Google Now Uses IP Addresses for Ads in Europe. Check Your TCF Strings

A change Google announced in June took effect last week: on or shortly after August 3, 2026, Google began using IP addresses for ad measurement and personalization for users in the European Economic Area, the United Kingdom and Switzerland. Google already received those IP addresses to route traffic and deliver ads. What changed is the purpose. Using an IP address to recognize a device for measurement and personalization is exactly the kind of processing that European consent rules care about, so publishers serving European audiences need to make sure their consent setup reflects it.

What Google announced

Google notified publishers on June 17 through a service announcement, and the change was widely covered, including by BleepingComputer and PPC Land. The key points:

• Scope. The change covers the EEA, the UK and Switzerland, and applies across Google's ad products, including AdSense, Ad Manager and Google's buying platforms.
• Method. Google says it processes the IP data using privacy-enhancing technologies: on-device processing, trusted execution environments and secure multi-party computation.
• TCF registration. Google is adding Feature 3, "Identify devices based on information transmitted automatically," to its registration in IAB Europe's Transparency and Consent Framework.
• Publisher responsibility. Google's EU User Consent Policy still applies. Publishers must give accurate disclosures and obtain legally valid consent where required.

Why this is a publisher issue, not just a Google issue

Under GDPR and the UK's equivalent rules, an IP address is personal data. When it is used to identify a device for advertising, the consent collected on your site has to cover that use. Google can register the feature, but it is your consent management platform that shows the disclosure to users and your TC string that carries the result to Google and every other vendor.

If the disclosure is missing or the string is wrong, the risk runs in two directions. Regulators may view the processing as undisclosed. And Google's systems may treat the request as not covered by the consent it needs, which can limit personalized demand on that impression. Either way, the fix sits in your consent configuration.

The UK's Information Commissioner's Office has been critical of IP-based tracking in advertising. It called Google's December 2024 policy change allowing fingerprinting techniques "irresponsible," which is a good reason to treat disclosure here carefully rather than minimally.

A checklist for publishers with European traffic

1. Update your CMP's vendor list. Make sure your consent management platform is using a current version of the Global Vendor List so Google's updated registration, including Feature 3, is shown to users.
2. Inspect real TC strings. Do not assume. Pull consent strings from live traffic in each market and decode them to confirm Google's vendor entry and the relevant disclosures are present.
3. Review your privacy notice. Your policy should explain that advertising partners may use automatically transmitted information such as IP addresses to identify devices for measurement and personalization, and link to Google's own explanation of how it uses this data.
4. Test consent paths. Check what happens when a user accepts, rejects or customizes consent. Confirm that ad requests after a rejection do not carry signals that imply consent.
5. Check every market. The change covers the UK and Switzerland as well as the EEA. Geo rules in your CMP should show the right experience in all three.
6. Watch revenue by consent state. Break out European revenue by consented versus non-consented traffic for a few weeks. Sudden drops in consented CPMs can point to a string problem.

Why travel and cross-border publishers should look first

Travel sites, international news brands and any publisher with a large share of European visitors carry the most exposure. Travel audiences are also highly mobile: the same user may browse from a hotel network, a mobile carrier and a home connection in a single week. Publishers with audiences like that tend to depend heavily on consented, measurable European traffic, and they are the ones most likely to see revenue move if their disclosures are out of date. If Europe is a meaningful share of your revenue, this deserves a slot on this month's ad ops calendar.

What this says about where addressability is going

This change fits a broader pattern. With third-party cookies unreliable across browsers, platforms are leaning on other signals that reach them automatically: IP addresses, device information and logged-in data. That makes the consent layer more important, not less. Your consent string increasingly governs whether any of those signals can be used, and by whom.

For publishers, the takeaway is to treat the CMP as core ad infrastructure rather than a legal widget. It deserves the same monitoring, testing and version control you apply to your wrapper. A broken consent string can quietly remove demand from a large share of your European impressions, and nobody will send you an alert when it happens.

Keep an eye on user controls

Google has indicated that user-facing controls over IP-based personalization will arrive later in the rollout. When they do, expect some users to opt out, and expect your consent-state reporting to be the first place you see it. Having that reporting in place now means you will be able to separate a policy-driven change from a technical fault.

If your team manages European inventory without a dedicated consent specialist, it is worth having someone audit the full path, from CMP to TC string to bid request. HBDR's ad ops team checks these signals as part of routine account management for publishers with international audiences.