Google ad tags gain full visitor IP addresses in server-side GTM in 2027 – PPC Land

From January 11, Google Ads, DV360, SA360 and CM360 tags get unredacted IP addresses while Analytics keeps redaction. Who can opt out, and what consent applies?Google has begun notifying advertisers that, starting January 11, 2027, server-side Google Tag Manager will allow tags “to process standard network signals like IP address to facilitate improvements to ads measurement and personalisation.” Server containers will move from container-wide IP address redaction to tag-level processing, and tags that send data to Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 “will now accept the full IP address,” according to Google. Google Analytics tags will keep redacting it. Google describes the way out of the new behavior as an opt-out, with instructions in a Help Centre article that the notice does not name.Some websites send their tracking data through their own server first, using a Google tool, and that server has been able to hide visitors’ internet addresses from every tag in one go. From January 11, 2027, the tags that feed Google’s four advertising products will get the full address unless the website owner switches the change off, while Google’s analytics tag will still get a redacted one. If you advertise to people in Europe, Google says the right consent must be in place before any of this data is collected, and owners who take no action will be sending more information to Google’s ad systems than they do now.The notice is headed “Updates to network signal processing in server-side tagging.” It carries the Google Ads logo, opens with “Dear customer,” and carries no date. The email circulated publicly today, when Google Ads freelancer Adriaan Dekker posted it on LinkedIn under the hashtag #News. His post summarizes the change and does not link to any Google page.The first paragraph sets out the date and the purpose. “Starting on 11 January 2027, server-side Google Tag Manager (sGTM) will allow tags to process standard network signals like IP address to facilitate improvements to ads measurement and personalisation,” according to Google. The phrase “network signals” is not defined anywhere in the notice. The IP address is the only example given, which leaves open whether other request-level data falls under the same heading.The same paragraph turns straight to compliance. Because the updates involve processing network signals, “proper end-user notices and legally required consents” must be “in place before data collection begins,” according to the email. Advertisers using Google’s advertising products in the European Economic Area “must strictly adhere” to Google’s EU user consent policy, according to the notice, while “Customers in all other applicable regions must ensure that their data collection practices comply with local privacy laws and platform terms.”A second paragraph makes the privacy and performance case. “To safeguard user privacy, this update also integrates privacy-enhancing technologies (PETs) and maintains data integrity through robust spam and invalid traffic filtering, ultimately driving improved campaign performance,” according to Google. No specific technology is named, and no measurement figure, uplift estimate or test result accompanies the claim.Server-side tagging changes where tracking data goes before it reaches a vendor. Instead of a visitor’s browser calling Google, Meta and other platforms directly, it sends requests to a tagging server the website operator runs, usually on a first-party subdomain. Inside the server container, a component Google calls a client receives the incoming HTTP request and translates it into an event data object, and the tags in the container then read from that object, according to Google’s developer documentation. Among the standard fields in that object is ip_override, which carries the user’s IP address in IPv4 or IPv6 format.That architecture is the reason the IP address question sits with the container owner at all. A browser calling Google directly hands over its IP address with every request, because that is how the internet routes traffic. A server container, by contrast, receives the visitor’s address and then decides what to forward. Google’s own documentation on region-specific settings already covers containers in which the IP address has been redacted, and says country and region information can still be used for modeling in that case.The change Google now describes is structural. “Server containers in Google Tag Manager will transition from container-wide IP address redaction to individual tag-level processing,” according to the email. Four rules follow:The split between Google’s advertising tags and its analytics tag follows a line Google drew years ago. Server-side Tag Manager gained the ability to use Google Analytics server-side tags to redact or anonymize IP addresses before transmission in March 2021, according to the Tag Manager release notes. That behavior carries over. What changes is that the four advertising products – Google Ads, the Display & Video 360 programmatic platform, the Search Ads 360 search management platform and the Campaign Manager 360 ad server, home of Floodlight measurement – no longer sit behind a single container-level setting.The third bullet matters for every non-Google vendor in a container. Tags from Meta, TikTok, LinkedIn or any other platform will, in Google’s description, “maintain independent control” over what they accept. The email does not explain whether a third-party tag that currently receives a redacted address will continue to do so after January 11, or whether its behavior will depend on how each template is written.Transformations arrived in server containers on June 7, 2023, according to the Tag Manager release notes, and gained the ability to apply a single rule to entire tag types on August 24, 2023. Google’s documentation describes them as a way to include, exclude or modify event parameters before tags can see them, and lists redacting incoming information by excluding parameters as one use. The transformations page itself does not mention IP addresses. The email names transformations as the mechanism for redacting network signals.The Google Ads server-side conversion tag already works on a send-everything basis. According to Google’s setup guide for that tag, it sends all available conversion data to Google, including any user-provided data, unless transformations are configured and attached to the tag. On the email’s description, the full IP address joins that data from January 11 unless a transformation or the opt-out removes it.Google closes by saying the changes leave container owners in control of network signals in server-side tagging, and directs them to “our Help Centre article for detailed opt-out instructions.” The wording frames the new behavior as the default: containers whose owners do nothing will start passing full IP addresses to the four advertising products on January 11.That default runs the other way from a comparable decision Google made for publishers this year. When AdSense introduced a “Share full IP address” control on June 1, 2026, full IP sharing was off by default, and bid requests carried only a truncated address unless a publisher changed the setting. Under the default, AdSense bid requests carry three octets, so an address such as 93.184.216.34 is sent as 93.184.216.0, and opting in sends the full address to Authorized Buyers, Display & Video 360 and Google Ads at once.As of November 2, the Tag Manager release notes carried no entry on the January change; the most recent item, dated October 12, 2026, covers Tag Manager containers sending data directly to Google measurement products. Google’s server-side developer pages, including those on transformations and common event data, were last updated on July 30, 2026, according to Google’s developer site, and none describes tag-level IP processing. Several practical points therefore remain open. Is the opt-out a single container setting, a per-tag switch, or a transformation the owner has to build? Does opting out restore the current container-wide redaction exactly? And what other “network signals” are covered beyond the IP address?Google’s EU user consent policy applies to end users in the European Economic Area, the United Kingdom and Switzerland, according to the policy page. The email mentions only the EEA. The policy requires businesses using covered Google products to obtain legally valid consent for the use of cookies or other local storage where the law requires it, and for the collection, sharing and use of personal data for personalization of ads. It also requires them to keep records of consent, give users clear instructions for revoking it, and identify each party that may collect, receive or use personal data as a result of the Google product. Google may limit or suspend use of a product, or terminate an agreement, for non-compliance, according to the policy.The policy does not mention IP addresses. Under European data protection law, however, an IP address can itself be personal data; the Court of Justice of the European Union reached that conclusion for dynamic IP addresses in its Breyer judgment of October 19, 2016. The email, for its part, places the duty to have “legally required consents” in place on the customer, not on Google.Google has tied the policy to advertiser accounts before. In March 2022, Google said it would enforce the EU user consent policy on the advertiser side from May 11 of that year, requiring advertisers to obtain consent from users in the EEA and the UK and promising a warning at least seven days before any account suspension.The relationship between the new IP processing and consent mode is not addressed in the email. Google’s server-side consent mode documentation describes what happens to cookies and conversion pings when ad_storage is denied, but says nothing about IP handling. Server containers have also carried consent-denied traffic for some time: from July 28, 2025, Floodlight tags in server-side Tag Manager began transmitting unconsented requests server-to-server to improve modeled conversions, according to the release notes. Whether those requests will carry the full IP address after January 11 is not stated.Google’s reference to PETs echoes language it used with publishers in June. When Google told AdSense publishers it would bring IP-based measurement and personalization to the EEA, the UK and Switzerland on or shortly after August 3, 2026, the notice named on-device processing, Trusted Execution Environments and secure multi-party computation as privacy-enhancing technologies, and said Google would add TCF Feature 3, “Identify devices based on information transmitted automatically,” to its registration. The same three technologies appeared in Google’s policy update of December 18, 2024, which took effect on February 16, 2025 and brought IP addresses into CTV advertising in Display & Video 360. The sGTM email names none of them.The invalid traffic point is more concrete in principle. IP addresses are among the standard inputs ad platforms use to separate human visitors from automated traffic, flagging requests from data centers or from addresses that generate implausible volumes. A truncated address removes some of that resolution. The email does not quantify how much filtering improves when the full address is available, or whether Google applies the full address to filtering only or also to the measurement and personalization uses named in its first paragraph.The sGTM change is the latest in a sequence of 2026 decisions about IP addresses across Google’s advertising stack, and they do not all point the same way.On January 7, 2026, Google announced that the Google Ads API would stop accepting new implementations of session attributes and IP address data for click conversion imports from February 2, 2026. Existing implementations could continue, and Google pointed developers towards its Data Manager API.On May 28, 2026, the Data Manager API began accepting IP addresses for Customer Match, with match-rate gains expected from the third quarter. Display & Video 360 was left out, and Google Ads does not support IP matching for end users in the EEA, the UK or Switzerland. By September, Google Ads had added “User IP address” and “User interaction timestamp” columns to Customer Match file uploads, with IP matching excluded for users in 32 countries, the 30 EEA states plus the UK and Switzerland, and the addresses passed as plain, unhashed strings.On June 1, AdSense publishers gained their full-IP control, off by default. On June 17, AdSense told publishers about IP-based measurement and personalization in Europe from August 3.Set against that sequence, the sGTM change stands out on two counts. It reaches into infrastructure the advertiser runs rather than Google’s own systems, and unlike the AdSense control, which starts blocked, it starts switched on.Google launched server-side tagging in Tag Manager on August 13, 2020, initially only on Google Cloud Platform, with a billing account required. The approach has since become a standard response to browser restrictions and ad blockers, and Google has spent much of 2026 building around it. Release notes from May 1 and June 22, 2026 describe improved conversion attribution in server-side setups by combining server data with parallel browser signals such as cookies. When the Google tag gateway for advertisers moved to general availability on May 8, 2025, Google said advertisers who configured it saw an 11% uplift in signals. Its Google Cloud version reached general availability on June 1, 2026, after a five-month beta, with confidential computing by default promised for tags but not dated.The rest of the tagging stack has also been moving. In May, Google said Google Tag Manager and the Google tag were merging, an opt-in change. On October 8, Google changed how gtm.js snippets handle gtag(‘config’) commands, and on October 12 it gave Tag Manager containers the ability to send data directly to Google measurement products. PPC Land described in May how Google Tag Manager in 2026 is far more complex than most marketers think, with one consent misconfiguration cited as dropping a client’s Google Ads conversions 90% overnight.Server-side setups face their own pressure. By May 31, ad blockers were targeting server-side GTM subdomains by name, with AdGuard’s first-party tracking list holding over 3,400 rules, including 83 for the gtm. pattern and 42 for sgtm. prefixes. In October, PPC Land reported that Safari caps server-set cookies at seven days on cloaked tracking subdomains when the IPv4 addresses of the site and the tracking server share fewer than 16 leading bits.None of this removes the consent obligation. Italian consent platform iubenda argued in a guide covered on October 24 that server-side tracking still needs consent, because moving tags to a server changes where data is processed, not whether permission is needed. Google’s email makes the same point in its own terms. The difference after January 11 is that a container configured to protect IP addresses at the container level will, by default, stop doing so for Google’s four advertising products.For advertisers and agencies, the practical effect depends on how their containers were set up. A business that chose server-side tagging partly to limit what reached Google’s ad systems faces a change to that arrangement on a fixed date, with the opt-out described only in a Help Centre page the email does not name. An advertiser chasing measurement gains may see the same change as the improvement Google describes. In both cases, Google’s email ties the new processing to consent, and the policy it cites reaches users in the UK and Switzerland as well as the EEA.Under Dekker’s post, Shiva Mishra, a performance marketing specialist, called it “a massive shift for sGTM” and wrote that “the compliance piece is going to be the real bottleneck for most brands.”Who: Google, through an email to Google Ads customers, affecting businesses that run server-side Google Tag Manager containers with tags for Google Ads, Display & Video 360, Search Ads 360, Campaign Manager 360 and Google Analytics. The email was posted publicly by Google Ads freelancer Adriaan Dekker.What: Server containers will move from container-wide IP address redaction to tag-level processing. Tags for Google’s four advertising products will accept the full IP address, Google Analytics tags will keep redacting it, third-party tags keep their own controls, and transformations can redact signals before any tag reads them. Google frames the change as an opt-out, with instructions in a Help Centre article the email does not name, and says PETs and spam and invalid traffic filtering are part of the update.When: The change takes effect on January 11, 2027. The email is undated and was posted on LinkedIn today, November 2, 2026.Where: Globally for server-side Tag Manager containers, with Google’s EU user consent policy applying to users in the EEA, the UK and Switzerland, and local privacy laws and platform terms elsewhere.Why: Google says processing standard network signals such as the IP address will improve ads measurement and personalization, and campaign performance. For advertisers, the change shifts a default in infrastructure they control, ties full IP processing to consent obligations they carry, and follows a year in which Google has widened its use of IP addresses across AdSense, Customer Match and Display & Video 360.Every morning, get a curated digest of the last 24 hours in programmatic advertisingsource