Last updated: July 2026 · 9 min read

What Google announced

In mid-2026 Google notified advertisers of a change to how it treats IP addresses in Europe. Starting on or shortly after 3 August 2026, Google will begin using IP addresses as one input for ad measurement and personalisation in the European Economic Area (EEA), the United Kingdom and Switzerland. (A few reports list the start date as 3 August and others as 4 August; either way, early August 2026.)

The distinction matters. Google already used IP addresses in these regions for the mundane plumbing of the internet — routing your request to a nearby server and showing you an advert in the right language and country. What's new is that the IP address can now feed into who Google thinks you are and whether an ad worked, rather than just where to send the packets.

Google frames the shift around what it calls "privacy-enhancing technologies," or PETs — techniques such as on-device processing, trusted execution environments and secure multi-party computation. The company's argument is that these methods let it draw useful signals from data like IP addresses while limiting how much raw information any single party sees. Whether those safeguards go far enough is exactly what regulators are now debating.

Why your IP address is such a useful tracking signal

Your public IP address is the number the wider internet sees when your device connects to a website or app. On its own it isn't your name, but it's a surprisingly sticky identifier: it reveals your rough location, your internet provider, and — crucially — it tends to stay the same across many of the sites and apps you use from the same network.

That stability is what makes it valuable to advertisers. When third-party cookies are blocked, cleared or simply unavailable, an IP address is one of the few signals that can quietly stitch your activity together across different services. Combine it with other details a browser leaks — screen size, language, fonts, device model — and you get something close to a unique profile. If you've ever wondered what a site can tell about you before you type a single word, our What Websites See About You page walks through the picture in detail.

It's worth keeping perspective, though. An IP address is a coarse signal. Many households and mobile networks share a single public IP among lots of users through carrier-grade NAT, and home IPs often change every few days. So IP-based tracking is powerful at scale but noisy for any single person — which is part of why it's used alongside other signals rather than on its own.

The fingerprinting connection

Using an IP address to recognise a device even after cookies are gone is a building block of what's known as device fingerprinting. Fingerprinting combines many small, individually harmless data points into an identifier that's hard to see and hard to erase.

Google itself once treated this as a line not to cross. Back in 2019, a Chrome engineering director publicly argued that fingerprinting "subverts user choice and is wrong," precisely because users can't clear it the way they can delete cookies. Then in December 2024 Google dropped its prohibition on advertisers using fingerprinting signals, with the change taking effect in February 2025. The 2026 move to use IP addresses for measurement in Europe sits squarely in that shift.

If you want to understand how fingerprinting works and how much of it a browser gives away, we cover it in depth on our browser privacy guide.

What privacy regulators have said

The UK's data-protection regulator, the Information Commissioner's Office (ICO), was blunt about the December 2024 policy reversal, calling it "irresponsible." The regulator's concern is that fingerprinting — including IP-based recognition — is far less transparent and controllable than cookies, so people can't easily see it happening or opt out.

In 2026 the ICO followed up with guidance stressing that businesses using signals like IP addresses to profile people across services over time should still obtain valid consent, and shouldn't treat the technique as a consent-free workaround. Notably, Google has said it is shifting much of the responsibility for lawful use onto advertisers themselves — meaning the businesses buying ads, not just Google, are expected to make sure the required permissions are in place.

None of this makes the practice automatically unlawful. European privacy law generally allows the use of data like IP addresses where there's a proper legal basis — often consent. The debate is about whether the consent people give is genuinely informed, and whether IP-based measurement is transparent enough to meet that bar.

Does this apply to you?

The August 2026 change specifically covers users in the EEA, the UK and Switzerland, because those are the regions where the stricter consent rules apply. If you're elsewhere, Google's use of IP and similar signals for advertising is generally governed by its global policies rather than this particular update.

That said, the underlying trend — IP addresses and fingerprinting quietly filling the gap left by disappearing cookies — is global. So the practical steps below are worth knowing wherever you are.

How to limit IP-based tracking

There's no single switch that makes you invisible, and it's worth being honest about that. But you can meaningfully reduce how easily your IP address is used to profile you by layering a few measures.

1. Mask your IP with a VPN

A VPN replaces the public IP that websites and advertisers see with the address of the VPN server. That directly blunts the IP signal: instead of your real, stable home or mobile IP, trackers see an address shared by many VPN users. Our VPN guide explains how to choose a reputable, no-logs provider — the trust you place in a VPN matters, because you're routing traffic through it.

Two important caveats. First, a VPN hides your IP but does not hide you when you're signed in to a Google account — account-level activity is tied to your login, not your IP. Second, a poorly configured setup can leak your real IP anyway through DNS requests or WebRTC. It's worth confirming your VPN is actually doing its job with our VPN leak test and DNS leak test.

2. Manage your Google ad settings and consent

Within your Google account you can turn off ad personalisation, which limits how much of your activity is used to tailor ads regardless of the IP signal. And when a European consent banner appears, the "reject" or "manage options" choice is meaningful here — declining non-essential tracking is the most direct way to withhold permission for this kind of measurement.

3. Reduce your browser's fingerprint

Because IP is only one input, hardening the rest of your fingerprint helps. Privacy-focused browsers and tracker-blocking extensions reduce the number of signals sites can combine with your IP. Our browser privacy guide covers practical settings that don't break the sites you use every day.

4. Know what you're exposing

You can't manage what you can't see. Checking what your current IP reveals and reviewing what websites see about you gives you a baseline — and makes it obvious when a VPN or privacy setting is actually working versus quietly failing.

Putting it in perspective

It's easy to read a headline like "Google will track your IP address" and picture a spy following your every move. The reality is more mundane and more structural: as cookies fade, the ad industry is leaning on signals that are harder for people to see and control, and IP addresses are one of the most convenient of those signals. Regulators are pushing back on transparency and consent rather than banning the practice outright.

For most people the sensible response isn't panic but a bit of hygiene: understand what your IP gives away, use a trustworthy VPN when you want to break the link, keep your consent choices deliberate, and verify that your tools work. None of it is bulletproof, but together it moves you from "tracked by default" to "tracked only when you choose to be."

Frequently Asked Questions

What exactly is Google changing in August 2026?

Google is starting to use IP addresses for ad measurement and personalisation — not just traffic routing — for users in the EEA, the UK and Switzerland, beginning on or shortly after 3 August 2026. In those regions it previously limited IP use to delivering ads and routing traffic.

Is using my IP address for ads legal?

In Europe it can be, provided there's a valid legal basis — usually consent. The controversy is about whether people's consent is genuinely informed and whether IP-based measurement is transparent enough. Regulators like the UK's ICO have criticised the direction while issuing guidance rather than an outright ban. This article is general information, not legal advice.

Will a VPN stop Google from tracking me?

A VPN hides the IP address that Google and advertisers see, which defeats the specific IP signal. It does not hide activity tied to your signed-in Google account, and it won't help if your setup leaks your real IP. Use a reputable no-logs VPN and confirm it with a leak test.

How is this related to fingerprinting?

An IP address is one of several signals used in device fingerprinting — the practice of recognising a device from many small details when cookies aren't available. Google dropped its ban on advertiser fingerprinting in December 2024 (effective February 2025), and the 2026 IP change extends that trend into Europe.

Does this affect users outside Europe?

This specific announcement targets the EEA, UK and Switzerland because of their stricter consent rules. But IP-based tracking and fingerprinting are used globally, so the steps to limit them are worth taking wherever you live.

How can I see what my IP reveals right now?

Run a quick check with GoIPScan's IP lookup to see your public address, location and provider, and review what websites see about you to understand the full picture a site can build.