Google to Use UK and EU User IP Addresses for Ad Personalization

Why It Matters

The move makes IP‑based profiling a consent‑required activity in regions where IP addresses are classified as personal data, shifting compliance risk onto advertisers and testing the limits of emerging EU privacy guidance.

Key Takeaways

• Google will use IP addresses for ad personalization in EEA, UK, Switzerland
• Consent required under GDPR for IP‑based device identification
• Google registers Feature 3 in IAB TCF, linking IP to personalization
• Advertisers now must secure user consent before IP‑based targeting
• ICO warns the move may breach upcoming UK consent guidance

Pulse Analysis

The use of IP addresses for ad personalization marks a notable evolution in Google’s data strategy. While IP data has long been collected for routing and fraud detection, repurposing it to identify devices for targeted advertising transforms a technical necessity into a profiling tool. Under the GDPR, an IP address qualifies as personal data, and its use for tracking falls squarely within the definition of fingerprinting—a practice regulators have scrutinized for bypassing cookie‑based consent mechanisms. By registering Feature 3 in the IAB Europe Transparency and Consent Framework, Google signals its intent to align with industry‑wide consent standards, yet the practical rollout still places the onus on advertisers to secure explicit user permission.

In the United Kingdom, the Information Commissioner’s Office has recently issued guidance that tightens consent rules for cross‑service profiling. Google’s announcement arrives just weeks after the ICO warned that the company’s 2024 reversal on fingerprinting was “irresponsible.” By embedding IP‑based personalization within the consent‑required tier, Google effectively pushes the compliance burden downstream. Advertisers must now audit their consent collection flows, update privacy notices, and potentially redesign campaign targeting to avoid non‑compliant data use. Failure to adapt could result in regulatory fines or loss of ad inventory in a market that values user choice.

The broader industry impact could be significant. If Google’s approach proves viable, other ad tech firms may follow suit, normalizing IP‑based profiling across jurisdictions where it was previously avoided. Conversely, heightened scrutiny from data protection authorities could spur the development of alternative privacy‑enhancing technologies, such as on‑device processing or secure multi‑party computation, to replace IP signals. Marketers should monitor the upcoming user‑facing controls slated for later this year, as they will determine whether consent can be obtained at scale without eroding the effectiveness of personalized advertising.