If GBP messaging asks for an EIN, have the privacy page ready first

What one person reported

On October 28, 2026, Barry Schwartz at Search Engine Roundtable wrote that Google is asking some businesses for an Employer Identification Number and a privacy policy link when they update parts of a Google Business Profile. The tip came from one commenter, Syed Amir, who said he noticed the request while setting up the message button. Amir said Google asked for an EIN and a privacy policy URL.

The screenshot quoted in the article says: "To help protect you and your customers, a Google partner will review your details before you can receive messages. This takes about three to four working days." Schwartz wrote that this makes more sense to him than asking for a government ID, and he asked readers if they had seen it. The article does not include a comment from Google.

Treat this as a single report. We have not seen the prompt on every client profile, and we are not saying Google rolled this out to all messaging. We are saying the cost of being surprised by it is several working days of delay on a channel that books jobs.

Messaging is a lead channel, not a settings toggle

For HVAC, plumbing, legal, and med spa, the message button on the Business Profile is a way a customer reaches you when they will not place a call. A homeowner with a leaking water heater, a person comparing plumbers, a potential client after hours, a patient asking if you have a Thursday opening. If that button is off, some of those people leave. If the button is on and nobody reads it, they leave anyway, and they are annoyed.

A review that takes three to four working days, if the screenshot is representative, means you cannot flip messaging on the morning a campaign starts and expect messages that afternoon. The review sits between "we turned it on" and "we can receive messages." Weekends and whatever "working days" means on Google's side stretch that further. The article does not define the clock beyond the words in the screenshot.

That is the operating problem. The paperwork has to exist before you want the channel, not after a client asks why messages are dark.

What to have in the folder before you flip the switch

Have the EIN available to the owner or the person who is allowed to manage the profile. Do not paste it into a group text, a shared doc with the whole staff, or an email thread with vendors. The number is tax identification. The profile form is the place it goes, if the form asks, and only the person who is supposed to see it should type it.

Have a privacy policy URL on the business's own website. The page should say who the business is, that you receive messages and calls, what you do with that information, and how a customer reaches you. Digital Domination's privacy policy is ours. It is not a template for a client site, and linking our policy from a client profile would be the wrong business. If you do not have a page, get one written and published on your domain before you start the messaging setup. We are not your lawyer. Have counsel look at the page if your trade has extra rules, which legal and medical practices usually do.

Have a person named for the inbox. A message that sits until the review clears and then sits again because the front desk does not know the tool exists is a missed job with extra steps.

• ▸EIN ready, held by the owner or the profile manager, not forwarded around
• ▸A public privacy policy on the client's domain that covers messages
• ▸The exact URL copied and tested in a browser before you open the messaging setup
• ▸Hours and the phone number already correct on the profile, so the review is not also cleaning up bad data
• ▸A named person who reads messages the day the channel opens
• ▸A note in the account if the prompt appears, including the date and a screenshot with the EIN covered

What we are collecting

We want sightings, not rumors. If a client profile asks for an EIN, a privacy policy URL, or shows the three to four working day review while messaging is being turned on, save a screenshot with the EIN blacked out and the date. Send it to the person who manages the account. One confirmed prompt on a client is more useful than a thread of maybes.

Until we have more than one report, we will not tell every client to expect the gate. We will tell every client who wants messaging on to have the EIN path and the privacy URL ready so a gate, if it shows up, costs days of review and not days of scrambling.

Profile work, including what belongs on the listing and what does not, is the job on Google Business Profile SEO. If you want a person to look at whether messaging is on, who reads it, and whether the privacy URL is real, book a call.

Source

Search Engine Roundtable, Barry Schwartz, Google Business Profiles Asking Businesses For EIN, October 28, 2026. One commenter, one screenshot, no Google comment in the article.