Google to Use IP Addresses for Ad Personalization in UK, EEA, and Switzerland

Google has informed advertisers about its plans to utilize IP addresses for ad measurement and personalization in the European Economic Area (EEA), the UK, and Switzerland starting on or shortly after August 3, 2026.

In these regions, IP addresses are considered regulated personal data, making this new practice a significant change in how online services operate.

What’s Changing?

Google already collects IP addresses for traffic routing and ad delivery purposes through various methods such as customer tags, SDKs, HTTP calls, and uploads.

However, starting on August 3, the same IP addresses will be used to identify devices for ad personalization and measurement, triggering consent requirements under UK and EU law.

Google will also adhere to the IAB Europe Transparency and Consent Framework (TCF) for Feature 3, which involves identifying devices based on automatically transmitted information.

Feature 3 under the framework differentiates devices based on the data they automatically send, including IP addresses, and is crucial for obtaining user consent for personalization purposes.

Google emphasizes the use of privacy-enhancing technologies (PETs) like on-device processing and secure multi-party computation to enhance user privacy.

Some personalization features related to IP addresses will be rolled out later, giving users the choice to opt-in on Google’s platforms.

Importance of the Change

While Google has utilized IP signals for ad purposes globally to combat spam and fraud, the use of IP addresses as personal data under GDPR in the EEA, UK, and Switzerland is a significant shift.

Previously, Google opposed fingerprinting, a method of tracking devices when cookies are blocked, but reversed its stance in 2024, leading to criticism from regulatory bodies like the UK’s ICO.

The ICO’s advice on changing consent rules for online advertising emphasizes the need for user consent for tracking that profiles individuals across services, placing IP-based personalization within the consent-required category.

Google’s communication places the responsibility of compliance on advertisers, requiring them to adhere to the EU User Consent Policy and obtain valid consent from users.

User Options

Users will have the option to control IP-based personalization settings later in Google’s rollout. Until then, they can manage cookie preferences and review ad personalization settings in their Google account.

Security teams often miss successful attacks, allowing threats to go undetected. Learn how breach and attack simulation can strengthen your security defenses.

Download the whitepaper for more insights.

Get the whitepaper