Notes
Enhanced Conversions for Leads: What It Sends, and When a Clinic Should Not Use It
Enhanced conversions for leads sends hashed contact details, usually an email address or phone number, from your lead form to Google, so a later offline outcome can be matched to the original ad click even when the click identifier was lost. It raises match rates. For a healthcare advertiser it is a larger disclosure than a click-ID-only feed, and that trade has to be decided deliberately.
Key takeaways
- It matches on hashed email or phone, not on the click identifier.
- Hashing hides the value from a casual reader. Matching it back to a person is the entire feature.
- It is genuinely useful when click IDs are hard to keep, for example call-heavy or multi-step funnels.
- Google does not offer a business associate agreement for Google Ads, so the payload decision belongs to your privacy officer.
- Most clinics get the same bidding benefit from a click-ID-only feed with a smaller disclosure.
Contents
Your agency suggests turning on enhanced conversions for leads because the match rate is low. It is a reasonable suggestion in most industries. In a clinic it is a privacy decision wearing a marketing hat.
What are enhanced conversions for leads?
Enhanced conversions for leads is a Google Ads feature that captures contact details entered on your lead form, hashes them in the browser, and sends them with the conversion event. When you later upload an outcome for that lead, Google matches on the hashed value rather than on the click identifier. Google documents it under enhanced conversions for leads.
How the match is made
The email or phone number is hashed with SHA-256 before it leaves the browser, so Google does not receive the plain value. It then compares that hash against its own signed-in users to find the person and the click. That is a real capability, and it is the reason the feature works at all. It is also the reason it is not anonymisation.
Enhanced conversions or a click-ID-only feed
| Enhanced conversions for leads | Click-ID-only offline feed | |
|---|---|---|
| Matches on | Hashed email or phone | The click identifier |
| Requires the click ID stored | No | Yes |
| What leaves your systems | Hashed contact data | An ID, a stage name, a time |
| Works when the ID was lost | Yes | No |
| Disclosure size | Larger | The smallest that still teaches bidding |
| Usually right for | Non-health lead generation | Clinics and regulated services |
The click-ID design is set out in click-ID-only conversion feeds, and the identifier itself in what a GCLID is.
Where it helps
Three situations where enhanced conversions earn their place, in any industry:
- Call-heavy funnels where the click identifier is regularly lost between the website and the phone.
- Multi-step or third-party booking flows that strip URL parameters.
- Accounts where capture has been broken for a long time and fixing every entry point will take months.
In each case the honest framing is that it compensates for a capture problem. Fixing capture is better, and cheaper in the long run, than sending more data to compensate for it.
The healthcare question
Google does not sign a business associate agreement for Google Ads. So the question is not whether hashing is good engineering, it is whether sending a hashed identifier for someone who enquired about a procedure constitutes disclosing identifiable health information to a vendor without an agreement.
I am a marketing consultant and not a lawyer. What I do in practice is put the literal payload in front of the clinic's privacy officer and let them decide, and default to the click-ID route while that conversation happens. The sources and the reasoning are in click-ID-only conversion feeds, and the website-side equivalent in is Google Analytics HIPAA compliant.
What goes wrong
| Cause | What actually happens | Hidden cost | What you see | Risk level |
|---|---|---|---|---|
| Turned on without a privacy review | A larger disclosure nobody approved | A compliance problem created by a marketing setting | A checkbox in the conversion action | High |
| Used instead of fixing capture | The underlying leak stays | Every other report remains unreliable | Match rate up, click IDs still missing | Medium |
| Both it and a click-ID feed set as primary | The same outcome counted twice | Inflated results, wrong bidding | Conversions roughly double | High |
| Field mapping wrong | Hashes never match | Weeks of no improvement | Match rate near zero | Medium |
| Consent mode not configured | Data sent where consent was refused | A different compliance problem | No consent signals in the tag | High |
What it costs
| Route | Typical cost | Time | What it depends on |
|---|---|---|---|
| Enable and map fields yourself | An hour or two | Same day | Tag Manager access |
| Developer work on a custom form | Upwork lists tag manager specialists at $20 to $49 an hour, median $30; senior US consultants at $85 to $175 | Days | Form platform |
| Fix capture instead | A few hours per entry point | Days to weeks | Number of forms and booking tools |
| I review and implement | Audit at $500 per ad account with a 90-day plan, credited toward the first month | Scoped in the audit | Entry points, privacy sign-off |
The audit covers your ad account, the tracking and the path from enquiry to booked patient, and ends with a 90-day plan. It is credited toward the first month if you continue with me.
You work with me directly. There are no account managers and no juniors.
Decide the payload before the feature
Before enabling anything, write down exactly what will leave your systems and show it to whoever signs off on privacy at your practice. If the answer is "hashed contact details for people enquiring about a procedure", that is a decision worth making on purpose. If you want the smaller route built instead, start with the audit, or see HIPAA-compliant conversion tracking.
Frequently asked questions
Is enhanced conversions for leads HIPAA compliant?
There is no business associate agreement for Google Ads, so compliance is not a property of the feature. Whether your specific payload is acceptable is a decision for your privacy officer, with the payload in front of them.
Does hashing make the data anonymous?
No. A hash is a consistent fingerprint, and matching it to a known user is what the feature is for. It protects the value from casual reading, not from matching.
Can I run enhanced conversions and offline imports together?
Yes, and many accounts do. Make only one primary for bidding, or you will count the same outcome twice.
Will it improve my results?
It improves match rates, which improves the data bidding sees. It does not change what you count as success, which matters more.
What if my match rate is still low?
Check the field mapping first, then consent mode, then whether the form platform is sending values at all. Low match rates are usually configuration, not volume.
What should a clinic do instead?
Fix click ID capture at every entry point and send a click-ID-only feed. Same bidding benefit, smaller disclosure.
Who does the work if I hire you?
I do: the review, the implementation and the payload documentation. Nothing is subcontracted or delegated.
How do I verify what is being sent?
Open the network panel on your own form submission and inspect the conversion request. You should be able to name every field in it, and so should your privacy officer.