Google to Collect Full IP Addresses in 2027: What Advertisers Must Fix Before January 11

Ad tags are one of the most important tools for ad experts and professionals. Through ad tags, online marketers measure campaign effectiveness using metrics collected through them. Ad tags collect and consolidate metrics such as click-through rate and user location.

While ad specialists collect as much information as possible through ad tags, marketers also observe user privacy to avoid legal challenges. In EU member countries, collecting information without consent is illegal.

Google’s latest update puts ad experts in a precarious position on data collection and privacy.

Full IP Address Collection on Ad Tags

Google recently sent a notice to its customers, “Updates to Network Signal Processing Server-Side Tagging,” that focuses on data collection. The email notice advises, “Starting 11 January 2027, server-side Google Tag Manager (sGTM) will allow tags to process standard network signals like IP address to facilitate improvements to ad measurement and personalization.” Ad Expert Adriaan Dekker shared the update on LinkedIn.

The email notice is essentially an advance notice to its clients’ privacy setup. Collecting full IP addresses and sending them to Google’s Server-Side Tag Manager is a privacy nightmare. This type of data collection must come with user consent, especially for EU users covered by GDPR.

Ironically, the upcoming update claims to “integrate privacy-enhanced technologies” with spam detection and invalid transactions. A full database of spam-related IP addresses can help reduce spam. However, this process exposes customer privacy. Tagging Invalid transactions may have the same effect on users.

Learning More About Server-Side Ad Tagging

Google’s ad tagging services offer ad managers fluid ad management and monitoring. Instead of processing user information on the client side (on the website, through the browser), Google does the heavy data processing. It’s a simple solution for ad managers and website owners.

Unfortunately, the latest update puts a strain on ad managers. Website reconfiguration for consent to IP address collection has to be included before the set timeline.

If there’s good news about the upcoming update, Google’s planned collection of full IP addresses is limited to ad tagging. Analytics will still collect redacted IP Addresses.

Opting Out of Full IP Address Collection

According to Search Engine Journal, web managers and ad experts can opt out and use IP address redaction. Google already has a help page for “IP address redaction for server-side tagging.” It’s a relatively simple process through Transformations, but web admins should check their code to ensure their website is stable after the changes. An unstable website might not only break the website but also expose users to attacks like the PHP2Shell vulnerability, placing government websites and other important institutions at risk, according to the BBC.

Balancing user privacy and data collection is always in flux because of continuing updates. Google’s latest attempt to collect as much data as possible to protect its users is straining ad managers and web admins. Doing nothing means using IP addresses without user consent. Updating consent ensures website stability, but users often leave over privacy concerns. Implementing IP address redaction through Transformation is the best bet for ad managers to ensure privacy while maintaining efficient data collection.