Which parts of the data path does Assured Workloads actually lock to the EU, and which parts are still on you?
An enterprise brand in Germany runs Performance Max campaigns on Google Ads. Over time, conversions in Google Ads stop matching its internal reports. The cause is Safari’s ITP, privacy-first browsers and ad blockers.
The fix is a first-party setup: Google Tag Gateway and server-side GTM on Google Cloud. Before it goes live, the data protection officer asks:
“How do we ensure the data from our EU users remains in the EU, following GDPR?”
Assured Workloads locks a Google Cloud folder to EU regions and limits who at Google can reach it. Cloud EKM keeps the key to your stored data outside Google.
This page shows what those two controls cover, and where parts one and three begin. The legal side of part two, contracts and transfer agreements, sits outside Google Cloud.
The key sits in a key manager you run, outside Google. Stored data in supported services can only be decrypted when that system answers. It can refuse requests by access reason.
Only stored data. sGTM still handles each event unencrypted in memory, the load balancer isn't supported, and GA4 and ad platforms receive whatever you send them.
Your tracking now depends on the key manager staying up. If it can't be reached, Cloud Run stops starting new instances and logs get dropped.
EU setups rarely break on day one. They break later, when someone new creates a server or a database and leaves the region on the default, which is often the US.
Error text is illustrative. The real message varies by service, but the constraint named is constraints/gcp.resourceLocations.
Pick a question. The boxes that answer it turn yellow in the diagram above.
Each one maps to a specific part of the path. Some are answered by the folder policy, some by your config, and some by a vendor contract that has nothing to do with GCP.
All three pin resources to EU regions. They differ in who at Google can touch the workload and what support tier you need.
| Control package | Data location | Support personnel | Access Justifications | Support tier needed |
|---|---|---|---|---|
| EU Data Boundary | EU regions only | Global support staff | No | Standard, Enhanced or Premium |
| EU Data Boundary and Support | EU regions only | EU personnel located in the EU | No | Enhanced or Premium |
| EU Data Boundary with Access Justifications | EU regions only | EU personnel located in the EU | Yes, a stated reason for Google access | Enhanced or Premium |
Allowed locations under the EU packages include eu-locations, europe-west1, europe-west3, europe-west4 and other EU regions. See sources below.
Checked September 2026. Error messages in “Try to break it” are illustrative.