An IP address is a unique identifier assigned to a device. Google has always collected and used IP addresses. The change from 3 August 2026, is in relation to new purposes for which they may be used. Google has now started using users’ IP addresses for ad measurement and personalisation across the EEA, UK and Switzerland.
Using IP address information in ad measurement enables the advertiser to distinguish between multiple devices being used once or one device being used multiple times to access and advert or website, providing useful useable data about the impact of the advert or website.
Ad personalisation will show a user adverts based on a profile that is built using their collected data.
This change is a significant shift with implications for businesses, advertisers and any organisation using Google’s ads services and needing to comply with UK GDPR. Under UK GDPR, an IP address is personal data so Google making this change will require organisations to revisit their cookie policies and privacy notices.
B P Collins’ corporate and commercial team explores the changes, as this development is not simply a technical update. Businesses should use this as a reminder to ensure their data practices and consent mechanisms remain compliant.
Fingerprinting and tracking risk – consent requirements
IP address based identification is a form of device fingerprinting (collecting information to uniquely identify a device), which Google itself previously criticised for bypassing user choice. Businesses should consider mapping all tracking technologies used across their websites and identify which practices (such as fingerprinting) may require user consent and how they propose to obtain that consent.
It’s important to note that fingerprinting cannot be “cleared” by users the way cookies can (such as when users reject cookies or clear all site data). The Information Commissioner’s Office is concerned about fingerprinting and stated in December 2024 that ‘Like all advertising technology, it must be lawfully and transparently deployed – and if it is not, the ICO will act.’1
Take a travel website that combines an IP address with device information, which allows a returning visitor to be recognised. The business should assess and clearly explain this tracking practice and be aware of applicable requirements to obtain users’ consent. Failure to do so can have significant regulatory consequences.
Update policies (cookie and privacy policies)
Google’s use of IP addresses for ad measurement and personalisation requires explicit user consent and while this is a change that Google is making, advertisers / site owners are ultimately responsible for obtaining that consent. Businesses relying on Google Ads, AdSense or any Google‑served advertising should ensure their cookie banners/ pop-ups and any cookie policy referencing IP address-based personalisation are compliant with regard to transparency and user control. Customers should be able to accept or reject personalisation before tracking begins. As part of this exercise, businesses should consider reviewing generally how and when user consent is captured.
If a business has a privacy notice, this should also be reviewed and updated to ensure that it reflects Google’s new use of IP addresses.
User controls and consent management
Google has not yet released specific user settings for IP address‑based personalisation. In the meantime, businesses should prepare for more user requests to restrict tracking and in any case, they should review their consent management platforms and processes.
Conduct a GDPR impact assessment
Given the change in how IP addresses will now be used, businesses may want to complete a Data Protection Impact Assessment focused on IP address‑based tracking. It may also be worth carrying out a review of retention policies for IP address‑derived data.
Google’s 2026 update marks a new era of IP address‑driven advertising. Businesses should consider what action they may need to take across consents and privacy notices. Moving forwards, businesses should be aware of the latest guidance issued by the ICO.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
