for accounts where a takeover would be materially damaging - typically any account with live ad spend or Merchant Center access. Security Factor Comparison: What Each Google 2SV Method Resists Method Resists SIM swap Resists phishing Resists remote attacker SMS code No Weak Partial Phone prompt Partial Weak Partial Authenticator app Yes Moderate Yes Passkey Yes Strong Yes Hardware security key Yes Strong Yes Lock the Recovery Path: Recovery Email, Recovery Phone and the Lockout Trap Recovery is the soft entry point most businesses overlook. Recovery email is frequently a staff member's personal Gmail rather than a business-controlled address. Move it to an address on your own domain, ideally on Workspace and shared with a second accountable person. Otherwise, a departing employee or a stolen personal inbox becomes your reset button. Set the recovery email to a company-domain mailbox on Workspace, not a personal Gmail. Then verify that a second admin can complete recovery independently. Billing Controls for Google Ads and Merchant Center: Separating the Money From the Login Separate the billing instrument from the login. Use a dedicated card for ad spend with a limit, not the operational EFT card. Configure spend alerts and change notifications. For Merchant Center, ensure the payment profile is owned by a finance-controlled account, not the media buyer's personal one.

Nov 4, 20266 min read

Google Ads

Search Advertising Agency South Africa: How to Brief, Hand Over and Hold a Paid-Search Specialist Accountable

Picture a mid-sized Cape Town distributor of industrial components: roughly R1.2m a year of media spend, an in-house marketer wearing six hats, and a generalist agency running Google Ads alongside social, display and email for three years. The distributor is plateaued. Branded queries are expensive, non-brand growth has stalled, and nobody can explain which keywords produced quotes. The marketing lead wants to move search to a specialist without waking up to find the agency holding the admin keys, billing card and historical change log. This is the playbook for that handover. What 'Search Advertising' Actually Covers - and What It Doesn't Search advertising is text advertising on search engines: Google Search campaigns, Shopping and Performance Max where retail applies, and Microsoft Advertising. It excludes social, display, video and influencer. Buyers often conflate 'paid media' with 'search', then brief a scope too broad to be done well. Google's documentation on Search campaigns is the reference point. A specialist should explain match-type strategy, negative keyword architecture and query hygiene - not just campaign naming. If the brief can't test that, it won't separate specialists from generalists. Why South African Buyers Say 'Search Advertising' and Not 'Google Ads' Microsoft Advertising still carries meaningful desktop and enterprise search volume in South Africa, particularly for B2B and professional services, so a Google-only brief leaves inventory untouched. Importing US terminology ('PPC', 'SEM') also signals imported expectations - offshore benchmarks, dollar ROAS targets, advice that ignores local delivery economics. A search advertising agency in South Africa should price in ZAR, apply VAT correctly and recognise that card failures and courier realities shape e-commerce conversion rates. The Engagement Brief That Separates a Specialist From a Generalist Write the brief around craft, not deliverables. A specialist brief asks for a documented match-type transition plan after broad match expansion; a negative keyword architecture with account, campaign and ad-group tiers; an explicit policy on brand protection versus competitor bidding; a decision on Search Partner and Display Network expansion (defaults are almost always on and almost always wrong); and a named owner for Microsoft Advertising. A generalist brief asks for 'monthly reports' and 'campaign optimisation', which cannot be verified. Specialist Search Shop vs Full-Service Agency vs Freelancer: Which Suits Which Buyer Buyer profile Best fit Why In-house team offloading execution, keeping strategy Specialist search shop Craft depth plus a collaborative operating rhythm Mid-market e-commerce or B2B SaaS wanting full search ownership Specialist, with CRO and feed support Search interacts with landing pages and Merchant Center Scaling brand with a generalist, needing search craft Full-service agency with a dedicated search pod Avoids splitting attribution across two vendors What a Search Advertising Agency Should Cost in South Africa: Fee Models and ZAR Ranges (Estimates) Figures are illustrative ranges, not quotes, and exclude VAT. Management fees are subject to VAT, so a R25,000 retainer is R28,750 to the client. Model Typical structure Watch for % of media spend Commonly 10-20% (estimate) Rewards spend, not efficiency Flat retainer R15,000-R60,000/month by complexity (estimate) Scope creep; check account count Hybrid with performance component Base plus bonus on agreed CPA targets Defining 'qualified' precisely Hourly Project or audit work No continuity of learning The First 90 Days: Handover, Access and Guardrails The client must retain admin ownership of Google Ads, Merchant Center, Microsoft Advertising and billing. Grant the agency standard or operating access, not admin. Keep a shared change log and require written approval for structural changes in the first month. Transparent reporting should be established before optimisation begins. Safe Access Handover: A Working Checklist Naming convention: [client]-[channel]-[market]-[owner] e.g. acme-google-za-inhouse acme-msads-za-agency Checklist: [ ] Client owns Google Ads admin + billing [ ] Agency: standard access only [ ] Merchant Center under client login [ ] Microsoft Advertising account client-owned [ ] Conversion actions documented [ ] Change log shared (Google Sheets) [ ] Rollback: revoke agency access, retain history If an agency insists on owning the Google Ads account 'for billing convenience', that is a red flag. Historical data belongs to the client. Explore the framework Prebo Digital applies to Google Ads engagements, including access structures built for clean handovers.

Nov 4, 20266 min read

Google Ads

Google Ads Conversion Tracking: The Technical Audit That Fixes Revenue Gaps

Context: The B2B SaaS Team Whose 'Conversions' Were Mostly Form Starts (Hypothetical Scenario) A subscription SaaS company runs Google Search campaigns for demo requests. Google Ads reports 180 conversions last month, GA4 shows 140 key events, and the CRM logged 60 qualified demos. CPA looks healthy in the platform and alarming in the board deck. Nothing is 'broken'-the tag fires-but the conversion actions have drifted from what the business actually sells. This is a measurement design problem, not a tagging failure. Why Google Ads, GA4, and Your CRM Never Match (By Default) Each system counts a different thing, at a different moment, for a different purpose. Google Ads credits conversions to a click within its attribution model; GA4 models sessions and events; the CRM counts business outcomes. Add consent-driven signal loss, cross-device journeys and differing attribution windows, and a gap is expected. An audit's goal is not to force the numbers identical-it is to understand the gap, bound it, and confirm the platform optimises toward the outcome you care about. Prebo Digital manages conversion tracking audits as a Google Premier Partner (2022-2026), giving direct visibility into how Google's own definitions and diagnostics behave. The Conversion Action Inventory: Your First Audit Artefact Before touching a setting, export every conversion action with its type, counting method, value, attribution window and filter. This table is the audit's backbone. Action Source Primary? Count Value Demo request GA4 import Yes One Static R1,200 Form start GA4 import Yes (flagged) Every None Newsletter Google tag No One Static R50 Here 'form start' is a primary conversion counted on every interaction-so single-page scrolling generates multiple conversions per prospect. Smart Bidding, told form starts are valuable, optimises for cheap form starts rather than qualified demos. Primary vs Secondary Settings: The Silent CPA Distorter Only primary conversion actions feed bidding and appear in the Conversions column; secondary actions are observable but do not influence bidding. Primary should contain only actions of genuine business value-purchase, qualified lead, booked call. Micro-actions (form starts, video views, brochure downloads) belong as secondary. Count Settings: 'One' vs 'Every' and the Value Trap 'One' counts a single conversion per click; 'Every' counts each occurrence. For leads, 'One' almost always matches economic reality. For e-commerce, 'Every' can double-count repeat submissions unless deduplicated on order ID. Pair this with value logic: dynamic order value for purchases, static or value-per-action for leads. Static values must reflect the CRM's average deal value-not an arbitrary round number. Attribution Windows: Google Ads vs GA4 Lookback Differences Google Ads defaults to a 30-day click window and 1-day view (display/video); GA4's reporting defaults differ and are configurable. Two systems with different windows will never reconcile to the rand. Pick windows deliberately, document them, and align them where reporting must be comparable. Instrumenting Values Correctly: Dynamic Order Value vs Static Lead Values For e-commerce, dynamic values from the data layer (revenue with a consistent tax definition) avoid the classic double-count where gross revenue is reported but margin funds bids. For lead businesses, use value-per-action modelling or offline imports tied to CRM stage. Precision on values turns a tROAS target into a profitability target rather than a vanity number.

Nov 3, 20266 min read

Back to Home

Get Google Ads Consultation

Speak with our Google Ads specialists. Free Google Ads account audit (worth R1,500).

GET FREE ADS STRATEGY