In short: We updated the Google advertising clauses in our privacy policies before August 3, 2026, so your document already describes Google’s use of IP addresses. Policies are served dynamically, so the new text reaches your site without any action from you. Consents you’ve already collected stay valid, and your users don’t need to consent again.
From August 3, 2026, Google uses IP addresses for ad measurement and personalization in the European Economic Area (EEA), the United Kingdom (UK), and Switzerland. If you use Google Ad Manager, AdSense, or other Google advertising products, you may have received an email about this from the Google Ad Manager team.
Here’s what changed, what we updated on our side, and what you need to check on yours.
What changed on Google’s side
Google now uses the IP addresses it receives through integrations with your sites and apps to identify users’ devices for ad measurement and personalization. This applies in the EEA, the UK, and Switzerland from August 3, 2026.
Google also updated its registration under the IAB Europe Transparency and Consent Framework (TCF) to declare Feature 3, “Identify devices based on information transmitted automatically”.
The practical difference: Google has always received IP addresses, they’re transmitted automatically with every request, and were used for delivering ads, security, and approximate location. What’s new is that they’re now also used to identify devices for measurement and personalization. Unlike a cookie, this needs no client-side storage and can’t be cleared by the user.
What we updated in your privacy policy
Our legal team amended the Google advertising clauses ahead of Google’s change. Three clauses carry the new text: Google Ad Manager, Google AdSense, and Google Analytics Advertising Reporting Features. We also refreshed the Google Ad Settings link across the wider Google advertising family, since the old address now redirects to My Ad Center.
Two things changed in each clause:
- The clause no longer describes the tracking as a single named cookie. It now refers to cookies and similar identifiers, including information transmitted automatically such as users’ IP addresses, and names device identification as a purpose
- The sentence about user controls now points to “Google Ad Settings” (My Ad Center) and explains that managing advertising cookies there may not prevent a device from being identified on the basis of information transmitted automatically
What you need to do
In most cases, nothing. We serve privacy policies dynamically, so the amended clause text propagates to your embedded document automatically.
Open your published privacy policy and check the Google advertising section. If it doesn’t refer to IP addresses, your document needs a forced update to pick up the new text. Get in touch with our support team and we’ll run that for you.
Separately, review your own disclosures for accuracy. As a user of Google’s ads products, you’re bound by Google’s EU user consent policy, which requires accurate disclosures about data processing and a prominent link explaining how Google processes end user data. The affected clauses already link to Google’s partner policy and their Business Data page, so a policy generated with iubenda covers the prominent link requirement.
One thing to be aware of: if a user turns off advertising cookies in Google Ad Settings, that choice doesn’t stop their device from being identified by IP address. The two work differently, and Google hasn’t released a user-facing control for IP-based personalization yet. Our updated clause text says this plainly, so your policy reflects it. If you write your own disclosures anywhere else, check that they don’t promise more control than the setting actually gives.
FAQ
Does this invalidate the consents you’ve already collected?
No. Your existing consent records stay valid and your users don’t need to consent again.
Two reasons:
- A privacy policy is a transparency document, not a consent mechanism. Amending clause text doesn’t touch consent records
- Under the TCF, a Feature can only be used in service of purposes the user has already been given a choice on. Google adding Feature 3 to its Global Vendor List (GVL) entry doesn’t invalidate existing TC strings
Do I need to update the TCF vendor list?
No. We download the updated GVL every week, so Google’s Feature 3 declaration surfaces in the vendor detail layer of your cookie banner on its own. Google’s entry (vendor ID 755) already declares Feature 3 in the current list.
Does this affect Google Analytics?
No. The August 3 change applies to Google’s advertising products, Ad Manager, AdSense, and the rest of the ads family. GA4’s own handling of IP addresses is unchanged: for users in the EEA, the UK, and Switzerland, Google Analytics uses the IP address at collection to derive coarse location, then discards it before the data is logged. The GA4 clause in your privacy policy hasn’t been amended.
My policy says Google discards IP addresses in one section and uses them to identify devices in another. Which is it?
Both, because they describe different products. The GA4 clause describes what Google Analytics does with IP addresses: for users in the EEA, the UK, and Switzerland it derives coarse location at collection and discards the address before logging. The advertising clauses describe what Google’s ads products do: from August 3, they use IP addresses to identify devices for measurement and personalization. If you run GA4 alongside Google Ad Manager or AdSense, your policy will carry both statements, and both are accurate for the product they refer to.
One of the updated clauses is “Google Analytics Advertising Reporting Features”. Isn’t that Analytics?
It sits in Analytics, but it’s an advertising feature, which is why it’s in scope. Advertising Reporting Features collects additional data for ad targeting and reporting rather than for site analytics, so the same IP-based device identification applies. Standard GA4 without this feature enabled isn’t affected.
I use Google Analytics with Google Ads linked. Does anything change for me?
Not because of the August 3 change specifically, but a separate Google update earlier this year changed how consent signals route between Analytics and Ads. If your accounts are linked and you’re collecting advertising consent, check that the Google Signals clause is active in your privacy policy alongside your GA4 clause.
Keep your policy accurate as Google changes
Google’s advertising products change often, and each change can affect what your privacy policy needs to say. Our Privacy and Cookie Policy Generator keeps the clause text current for you, so your document reflects what these services actually do.
Related documentation: