Privacy

IP-Based Ad Personalization Goes Live in the EEA: What Publishers Must Configure

A hand plugging an ethernet cable into a router port, wine-toned

Google is switching on IP-based ad personalization across the European Economic Area, the United Kingdom and Switzerland starting today, August 3, or shortly after. This is an advertising and publisher-monetization change, not a Google Analytics or GA4 update; no GA4 property is affected. Google notified publishers and advertisers back on June 17, through a mandatory AdSense service email.

What is Google changing about IP addresses in the EEA?

Google already receives the IP addresses of visitors in the EEA, UK and Switzerland for routing and ad delivery. Starting on or shortly after August 3, the same addresses become an active signal: Google will use them to identify devices for ad measurement and personalization, a use it describes as “IP-based measurement and personalization solutions” built from “IP addresses it receives via integrations with your sites and apps.” The change is one of purpose, not new collection, and it is the use that triggers consent requirements under UK and EU law.

IP-Based Ad Personalization Replaces Privacy Sandbox

Google spent six years building an alternative to identifiers like the third-party cookie. Privacy Sandbox formally retired in October 2025, closing out that effort with third-party cookies still active in Chrome and no deprecation timeline on the calendar. What is taking its place in the EEA is not a new privacy-preserving API. It is the IP address itself, promoted from a routing-and-delivery signal into a declared feature inside the IAB Europe Transparency and Consent Framework.

Google is adding TCF Feature 3 to its registration, described verbatim as “Identify devices based on information transmitted automatically.” IP addresses are personal data under GDPR and UK law, so Feature 3 joins the other TCF declarations publishers already manage through their consent management platform. It covers a signal that arrives with the network connection, before any script on the page runs.

See also  California Privacy Overhaul 2026: Mandatory Risk Assessments, Cybersecurity Audits, and the DELETE Act Hit Marketers

The Control Surface Moved to Your CMP

Because the IP address arrives before a script executes, the lever here is not the cookie banner itself. It is the vendor and purpose configuration inside your TCF stack, plus the wording of your EEA privacy notice. Google’s notice tells advertisers they remain “bound by its EU User Consent Policy and must obtain valid consent from users in the affected regions.” Publishers on Google AdSense, Ad Manager or AdMob, and anyone running a third-party CMP, need to confirm Feature 3 is surfaced in the consent prompt and that valid TCF consent is being captured for it. Where a consent flow doesn’t capture it, Google excludes those users from the IP-based measurement and personalization.

The architecture reaches beyond AdSense: Authorized Buyers, Campaign Manager 360, Ad Manager 360, Search Ads 360 and Display & Video 360 sit on the same rails, according to PPC Land’s reporting on the rollout. If your privacy notice currently states that the site does not use IP addresses for advertising purposes, this is the week to rewrite it. The Council of the EU stripped the browser-level consent signal out of its Digital Omnibus position in June, so the per-site banner isn’t being replaced any time soon.

Regulatory History and What to Annotate Today

Google has been here before. In December 2024, the company reversed its policy against browser fingerprinting, and the UK’s Information Commissioner’s Office called that reversal “irresponsible” at the time. In May 2026, per BleepingComputer’s coverage, the ICO advised that consent remain mandatory for cross-service profiling generally.

See also  Google AI Overviews Surge to 2 Billion Users: Search Transformation Reaches Tipping Point

Google frames the IP-based processing as running through privacy-enhancing technologies: on-device processing, Trusted Execution Environments and secure multi-party computation. Those are the safeguards the company describes for this rollout. Meaningful user-facing choice over IP-based personalization specifically isn’t expected until later; for now, the available controls remain the general ones, declining non-essential cookies and adjusting ad personalization settings at myadcenter.google.com.

If IP becomes an active measurement signal, EEA-side conversion counts and audience totals can shift on August 3 with no deploy behind them. Mark today’s date in your ad reporting tools now. That way a discontinuity in next week’s EEA numbers isn’t misdiagnosed as a tagging bug, and having the annotation in place saves a debugging cycle later.

None of this touches Google Analytics or GA4 reporting. It touches how Google’s ad products identify devices in the EEA, UK and Switzerland, using IP addresses that were already flowing to Google for delivery. The work in front of publishers is unglamorous: confirm Feature 3 is live in the CMP, check the wording of the privacy notice, and if EEA ad numbers step next week, the annotation already explains it.