From Jan 11, 2027, server-side GTM sends full visitor IPs to Google Ads tags by default. Here's what changes, who's affected and how to decide.
Do you know what your server-side tag container does with your visitors' IP addresses? If you set it up a couple of years ago and haven't looked since, there's a date you should put in the calendar: January 11, 2027.
According to PPC Land, Google has emailed advertisers to say server-side Google Tag Manager will start passing the full IP address to its ad products. And the new behaviour is the default.
That means if you do nothing, your container changes how it handles personal-looking data on that day.
This post explains what's changing, what Google hasn't said yet, and how to make a sensible decision before the date. No panic needed, but no waiting either.
Key Takeaways
- From January 11, 2027, server-side GTM decides IP handling tag by tag instead of for the whole container, according to PPC Land's report of Google's email.
- Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 tags will accept the full IP address, and it's the default if you take no action.
- Google Analytics tags keep redacting IP addresses, so your analytics setup behaves differently from your ad tags.
- Google says proper notices and legally required consents must be in place before data collection starts, including its EU user consent policy for EEA advertisers.
- Google hasn't yet named the opt-out article or explained exactly how it works, so audit your containers now and watch for the instructions.
What Is Actually Changing?
Until now, server-side tagging has handled IP addresses in a fairly blunt way. Google's own launch post for server-side tagging says it automatically anonymises users' IP addresses before data is shared with Google's reporting tools, and lets businesses remove them entirely if they want more control.
The new email, reported by PPC Land, is titled "Updates to network signal processing in server-side tagging." It describes a move from container-wide redaction to a per-tag decision.
Here's the split as reported:
- Full IP address: Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 tags will "accept the full IP address."
- Still redacted: Google Analytics tags keep redacting IP addresses.
- Up to the vendor: third-party tags such as Meta, TikTok or LinkedIn keep their own control over which signals they accept.
- Your control: transformations can redact signals before any tag reads them.
One detail matters most. Google describes this as the default. Owners who take no action will send full IP addresses to those four ad products from January 11.
Why Would Google Want Full IP Addresses?
Google's stated reason is performance. The email, as reported, says the update uses privacy-enhancing technologies plus spam and invalid traffic filtering, and that it will improve campaign performance.
It doesn't name the technology or give any metrics. That's worth noticing.
The practical logic is easy to guess. An IP address helps an ad platform filter bot traffic and match signals more reliably. But a guess isn't a fact, and Google hasn't published numbers on how much this helps. Treat the performance claim as a claim until you see data from your own account.
Why the Consent Question Comes First
Here's where this stops being a tag setting and becomes a legal question. Google's email says proper end-user notices and legally required consents must be in place before data collection begins.
For advertisers with visitors in the European Economic Area, the UK or Switzerland, Google's EU user consent policy already applies. It requires consent for using cookies or other local storage where the law demands it, and for collecting, sharing and using personal data to personalise ads.
The same policy says you must keep records of consent, give clear instructions for withdrawing it, and name each party that may collect or use the data. Break the rules and Google may limit or suspend your use of the product.
PPC Land points out the policy doesn't mention IP addresses at all, and notes that the EU's Court of Justice ruled in 2016 that dynamic IP addresses can be personal data. I'm not a lawyer, and this isn't legal advice. But if you sell to European buyers, ask your privacy adviser whether your current notices cover this before January 11.
What Google Hasn't Told Us Yet
This is a new announcement, so there are gaps. PPC Land lists several open questions, and they're the right ones to ask:
- Is the opt-out a container setting, a per-tag switch or a transformation you build yourself?
- Does opting out fully restore today's redaction?
- Which other "network signals" does the change cover? The email gives IP address as its only example.
- How does it interact with consent mode and requests where consent was denied?
- What will third-party tags in the same container do?
As of November 2, the Tag Manager release notes had no entry on the change, according to the same report. The email itself is undated and was shared on LinkedIn by a Google Ads freelancer, so confirm the details in your own Google account notices before you act on any of this.
A 5-Step Audit You Can Do This Month
You don't need Google's answers to start. Most of the work is knowing what you've got.
- List your server containers. Note which domains and which sites feed them. Agencies and past developers often set these up, so ask around.
- List every tag in each container. Mark the ones for Google Ads, DV360, SA360 and CM360. Those are the tags that change.
- Check today's IP settings. Write down whether the container redacts IPs and whether any transformations already strip them.
- Review your consent setup. Check that your banner, privacy policy and consent records match what the container really sends, especially for EEA, UK and Swiss visitors.
- Decide per tag. For each ad tag, choose whether you want full IPs or redaction, then watch for Google's opt-out steps.
If you use a web analytics setup partner or a technical SEO team who also manages your tags, ask them to run this audit and send you the list. It should take hours, not weeks.
The Change in Action: A Quick Example
Picture a business with one server container. It has a GA4 tag, a Google Ads conversion tag and a Meta tag. Today the container redacts IP addresses across the board.
On January 11, going by the reported changes, the GA4 tag keeps redacting. The Google Ads conversion tag now accepts the full IP. The Meta tag follows Meta's own rules, and the email doesn't say whether its current behaviour continues.
Nothing broke. Nobody was told. But the data leaving your server just changed for one of three tags.
That's why the audit matters. The risk isn't the setting. It's not knowing the setting changed.
When You Might Not Care
Not every business needs to worry. If you run only client-side tags and have no server container, this change doesn't touch you.
If your audience is a local one outside the EEA, UK and Switzerland, your main duty is following your local privacy laws and the platform terms. That's still a duty, but a lighter one.
And if you'd welcome better bot filtering in Google Ads, full IPs might be a fair trade once your consent setup is solid. The point isn't to refuse the change. It's to choose it on purpose.
Google also points to the performance upside of server-side tagging in general. Its launch post cites Square reporting 46% more reported conversions and a Danish grocer cutting page load time by 7%. Those results come from the 2021 launch and don't measure this IP change, so don't expect the same from it.
FAQs
When does the server-side GTM IP address change start?
January 11, 2027, according to PPC Land's report of Google's email. From that date, Google Ads, DV360, SA360 and CM360 tags in server-side containers will accept the full IP address by default. Check your own Google notices to confirm the date applies to your account.
Will Google Analytics also get full IP addresses?
No, based on the reported email. Google Analytics tags keep redacting IP addresses. Only the four ad products named in the email are set to accept the full address, so your analytics and ad tags will behave differently after the change.
Can I opt out of sending full IP addresses?
Google says owners can opt out through a Help Centre article, but the email doesn't name it. Transformations can also redact signals before tags read them. Wait for Google's instructions, and test any opt-out in a staging container first.
Do I need user consent to send full IP addresses?
Google says proper notices and legally required consents must be in place before collection begins. EEA advertisers must follow Google's EU user consent policy, which also covers the UK and Switzerland. Ask a privacy professional how that applies to IP addresses in your case.
Does this affect Meta or TikTok tags in my container?
The email says third-party tags keep their own control over which signals they accept. It doesn't say whether their current behaviour continues. Check each tag's settings in your container rather than assuming it will stay as it is.
Conclusion
The one idea to remember: a default you didn't choose is still a decision you own. January 11 is a good deadline for finding out what your tags send.
This week, list your server containers and the ad tags inside them. Next, line up your consent notices against what those tags collect, then watch for Google's opt-out steps.
If you'd like a second pair of eyes on your tracking setup, our analytics team does this kind of audit all the time. When you're ready, get a free quote.
Sources
- PPC Land: Google ad tags gain full visitor IP addresses in server-side GTM in 2027
- Google: Bring performance and privacy together with Server-Side Tagging
- Google: EU user consent policy
John Doe
Supreb Information. Thanks
15 July 2014 View replies . 1