> [!WARNING]
> **Preview:** The Ads Data Hub integration with VPC Service Controls is in [preview](https://cloud.google.com/products/#product-launch-stages).

VPC Service Controls enhance the security of your data by allowing you to define
a service perimeter around Google Cloud resources. This service perimeter
constrains the movement of data across the perimeter boundary, which mitigates
data exfiltration risks.

[Learn more about VPC Service Controls](https://cloud.google.com/vpc-service-controls/docs)

## Prerequisites

This document assumes that you previously:

- Designated an [admin project](https://developers.google.com/ads-data-hub/guides/account-setup#designate_an_admin_project) in your Ads Data Hub account.
- Confirmed that your Ads Data Hub service account ends in `gcp-sa-adsdatahub.iam.gserviceaccount.com`. You can find it under **Settings** \> **Details** \> **Service account** . If it doesn't, or you aren't sure, [contact Ads Data Hub support](https://developers.google.com/ads-data-hub/support/contact-support) to have your account updated before you enable VPC Service Controls.

## Enable VPC Service Controls

If you haven't previously set up VPC Service Controls, refer to the
[VPC Service Controls quickstart](https://cloud.google.com/vpc-service-controls/docs/quickstart).
The quickstart will guide you through the initial setup of VPC Service Controls.
Once you have completed the quickstart, follow the instructions on this page.

### Ads Data Hub-specific setup

1. Navigate to the VPC Service Controls console and select an existing service perimeter.
2. Add the projects that you want to secure within the perimeter. You must include the admin project and any projects you use for input or output data in Ads Data Hub.
3. Add Ads Data Hub and BigQuery as restricted services within the perimeter.
   1. VPC Service Controls recommends [restricting all services](https://cloud.google.com/vpc-service-controls/docs/create-service-perimeters) in the perimeter.

## Limitations

Certain Ads Data Hub features (such as custom audience activation, custom
bidding, and LiveRamp match tables) require certain user data to be exported
outside of the VPC Service Controls perimeter. If Ads Data Hub is added as
a restricted service, it will bypass VPC Service Controls policies for these
features in order to retain their capabilities.

For user-provided data matching, use
[Private Cloud Match](https://developers.google.com/ads-data-hub/guides/user-provided-data-matching),
which runs as a standard Ads Data Hub analysis query inside your
perimeter. Your first-party data must be in a BigQuery project within the
perimeter. Matching through the **Connections** tab isn't supported when VPC
Service Controls is enabled.

All dependent services must be included as allowed services in the same VPC
Service Controls perimeter. For example, since Ads Data Hub relies on
BigQuery, BigQuery must also be added. In general, VPC Service Controls best
practices recommend including all services in the perimeter, that is,
"restricting all services".

Customers with dual-tier Ads Data Hub account structures, such as agencies
with subsidiaries, should have all of their admin projects in the same
perimeter. For simplicity, Ads Data Hub recommends that customers with
dual-tier account structures restrict their admin projects to the same Google
Cloud organization.

> [!NOTE]
> **Note:** To use admin projects in the same Google Cloud organization with different VPC Service Controls perimeters, connect the perimeters with a perimeter bridge. Connecting perimeters across multiple organizations can be done using [ingress and egress rules](https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules).