Google just started using your IP address to track you for ads, a technique it once called 'wrong'
From 3 August 2026, Google began using the IP addresses of users in the UK, the European Economic Area and Switzerland to identify their devices for ad targeting and measurement. It is a quiet but significant reversal: the same company once said this kind of tracking was wrong precisely because, unlike a cookie, you cannot clear it. Here is what changed and what you can do.
On 3 August 2026, Google began using the IP address it already collects from users in the UK, the European Economic Area (EEA) and Switzerland to help identify their devices for advertising, personalisation and measurement, a technique closely related to "fingerprinting." It matters because an IP address is not like a cookie: you cannot simply delete it, and it follows you across Google's services. This is a reversal of Google's own past position; in 2019 a senior Google engineer called covert fingerprinting "wrong" for exactly that reason, and the UK's data regulator called Google's 2024 decision to permit fingerprinting for advertisers "irresponsible." The change is now live, and your options for avoiding it are limited but real.
Most privacy changes arrive without a headline, buried in a policy update advertisers see and users do not. This is one of them, and it is worth pulling into the light, because it marks a genuine shift in how one of the world's largest advertising companies identifies you, using a piece of data you cannot easily hide and that it once publicly positioned itself against exploiting this way. Here is what Google changed on 3 August 2026, why it matters more than it sounds, and what, realistically, you can do.
What Google just changed
As of 3 August 2026, Google began using IP addresses to help identify users' devices for advertising purposes across the UK, the European Economic Area and Switzerland. Google notified advertisers of the change on 17 June 2026, and it now applies across its services, including Search and Gmail.
To be precise about what this is: Google already collects your IP address, as every website you visit necessarily does, because it is how data gets routed back to you. What changed is that Google is now using that IP address as an identifying signal for ad targeting, personalisation and measurement, rather than treating it as purely technical plumbing. Combined with other signals, an IP address helps a company recognise the same device or household over time, which is exactly what advertisers want and what privacy law in these regions is meant to constrain.
Why your IP is not like a cookie
The reason this is more than a technicality comes down to a single difference between an IP address and a cookie. When tracking relies on cookies, you have some control: you can clear them, block them, or refuse them, and privacy laws forced the consent banners that at least let you try. An IP address is different. You do not set it, you usually cannot change it on demand, and it is assigned by your internet provider, so you cannot "clear" it the way you empty your browser. Tracking that leans on your IP is therefore much harder to escape, which is precisely what makes it attractive to advertisers and worrying to privacy advocates.
This is closely related to the technique known as fingerprinting: identifying a device from hard-to-change characteristics (IP address, screen size, browser configuration) rather than from a cookie the user can delete. And it is why Google's move is pointed. Back in 2019, when Google was publicly positioning itself against fingerprinting, a senior Chrome engineer argued the practice was "wrong" and "subverts user choice," because it lets sites track people in a way they cannot clear the way they clear their cookies. Using IP addresses to identify devices for ads is a step toward the very thing Google once said should not be done.
Google's quiet reversal
That contrast is not an accident of memory; it is a documented about-face. For years Google's stated policy prohibited advertisers on its platforms from using fingerprinting. In December 2024, Google dropped that prohibition, permitting fingerprinting techniques for advertisers, a decision the UK's Information Commissioner's Office (ICO) publicly called "irresponsible." The regulator's position is that consent should remain mandatory for the kind of cross-service profiling this enables. The August 2026 IP change is that loosened policy arriving in practice, in the very regions with some of the world's strictest privacy rules, which is what makes it striking.
Google's defence is that IP-based identification can be done in privacy-protective ways and is necessary for functions like fraud prevention and frequency capping (not showing you the same ad fifty times). Those uses are real. The dispute is over the line between legitimate technical use of an IP address and using it as a durable advertising identifier, and reasonable people, including a national regulator, think Google has stepped over it.
What you can, and cannot, do
Honestly, your options are narrower than with cookies, but they are not zero.
- Turn down ad personalisation. In your Google account's ad settings you can switch off personalised ads, which limits how your data, including these signals, is used to target you. It does not stop collection entirely, but it is the most direct lever Google offers.
- Mask your IP. Because this technique keys on your IP address, tools that change it help. A VPN replaces your real IP with the server's, and tools with built-in IP protection, Apple's iCloud Private Relay or the Tor Browser, obscure it too. Note the limits: as our explainer on what a VPN actually hides makes clear, masking your IP does nothing about the other signals (your logged-in Google account above all) that also identify you.
- Reduce the logged-in footprint. The more of Google's ecosystem you are signed into as you browse, the richer the profile; using a separate, signed-out browser for general searching cuts some of that linkage.
None of these is a clean off switch, which is rather the point of the criticism: an IP-based identifier is designed to be hard to shake.
Why it matters
This change is a small window onto a bigger trend. As the cookie, the tracking tool users learned to fight, becomes less reliable, the advertising industry is shifting toward identifiers that are harder to see and harder to refuse, and your IP address is near the top of that list. What makes Google's move notable is not that IP tracking is new, but that the company built much of its privacy reputation on opposing exactly this, and has now quietly adopted it in the world's most tightly regulated markets. The lesson for anyone who cares about their privacy is the durable one: watch what the platforms do in the settings advertisers read, not what they say in the banners users see. For more, see the Privacy section, our best VPN guide, and the honest limits of what a VPN actually hides.
Google's IP-for-ads change, at a glance
| What | Using users' IP addresses to identify devices for ad targeting/measurement |
| Where | UK, European Economic Area, Switzerland |
| Live from | 3 August 2026 (advertisers notified 17 June 2026) |
| Why it matters | An IP can't be cleared like a cookie, so it is harder to escape |
| The reversal | Google banned advertiser fingerprinting until Dec 2024; the ICO called lifting it "irresponsible" |
| Your options | Turn off ad personalisation; mask your IP (VPN/Private Relay); browse signed out |
What a VPN actually hides, and the myths that oversell it
A VPN does two genuinely useful things and gets sold as if it does ten. Here is the honest version: what it really hides, why it does not make you anonymous, and the tracking it cannot touch.
A private company's cameras quietly became a de-facto national surveillance grid. Now the backlash has started
Flock Safety's license-plate readers scan billions of cars a month into one searchable database used by thousands of police departments. In 2026 it emerged that federal immigration agents were tapping it without a contract or, critics say, a warrant. Here is how the network works, and why cities are now revolting against it.
The EU's plan to scan your private messages isn't dead. It's heading for a September showdown
'Chat Control,' the EU push to scan private messages for child-abuse material, comes in two versions. A voluntary one survived a July vote; a far-reaching mandatory one now returns for a decisive autumn negotiation. At its heart is a question with no easy answer: can you scan everyone's messages without breaking the encryption that protects them? Here is the honest state of play.