Customer Match: Using First-Party Data in Ads

Most business owners hear about Customer Match as a way to “show ads to your customer list”. That sounds useful. Then they upload a spreadsheet, see a small matched audience, and wonder why nothing changed. The feature works, but not the way it is usually sold.

Google splits access into two tiers. The tier your account sits in decides what the list can actually do. For a typical Malaysian account spending a few thousand ringgit a month, your customer list becomes a tool for cleaning up spend and teaching the bidding system. It is not a way to build a new audience from scratch.

This guide from IZI Digital Marketing helps you decide whether it is worth setting up, which lists to build first, and how to handle the data under Malaysia’s updated PDPA. It supports our guide to choosing an SEM agency in Malaysia, because how an agency treats your customer data says a lot about how it will treat your account. The short walkthrough below shows the upload screen itself.

PART 1 · DIAGNOSE

What Is Customer Match in Google Ads?

IN BRIEFCustomer Match turns contact details you collected yourself into an audience Google can recognise when those people are signed in. It differs from website remarketing to lost visitors, which relies on cookies and site visits. This relies on data your customers gave you directly.

Google’s About Customer Match page describes it as using your online and offline data to reach and re-engage customers. You upload a file of emails, phone numbers or names with postcodes. Google hashes the details, compares them with signed-in accounts, and builds a segment from the people it can match.

That segment can appear in five places:

• Search and the Shopping tab: mainly for bid changes, observation and exclusions on people already in your records.
• YouTube: for reaching customers again, or finding people who look like your best buyers.
• Gmail: ads at the top of inbox tabs for matched customers.
• Display: personalised ads across the Google Display Network.
• Smart Bidding and optimised targeting: lists are now auto-included as a signal unless you opt out.

The last point matters most and gets mentioned least. You may already be using your lists without knowing it, if someone uploaded a list and your campaigns run on Smart Bidding.

BENCHMARK BRIEFING 1 OF 4

Customer Match Requirements and Rules at a Glance

IN BRIEFTen platform rules decide what your list can do. The three that change plans: targeting needs 90 days of history plus over USD 50,000 lifetime spend, lists need 100 fresh members, and memberships expire after 540 days. Your Smart Bidding strategy choice decides whether lists are used at all.

The full-access row is the one that reshapes most plans. USD 50,000 in lifetime spend is a six-figure ringgit sum, so many Malaysian SME accounts will sit in the basic tier for years. That is not a reason to skip the feature. It is a reason to use it for the jobs the basic tier does well.

PART 2 · DIAGNOSE

Is Customer Match Worth It for a Small Business?

IN BRIEFYes, if you have at least a few hundred real customer contacts and a campaign on conversion-based bidding. Excluding past buyers from acquisition campaigns and signalling your best customers to Smart Bidding both work in the basic tier. Neither works without solid Google Ads conversion tracking underneath.

Most guides treat it as a targeting feature and stop there. For a smaller account, that framing leads to disappointment. The better question is which of four jobs your list can do today.

There is one case where it is not worth the effort yet. If your list has fewer than a few hundred contacts, the matched segment may fall below 100 members and never become active. Collect first, upload later.

BENCHMARK BRIEFING 2 OF 4

Does PDPA Allow You to Upload Customer Lists to Google?

IN BRIEFIt can, if customers were told their data may be shared with service providers for marketing and you have the consent your notice requires. The 2024 PDPA amendments came into force in three phases during 2025, adding breach notification and data protection officer duties. Start with a PDPA-compliant website privacy notice.

Google’s own Customer Match policy asks for the same thing Malaysian law does. Your privacy policy must disclose that you share customer data with third parties who perform services for you, and you must get consent where the law requires it. The riskiest moment is not the upload itself. It is the spreadsheet emailed between staff and agency before the upload.

PART 3 · DESIGN

Which Customer Lists Should You Build First?

IN BRIEFBuild lists around decisions, not around whatever your CRM exports. A past-buyer list for exclusion and a high-value list for bidding signals cover most accounts. Split them by campaign purpose, which is easier inside a clean Google Ads account structure that scales.

One large “all contacts” list is the most common mistake. It mixes buyers, enquiries that went nowhere and newsletter sign-ups. Google cannot tell a loyal customer from a cold lead if you upload them together. Four lists cover most businesses:

1. Past buyers: everyone who paid in the last 12 to 18 months. Use it to exclude from acquisition campaigns.
2. High-value customers: your top spenders or most profitable accounts. Use it as the Smart Bidding signal for what good looks like.
3. Open leads: enquiries that did not close yet. Observe them first; with full access, re-engage them on YouTube or Gmail.
4. Lapsed customers: buyers who have not returned in a year or more. Useful for win-back offers once you qualify for targeting.

If you also run Meta, the same lists can power your Meta retargeting audiences. Keep the definitions identical on both platforms so results can be compared fairly.

BENCHMARK BRIEFING 3 OF 4

What Is a Good Customer Match Rate? A Match-Key Model

IN BRIEFIn this model of a 5,000-contact Klang Valley tuition centre, a raw email-only upload matches 22% of records. Cleaning emails and adding phone numbers in +60 format lifts that to 46%. Data quality matters more than list size, the same lesson behind fixing junk leads from ads.

Why do phone numbers do so well in this model? Malaysians are almost universally online: DOSM’s ICT Use and Access Survey 2025 puts mobile phone use at 99.6% of individuals. Phone numbers collected through WhatsApp are often more current than old email addresses. Google also reminds advertisers that match rate shows data quality, not campaign performance.

PART 4 · DEPLOY

How to Upload a Customer Match List Step by Step

IN BRIEFCheck your notice, clean the file, upload through Audience manager, then apply the list as an exclusion or observation. Allow up to 48 hours before it is usable. Pair the list with sensible ad scheduling and geo-targeting, since Google blocks lists combined into overly narrow audiences.

1. Confirm your privacy notice: it should say customer data may be shared with service providers such as advertising platforms.
2. Export only what you need: email, phone, first and last name, country and postcode. Leave out IC numbers, addresses and purchase notes.
3. Clean the file: trim spaces, lowercase emails, and write phone numbers with the 60 country code, such as +60123456789.
4. Use English column headers: Email, Phone, First Name, Last Name, Country and Zip, exactly as Google expects.
5. Upload in Audience manager: choose Customer list, upload the CSV, tick the policy box and set a membership duration of up to 540 days.
6. Apply the list with purpose: exclusion on acquisition campaigns, observation on the rest, and leave Smart Bidding auto-inclusion on unless a list is irrelevant.
7. Delete the local export: once uploaded, remove the spreadsheet from shared drives and email threads.

Google’s help page notes that plain-text uploads are hashed with SHA256 on your computer before they leave it. That protects the upload, not the spreadsheet sitting in someone’s Downloads folder. Step seven is the one most teams skip.

BENCHMARK BRIEFING 4 OF 4

What Changes After Your Customer Lists Go Live? A 12-Week Model

IN BRIEFIn this 12-week model on a constant RM1,500 weekly spend, excluding past buyers cuts clicks from existing customers from 18% to 6%. Adding a high-value list as a bidding signal then brings cost per new-customer lead from RM68 to RM54. For a spend-level view, see why agencies set minimum ad spend requirements.

Notice that existing-customer clicks never reach zero. Exclusions only work on matched, signed-in people, so some past buyers will always slip through. Judge the change by cost per new-customer lead, and keep a separate brand campaign for customers who search for you by name.

PART 5 · DRIVE

What Should Your Agency Do With Your Customer Data?

IN BRIEFA good agency treats your customer list as your asset, handles it with the least data possible, and can explain what each list does in your account. Write these expectations into your digital marketing RFP so every candidate answers them before you hand over any data.

You don’t need to upload the lists yourself. You do need clear answers to these questions:

• “Which lists are in our account, and what does each one do?” Every list should have a named job: exclusion, observation, bidding signal or targeting.
• “How do you receive our data?” A shared, access-controlled folder or a direct CRM connection is better than an email attachment.
• “Who deletes the export after upload?” Someone should own this, and it should happen the same week.
• “Which access tier is our account in?” An agency promising list targeting on a small account has not checked the USD 50,000 rule.
• “How often are lists refreshed?” Monthly or quarterly is reasonable. A list untouched since last year is quietly shrinking.

For how customer data fits into ongoing search management, see our Google Ads management service.

THE DECISION

So, Should You Use Your First-Party Data in Ads?

If you have a few hundred real customers and run conversion-based bidding, yes. Start with a past-buyer exclusion list and a high-value signal list, clean your phone numbers into +60 format, and refresh monthly. Leave direct targeting until your account qualifies.

Before any of that, make sure your privacy notice covers sharing with service providers. If you are comparing partners to handle this, our guide to choosing an SEM agency Malaysia businesses can trust with their data shows what else to check.

FAQ

Frequently Asked Questions

1. What is the minimum list size for Customer Match?

At least 100 active members. It depends on freshness too: Google needs 100 members added or updated within the last 540 days. Uploads also need at least 100 records, so a list of a few hundred contacts is a safer start.

2. Can a small account use Customer Match?

Yes, but not for targeting. It depends on your lifetime spend. Below USD 50,000, you can still use lists for observation, exclusions and as a Smart Bidding signal, which is where most of the value sits.

3. Is uploading customer emails to Google allowed under PDPA?

It can be, with the right notice. It depends on what you told customers when you collected their details; your notice should cover sharing with service providers for marketing, and you should minimise and protect the file. Take legal advice for your specific case.

4. Why is my customer list match rate low?

Usually because of formatting or old data. It depends on your match keys; uncleaned emails, phone numbers without the 60 country code and outdated contacts all lower matches, while adding phone and name fields raises them.

5. How often should I update my customer list?

Monthly for most businesses. It depends on how fast your customer base changes, but memberships expire after 540 days at most, so a list that is never refreshed slowly shrinks until it stops serving.