Google's New IP Address Policy for Ad Personalization
Google has begun notifying advertisers that it will start using IP addresses for ad measurement and personalization across the European Economic Area (EEA), the UK, and Switzerland on or shortly after August 3, 2026. This move is significant because IP addresses are considered personal data under UK and EU law, and using them for ad personalization will require user consent.
Google already receives IP addresses to route traffic and deliver ads, but what's changing is the purpose of using these addresses. Previously, IP addresses were used for routing and delivering ads, but now they will be used to identify devices for measurement and ad personalization, which triggers consent requirements under UK and EU law.
Changes to Google's Ad Personalization Policy
Google will register under the IAB Europe Transparency and Consent Framework (TCF) for Feature 3, "Identify devices based on information transmitted automatically." This framework requires user consent for personalization purposes, rather than legitimate interest. Google's email notification to advertisers frames the change around privacy-enhancing technologies, such as on-device processing, trusted execution environments, and secure multi-party computation.
Some personalization features will not arrive until later this year or early next, at which point Google says it will let users on its own properties make a choice about IP-based personalization. This move has raised questions about the timing, as the UK's Information Commissioner's Office (ICO) published advice to the UK government on changing the consent rules for online advertising just a few weeks ago.
Implications of Google's New Policy
The ICO's preferred approach would allow some advertising without consent only where it is based on the context being viewed, not a person's activity over time, and would keep consent mandatory for tracking that profiles people across services. IP-based personalization across surfaces sits on the consent-required side of that line. The ICO has stressed that nothing has changed yet and existing rules still apply.
Google's customer email pushes the compliance burden onto advertisers, reminding them they remain bound by its EU User Consent Policy and must obtain valid consent from users in the affected regions. This means that advertisers will need to ensure they have the necessary consent from users before using IP addresses for ad personalization.
What Users Can Do
The user-facing choice over IP-based personalization will not arrive until later in Google's rollout. Until then, the available controls are the familiar ones: declining non-essential cookies and consent prompts, and reviewing the ad personalization settings under your Google account at myadcenter.google.com. Whether this squares with the ICO's May advice, which would keep consent mandatory for cross-service profiling, is the question Google's rollout now raises.
Google has used IP signals in advertising elsewhere in the world for a while to fight spam and fraud, and maintained that IP is already common across the ads ecosystem. However, the EEA, the UK, and Switzerland are different because an IP address is personal data under GDPR, and using one to identify a device is a building block of fingerprinting, the practice of tracking a device when cookies are blocked or cleared.
- Google will start using IP addresses for ad measurement and personalization in the EU, UK, and Switzerland on or after August 3, 2026.
- This move requires user consent under UK and EU law.
- Google will register under the IAB Europe Transparency and Consent Framework (TCF) for Feature 3, "Identify devices based on information transmitted automatically."
- Some personalization features will not arrive until later this year or early next.
- Google will let users on its own properties make a choice about IP-based personalization.
Google's reversal on fingerprinting in December 2024 was called "irresponsible" by the UK's Information Commissioner's Office (ICO) within a day.
The timing of Google's new policy has raised questions, as the ICO published advice to the UK government on changing the consent rules for online advertising just a few weeks ago. The ICO's preferred approach would allow some advertising without consent only where it is based on the context being viewed, not a person's activity over time, and would keep consent mandatory for tracking that profiles people across services.
Source: BleepingComputer