Account setup

Page Summary

• Initial setup for Ads Data Hub involves structuring your account, configuring Google Cloud projects, provisioning user access, and linking data.

• You can choose between a single-tier account for simple setups or a dual-tier account for complex organizational structures, communicating your choice to your Google representative.

• Configuring Google Cloud requires designating a permanent admin project, enabling the Ads Data Hub API, creating a BigQuery dataset for results, and granting Ads Data Hub write permissions to your Google Cloud project.

• Users need access to both Ads Data Hub for querying and BigQuery for working with results, and you must link data from your Google ad product accounts to make it available for querying.

Key Point: This document will give you the information and context necessary for doing the initial setup of your Ads Data Hub account. This guide assumes that you are the owner of both the Ads Data Hub account and the Google ad platform accounts that you'll be linking. If you're working with an Ads Data Hub vendor, contact the vendor to learn about their integration process.

Ads Data Hub account setup overview

This overview provides a high-level summary of the steps required to set up an Ads Data Hub account:

1. Determine your account structure: Choose between a single-tier account (recommended for most organizations) or a dual-tier account for complex multi-advertiser structures.
2. Configure your Google Cloud project(s): Designate a Google Cloud project as your admin project, enable the Ads Data Hub API (adsdatahub.googleapis.com) and BigQuery API (bigquery.googleapis.com), create a BigQuery dataset, and grant the Ads Data Hub service account (a Google Cloud Per-Product, Per-Project Service Agent, or P4SA) permission to read and write to your dataset(s).
3. Provision user access: Assign user access roles to users in your Ads Data Hub account and configure BigQuery IAM permissions.
4. Link data to your Ads Data Hub account: Connect your Google ad platform accounts by linking accounts in Ads Data Hub.

Structure your Ads Data Hub account

Review the two types of account structures in the following sections. Once you have determined the structure necessary for your organization's needs, communicate this to your Google representative. If you feel that neither accommodates your organization's needs, please consult with your Google representative.

Single-tier account

A single-tier account is an Ads Data Hub account with no sub-accounts. It is the recommended and most common structure for most customers. In this type of account structure, ads data is linked directly to your Ads Data Hub account and data access is solely determined by user access roles.

Dual-tier account

If you need your Ads Data Hub account to mimic a complex organizational structure, you may require a dual-tier account. In this type of account structure, your Ads Data Hub account (referred to as a parent account) contains multiple child accounts. Ads data is linked to the child accounts, and user access can be restricted by assigning users to specific child accounts. The parent-child account relationship is immutable, meaning child accounts cannot be moved to another parent account. Each Ads Data Hub account (and each child account) requires a distinct Google Cloud project designated as the one and only admin project for that Ads Data Hub account. This relationship must be 1-to-1: a single Google Cloud project cannot serve as the admin project for multiple Ads Data Hub accounts.

Your BigQuery datasets must be in the same region as your Ads Data Hub account (US, EU, asia-northeast1, or australia-southeast1). All child accounts inherit their region from the Ads Data Hub parent account.

Important: Users with organizations that span multiple regions may need to create multiple region-specific Ads Data Hub accounts that align with the regions of their ads data and datasets. In order to respect region-specific regulations, an Ads Data Hub account in the US cannot import or export data with a BigQuery dataset in the EU. Child accounts inherit their region from the Ads Data Hub account. This becomes particularly important when working with first party data in Ads Data Hub.

This chart compares the two account structure types:

	Single tier	Dual tier
Typical use cases	Advertisers	Agencies Advertisers with a complex org structure
Example diagram	Show image	Show image
Data linking
Assumes that the Ads Data Hub account owner is also the ad platform account owner.
Google ad platform accounts are linked directly to your Ads Data Hub account.
Child accounts, representing particular advertisers, are created under your Ads Data Hub account.
Google ad platform accounts are associated to your Ads Data Hub child accounts using ads data from IDs. One ad platform ID can be associated to each ads data from ID.
User management
Simple user management. Users are provisioned directly in your Ads Data Hub account. Users with access to this account could access all of the account's linked ads data.
Granular user management. Users that are provisioned directly in your Ads Data Hub account could access all of the ads data linked to all of the child accounts. Users that are provisioned in a given child account could access all of the ads data linked to that child account. They cannot access data from other child accounts.
Cloud requirements
Requires one administrative Google Cloud project for your Ads Data Hub account (1-to-1 relationship).
Requires one administrative Google Cloud project for your Ads Data Hub account, plus one distinct Google Cloud project for each child account (each in a 1-to-1 relationship).
Data can be imported from multiple cloud regions into the same Ads Data Hub account.
Data joining
Data from different ad platform accounts linked to the same account (or same child account) can be joined in the same query. Data across different child accounts cannot be joined in the same query.

Configure your Google Cloud project(s) (manual configuration)

Your Google Cloud project contains your Ads Data Hub results and any first-party data that you use to write first-party joins. Additionally, Google Cloud projects are the underlying foundation that billing and the usage of Google Cloud services are built upon.

Learn more about how Ads Data Hub works with BigQuery

Learn how to create a Google Cloud project

Designate an admin project

For administrative purposes, your Ads Data Hub account is initially created with a designated Google Cloud project, known as the admin project. Once set, this admin project designation cannot be changed. This relationship is strictly 1-to-1: a single Google Cloud project cannot be designated as the admin project for multiple Ads Data Hub accounts (or child accounts).

Separate from the designated admin project, your Ads Data Hub account can read input data from and write output results to BigQuery datasets in any number of Google Cloud projects. Access to those datasets is controlled by granting the Ads Data Hub service account (a Google Cloud Per-Product, Per-Project Service Agent, or P4SA) the appropriate BigQuery permissions on the necessary datasets or Google Cloud projects, which can be updated at any time.

You won't be able to designate a different admin project after making your initial selection. Changing which project is your admin project can break your Ads Data Hub account. As such, it's critical that you designate a permanent Google Cloud project as your admin project when setting up your account. Disabling the Ads Data Hub API from your admin project, or deleting your admin project can cause data loss and create issues in accessing your Ads Data Hub account. Additionally, anticipate any upcoming changes in your organization (such as naming conventions) that may require changing your admin project.

If your admin project is accidentally deleted or if you need help restoring access to your account, contact Ads Data Hub support.

Note: Protect your admin project from accidental deletion by placing it under a lien. Learn more

Sample Google Cloud project configurations

Most users can use a single project (the default setup) that handles all functionality. This includes input and output data. This is the recommended setup, as introducing more projects creates additional complexity and overhead. However, if the single project setup won't meet your needs, work with your Google representative to determine what structure will work best.

The default setup, a single project used for all functionality:

Separate input project, admin project for administration and output:

Enable the API on your admin project

Before creating an Ads Data Hub account, you must enable the Ads Data Hub API (service name: adsdatahub.googleapis.com, "API for executing Ads Data Hub queries") and the BigQuery API (service name: bigquery.googleapis.com, "A data platform for customers to create, manage, share and query data") on your admin project.

The user enabling the APIs should have serviceusage.services.enable permission within the admin project. This could be someone outside of your organization.

Learn how to enable the Ads Data Hub API

Create a BigQuery dataset

BigQuery datasets are where Ads Data Hub results are written, and one of the places where you can further analyze your data.

During account creation, a default dataset is entered into your Ads Data Hub account settings. This dataset is where results are written if you don't specify a dataset during query execution.

The dataset ID consists of your default output project name and dataset name, i.e.: projectName.datasetName.

Note: You can use any dataset in the default output project for your output without the need to reconfigure your Ads Data Hub account, however, the dataset must have write permission for the Ads Data Hub service account (P4SA). If you are planning to use VPC Service Controls, any dataset you use must be within the service perimeter.

Learn how to create datasets in BigQuery

Note: BigQuery requires datasets and query jobs to be co-located (see Cloud BigQuery dataset locations). BigQuery executes compute in the same location where the data resides to optimize query performance and eliminate cross-region network latency.

Both input and output BigQuery datasets must reside in the location matching your Ads Data Hub account region:

• US accounts: Specify the US multi-region.
• EU accounts: Specify the EU multi-region.
• Asia Pacific accounts: Specify asia-northeast1 (Tokyo) or australia-southeast1 (Sydney), matching your account.

Jobs fail if a dataset's location does not match your account region (for example, specifying us-east1 for an account in the US multi-region, or specifying US for an account in asia-northeast1).

The geographic location of ad serving and audience targeting is entirely separate from the BigQuery data location used when running Ads Data Hub queries. Regardless of where your ads are served or where target audiences reside globally, your input and output BigQuery datasets must still reside in the location matching your Ads Data Hub account region.

Permission the Ads Data Hub service account

In order for Ads Data Hub to read data and write results, you must grant the Ads Data Hub service account (P4SA) access to the relevant BigQuery datasets:

• Output datasets: Grant BigQuery Data Editor (roles/bigquery.dataEditor) to allow Ads Data Hub to write query results to your dataset.
• Input datasets (first-party data): Grant BigQuery Data Viewer (roles/bigquery.dataViewer) to allow Ads Data Hub to read your first-party data for joins.

Permissions can be granted at either the dataset level or the project level:

• Dataset level (recommended): In the BigQuery console, select your dataset, click Share > Manage permissions, and add the service account principal.
• Project level: Add the service account principal on the Identity and Access Management (IAM) page in the Google Cloud console.

You can find the Ads Data Hub service account (P4SA) email (principal) under Settings > Details > Service account in your Ads Data Hub account.

Provision user access

Users will need access to both Ads Data Hub and BigQuery. Within Ads Data Hub they'll write and run queries, and within BigQuery they'll work with the results obtained from Ads Data Hub.

Users are added to your Ads Data Hub account under Settings > Users and assigned role-based access (such as Superuser, Analyst, or Read-Only) to write and run queries. In Google Cloud, BigQuery IAM roles (such as roles/bigquery.dataViewer and roles/bigquery.user) control who can view and query the resulting output tables in BigQuery.

Learn more about role-based access in Ads Data Hub Learn more about access control in BigQuery

Link data to your Ads Data Hub account

In order to have ads data available for querying in Ads Data Hub you'll need to link from the account associated with the Google ad product used by your team.

Account linking is a two-step process:

1. Initiate the link request: A link request is initiated from the Google ad platform used by your team (such as Google Ads, Display & Video 360, Campaign Manager 360, or YouTube Reserve).
2. Approve the link request: The link request is approved in your Ads Data Hub account—either in the Ads Data Hub UI under Settings > Linked accounts or programmatically using the CustomerService.BatchApproveAdsDataLinks API.

Learn more about linking accounts in Ads Data Hub