A quiet notification landing in advertiser inboxes this month carries significant implications for digital privacy across Europe. Starting on or shortly after August 3, 2026, Google will expand the purpose for which it processes IP addresses in the European Economic Area, the United Kingdom, and Switzerland — moving beyond basic traffic routing into active use for ad measurement and device identification. The shift is technically subtle but legally consequential, and its timing relative to ongoing regulatory debate makes it one of the most closely watched advertising policy changes of the year.
What Is Actually Changing — and Why It Matters
Google already receives IP addresses from users across the globe as a routine part of serving content. Every HTTP request, SDK call, customer tag, and data upload carries this information. That has never been the controversy. The distinction that matters here is one of purpose.
Before August 3, those addresses were used primarily for traffic routing and basic fraud prevention. After that date, the same data points will be applied to identify specific devices for ad personalization and cross-service measurement. Under both the UK GDPR and the EU's General Data Protection Regulation, an IP address qualifies as personal data. Using it to distinguish one device from another — particularly across different properties and services — crosses into territory that requires explicit user consent rather than a legitimate interest basis.
To formalize this within the industry's existing consent infrastructure, Google is registering for Feature 3 under the IAB Europe Transparency and Consent Framework (TCF). Feature 3 governs the practice of "identifying devices based on information transmitted automatically," which includes IP-derived signals. It is not a standalone consent mechanism — it attaches to the underlying personalization purposes that separately require affirmative user agreement.
The Fingerprinting Problem
IP addresses occupy a complicated space in the modern tracking ecosystem. On their own, they are blunt instruments. Combined with other passively transmitted signals — browser type, screen resolution, installed fonts, time zone — they become a powerful fingerprinting vector capable of persistently identifying a device even when cookies are cleared or blocked entirely.
"Fingerprinting subverts user choice and is wrong" — Google's own position, articulated publicly as recently as 2019, before a policy reversal in late 2024.
That reversal, announced in December 2024, dropped Google's longstanding prohibition against advertisers using fingerprinting techniques. The UK's Information Commissioner's Office responded within 24 hours, publicly labeling the decision "irresponsible." The current IP personalization rollout is a downstream consequence of that earlier policy pivot — and the ICO's objections have not softened in the intervening months.
Regulatory Crossfire: The ICO's Competing Guidance
The timing of Google's rollout is particularly sensitive. In May 2026, the ICO published formal advice to the UK government recommending changes to consent rules governing online advertising. The regulator's preferred framework would carve out a narrow, consent-free lane for contextual advertising — ads served based on the content a user is currently viewing — while keeping mandatory consent requirements firmly in place for any tracking that profiles individuals across services or over time.
IP-based device identification across multiple Google properties sits unambiguously on the consent-required side of that proposed boundary. The ICO has been explicit that no rules have changed yet and that current legal obligations remain fully in force. Google's notification to advertisers reinforces this, reminding them of their continued obligations under the EU User Consent Policy and their responsibility to obtain valid consent from users in the affected regions before those signals are processed for personalization.
That burden-shifting language is worth noting. Google is not absorbing the compliance risk — it is delegating it to the advertiser layer, where enforcement exposure is considerably higher for smaller players who may lack robust consent management infrastructure.
Privacy-Enhancing Technologies: Substance or Signal?
Google frames the change within a broader commitment to privacy-enhancing technologies, citing on-device processing, trusted execution environments, and secure multi-party computation as mitigating factors. These are legitimate and meaningful technical controls in the right contexts. Whether they are sufficient to bring IP-based personalization into full compliance with existing EEA and UK law is a question regulators, not Google's engineers, will ultimately answer.
Some of the more sophisticated personalization features tied to this rollout are not expected to arrive until later in 2026 or into early 2027. At that point, Google has indicated it will provide users on its own properties with a choice regarding IP-based personalization — though the specific form that choice will take has not yet been detailed.
What You Should Do
For Advertisers and Marketing Teams
For Individual Users
- Exercise caution when dismissing cookie consent banners — declining non-essential tracking remains the most direct available control.
- Review your ad personalization settings at Google's Ad Center (myadcenter.google.com) and adjust your preferences accordingly.
- Understand that until Google's user-facing IP personalization controls are live, your options are limited to existing consent prompts and account-level settings.
The Broader Signal
What Google's August rollout illustrates is the persistent tension between the commercial imperatives of digital advertising and the legal architecture Europe has constructed around personal data. IP-based personalization is not a novel concept — it has operated in unregulated markets for years. Its arrival in GDPR-governed jurisdictions, at precisely the moment regulators are debating how to modernize consent rules, makes it a genuine test case for how those rules will be enforced in practice.
The answer to that question will shape the compliance posture of every major ad technology platform operating across European markets. Organizations that treat it as a Google problem, rather than an industry-wide reckoning, are taking on risk they may not fully appreciate.
