Google has begun notifying advertisers that it’s going to start utilizing IP addresses for advert measurement and personalization throughout the European Financial Space (EEA), the UK, and Switzerland on or shortly after August 3, 2026.
IP addresses are acquired by on-line companies in nearly each request and are routinely carried out in lots of elements of the world. However doing so is new within the UK and EU, the place IP addresses are regulated as private information.
what’s altering
Google already receives these IP addresses and routes visitors and serves adverts via buyer tags, SDKs, HTTP calls, and uploads.
What adjustments on August third is function. The identical tackle is used to establish your machine for measurement and advert personalization. It is a use that triggers consent necessities beneath UK and EU legislation.
Google additionally plans to register with the IAB Europe Transparency and Consent Framework (TCF) for Function 3, “Figuring out units primarily based on data routinely transmitted.”
On this framework, characteristic 3 is a approach to distinguish your machine from routinely transmitted information, together with your IP tackle.
This isn’t a consent step in itself. It’s incidental to the aim of personalization and requires your consent moderately than authentic curiosity.
The corporate frames its adjustments round privacy-enhancing expertise (PET), enumerating on-device processing, trusted execution environments, and safe multiparty computing.
Some personalization options will not be obtainable till later this yr or early subsequent yr, at which level Google says it’ll enable customers at its properties to decide on IP-based personalization.
why is it essential
Google has been utilizing IP indicators in promoting elsewhere all over the world for a while to combat spam and fraud, and claimed that IP is already commonplace throughout the promoting ecosystem.
Nevertheless, the EEA, UK and Switzerland are totally different. As a result of IP addresses are private information beneath the GDPR and utilizing IP addresses to establish units is a part of fingerprinting, which tracks units when cookies are blocked or cleared.
Google itself as soon as held this view.
In 2019, then-Chrome engineering director Justin Schuh wrote that fingerprinting is fallacious as a result of it overrides person alternative and customers cannot clear fingerprints in the identical manner they clear cookies.
In December 2024, Google reversed its stance and lifted its ban on fingerprinting advertisers.
The UK Data Commissioner’s Workplace (ICO) later that day condemned the cancellation as “irresponsible”.
The timing is the tough half. On 18 Could 2026, the ICO revealed recommendation to the UK Authorities on adjustments to consent guidelines for internet advertising.
Its really useful strategy is to permit some adverts with out consent solely when primarily based on the context through which they’re seen, moderately than an individual’s exercise over time, and depart consent obligatory if you wish to observe individuals’s profiling throughout companies.
IP-based personalization throughout surfaces is on the consent aspect of that line.
The ICO harassed that nothing has modified but and present guidelines will proceed to use.
Google’s buyer emails shift the burden of compliance onto advertisers, reminding them that they’re nonetheless sure by EU person consent insurance policies and should get hold of legitimate consent from customers in affected areas.
What customers can do
Person alternative for IP-based personalization is not going to be realized till later in Google’s rollout.
Till then, the controls obtainable are the acquainted controls, together with rejecting non-essential cookies and consent prompts, and checking your Google Account’s advert personalization settings at myadcenter.google.com.
The query now being raised by Google’s rollout is whether or not it’s per the ICO’s Could suggestion to require consent for cross-service profiling.
Safety groups doc 54% of profitable assaults and concern a warning on solely 14%. The remainder strikes invisibly via the setting.
Picus’ whitepaper reveals learn how to take a look at your SIEM and EDR guidelines in breach and assault simulations to make sure threats go undetected.
Get the white paper
