On or shortly after August 3, 2026, Google will begin using IP addresses it already receives to identify devices for ad measurement and personalization across the European Economic Area, the UK and Switzerland, the company has notified advertisers.
What Google will change on August 3, 2026
Google says the technical inputs—IP addresses obtained through customer tags, SDKs, HTTP calls and uploads—are already flowing to its systems to route traffic and deliver ads. What changes on or shortly after August 3, 2026, is the stated purpose: the same IP addresses will be used to identify devices for measurement and ad personalization.
Google has framed this shift around "privacy‑enhancing technologies, or PETs," and lists specific approaches including on‑device processing, trusted execution environments and secure multi‑party computation. The company also told advertisers it will register under the IAB Europe Transparency and Consent Framework (TCF) for Feature 3 — the Framework label for "Identify devices based on information transmitted automatically."
The rollout is staged: some personalization features will not arrive until later in 2026 or early 2027, and Google says that when those features appear it "will let users on its own properties make a choice about IP‑based personalization." In the meantime, Google’s customer email reminded advertisers that they remain bound by its EU User Consent Policy and "must obtain valid consent from users in the affected regions."
Why the switch is legally sensitive in the EEA, the UK and Switzerland
The difference between other markets and the EEA, the UK and Switzerland is legal: an IP address is regulated personal data under the GDPR regime that applies in those territories. Using an IP address to identify a device is a building block of fingerprinting—the practice of tracking a device when cookies are blocked or cleared—which regulators have treated as especially sensitive because, as one former Google engineer put it in 2019, fingerprinting "subverts user choice and is wrong, because users cannot clear it the way they can clear cookies."
Google reversed its earlier prohibition on fingerprinting in December 2024; the UK’s Information Commissioner’s Office (ICO) called that reversal "irresponsible" within a day. That regulatory context matters now: on May 18, 2026, the ICO published advice to the UK government recommending that some advertising be allowed without consent only where it is based on the context being viewed (not a person's activity over time), and that consent remain mandatory for tracking that profiles people across services. IP‑based personalization across surfaces sits on the consent‑required side of that line, the ICO’s advice implies. The ICO has stressed that "nothing has changed yet and existing rules still apply."
How the IAB Europe TCF’s Feature 3 fits into the change
Google’s registration under IAB Europe’s Transparency and Consent Framework is specifically for Feature 3, which the Framework defines as the method for distinguishing a device from the data it sends automatically — "including the IP address." The Framework language makes clear that Feature 3 itself is not a standalone consent step: it "attaches to the personalization purposes, which require user consent rather than legitimate interest."
In practical terms, the TCF registration signals that Google intends to treat IP‑based device identification as a recognized method inside the consent architecture used across much of the European ad ecosystem, while preserving the legal distinction that personalization purposes must be supported by user consent.
Controls available to users, and the rollout timetable
The immediate user‑facing choice over IP‑based personalization will not be available until later in Google's staged rollout. Until that point, the controls users can exercise are the familiar ones: decline non‑essential cookies and consent prompts presented by sites, and review ad personalization settings under a Google account at myadcenter.google.com.
Google’s timeline therefore creates a gap: the company is changing the internal purpose for data it already collects now, while the explicit user choice tied to those purposes is promised only when additional personalization features are deployed later this year or early next.
What this means for advertisers, the ICO, and users
- Advertisers: Google’s notification explicitly pushes the compliance burden onto advertisers by reminding them they "must obtain valid consent from users in the affected regions" and remain bound by Google’s EU User Consent Policy. Advertisers will need to decide how to collect and document consent if they plan to rely on IP‑based personalization.
- The ICO and policymakers: The May 18, 2026 ICO advice set a regulatory preference that preserves consent where cross‑service profiling is involved. The ICO has reiterated that existing rules remain in force, leaving regulators positioned to evaluate whether Google’s PETs framing and TCF registration are sufficient under those rules.
- Users: Until Google deploys the promised on‑property choice, users retain the existing options (declining cookies, denying consent prompts, or adjusting settings at myadcenter.google.com), but will not yet see a dedicated control for IP‑based personalization across Google’s surfaces.
Google has changed the declared purpose of data it already receives. That narrow factual move—routing and ad delivery versus device identification for personalization—carries broader legal meaning in jurisdictions that treat IP addresses as personal data. The immediate milestones to watch are the August 3, 2026 change in purpose, the staged arrival of personalization features later this year or next when Google promises an on‑property choice, and whether regulators treat the IAB TCF registration plus PETs claims as meeting the consent‑and‑privacy standard the ICO outlined on May 18, 2026.
Source: BleepingComputer — Google to use UK and EU user IP addresses for ad personalization
