Recently, it was announced that Google will begin using IP addresses from UK and EU users for ad personalization by August 3, 2026. This change has significant implications for online advertising in the region, particularly in light of upcoming regulations on consent
Google already collects IP addresses to route traffic and deliver ads through a variety of methods, such as customer tags, SDKs, HTTP calls, and uploads. However, starting from August 3, Google will also use these IP addresses for ad measurement and personalization purposes, which is a regulated activity under UK and EU law
The change has sparked concerns about user privacy, especially in light of the General Data Protection Regulation (GDPR) that classifies an IP address as personal data. Using IP signals to identify devices can facilitate fingerprinting, a tracking mechanism that can bypass cookie blockers or expired cookies
This has also brought up memories of Google’s stance on fingerprinting in 2019. At that time, Chrome’s engineering director Justin Schuh argued that using IP signals for device identification is “wrong” because it cannot be cleared like cookies
However, just five years later, in December 2024, Google changed its stance and allowed advertisers to use IP signals for device fingerprinting. This shift has been met with criticism, particularly from the UK’s Information Commissioner’s Office (ICO), which described it as “irresponsible”
The ICO’s recent advice to the UK government on changing consent rules for online advertising suggests that strict guidelines are still in place. Under its preferred approach, consent would be mandatory for tracking activities that profile people across services, while allowing some limited context-based advertising without consent
Google claims this new development is an effort to enhance user choice and control over their data through the use of privacy-enhancing technologies (PETs), such as on-device processing, trusted execution environments, and secure multi-party computation. Advertisers are being notified about the upcoming change, but existing rules still apply
What this means for users is still unclear until they will be able to make a choice over IP-based personalization. For now, basic controls remain available: declining non-essential cookies and consent prompts, as well as reviewing ad personalization settings under Google accounts at myadcenter.google.com
The alignment of these controls with the ICO’s guidelines on cross-service profiling is uncertain, which raises more questions about how user data will be handled in this new setup. As the rollout progresses, it remains to be seen how effectively Google balances privacy concerns and regulatory requirements
Why it matters:
This change underscores the ongoing debate around online advertising, user consent, and data protection. The use of IP addresses for ad personalization has sparked controversy due to its potential for fingerprinting and tracking activities that are not easily cleared or blocked by users
The upcoming regulations on consent in the UK and EU will undoubtedly impact Google’s practices, but it remains to be seen how these guidelines will play out. As the landscape continues to evolve, one thing is clear: ensuring user data privacy while navigating regulatory requirements will be an ongoing challenge for Google and other major players in online advertising
Source: Bleeping Computer
