Google ad tags in server containers get the full IP in 2027

Google has told advertisers that server-side Google Tag Manager will handle IP addresses differently from 11 January 2027. Today a server container passes Google's ad tags a shortened IP address. From that date, tags for Google Ads, Campaign Manager 360 (Floodlight), Display & Video 360 and Search Ads 360 receive the visitor's full IP address, unless you set the container up to keep shortening it.

Nothing in your container changes visibly and no tag stops working. It is a change of default, which is exactly why it is easy to miss. This article explains what changes, what it means for privacy and measurement, who it affects and what to do before the date.

What changes on 11 January 2027

Google describes it as a move from IP redaction for the whole container to processing per tag. In practice:

• Google Ads, Floodlight, DV360 and SA360 tags accept the full IP address from that date.
• Google Analytics tags keep redacting. A GA4 tag in your server container still sends a shortened address.
• Third-party tags (Meta, TikTok, LinkedIn and others) keep deciding for themselves which signals they accept. Many of them already read the full address from the container today.
• The change is limited to server containers. Your web container and the Google tag in the browser are not part of this change.

Google's email calls the way out an opt-out and points to its help article on IP address redaction for server-side tagging. That article describes one method: a transformation that replaces the IP with a shortened one for the tags you choose. We walk through it below.

Why Google wants the full address

Google names better ads measurement and personalisation, privacy-enhancing technologies, spam and invalid-traffic filtering, and improved campaign performance. It gives no figures. An IP address is a strong signal for telling real visitors from bots, for placing a conversion in the right region and for matching a conversion to an ad click when cookies are missing, so the reasoning is plausible. It is also the reason this is not a neutral setting: the more useful an IP address is for matching, the more clearly it counts as personal data.

What this means for privacy

Under EU law an IP address is usually personal data. The EU Court of Justice said so in 2016 (Breyer), and European data protection authorities treat it that way. A shortened address, with the last part set to zero, still allows country and city reporting but no longer points at one connection.

Three things follow from that:

• Your privacy statement may stop being true. Many statements and processing registers say IP addresses are anonymised or shortened before they reach Google. From 11 January that is no longer automatic for ad tags.
• Consent matters more. Google's email reminds advertisers that notices and legally required consents must be in place before collection, and that the EU User Consent Policy applies in the EEA. Google has not said how the change interacts with Consent Mode, for example with the requests Floodlight sends server to server when consent is denied.
• It is your decision, not Google's. Sending the full address is not forbidden, but it needs a legal basis and a correct notice. Make the choice on purpose, together with whoever handles privacy for the site, rather than letting the default decide.

Who this affects

You are affected when a server container runs at least one Google ad tag:

• A Google Ads conversion tag or Google Ads remarketing tag in the server container.
• A Floodlight tag (Campaign Manager 360), or tags for DV360 or SA360.

You are not affected when your server container only runs GA4, when Google Ads only runs from your web container, or when you have no server container at all. Agencies should check every client container separately: one Floodlight tag is enough.

On Measurebase: the IP Anonymization power-up shortens the visitor's address before the request reaches your server container. Every tag in the container, Google's ad tags included, only ever sees the shortened address, so this change makes no difference for domains with the power-up on. It is off by default, so check it per domain.

1List your server containers and Google ad tags

Open each server container in Tag Manager and note every Google Ads, Floodlight, DV360 and SA360 tag, including paused ones you might switch on later. Note the third-party tags too: this is a good moment to check which of them already receive the full address today.

2Decide: keep shortening, or accept the full IP

Keep shortening when your privacy statement promises it, when you are unsure about the legal basis, or when you simply want nothing to change. Accept the full address only when you have a clear legal basis, a statement that says so, and consent that actually gates the ad tags. Write the decision down per site; an auditor or a client will ask.

3Keep shortening the IP

Two ways, which you can combine:

• IP Anonymization in Measurebase. Switch it on for the domain under Power-ups. The address is shortened before the container receives the request, for every tag, with nothing to build in Tag Manager. Location reporting keeps working: Data Enrichment resolves country and city from the real address first and only passes on the result.
• Google's transformation. In the server container, create a variable template that returns getAnonymizedIpAddress() (it needs permission to read the visitor IP), and a variable from that template. Then add a transformation of the type Augment event that sets ip_override to that variable, and limit it to your Google Ads and Floodlight tags. The function sets the last part of an IPv4 address to zero and keeps only the first 48 bits of an IPv6 address. Google's help article on IP address redaction for server-side tagging has the steps.

You can set either up now. Until January the result is the same as today, so there is no reason to wait for the deadline.

4If you accept the full IP, update your paperwork

Update the privacy statement and processing register to say that the full IP address is shared with Google for advertising. Check that your Google Ads and Floodlight tags only fire with advertising consent, and that Consent Mode signals reach the server container. Agencies: tell the client in writing and let them decide; it is their data and their statement.

5Test it in Preview

Open the server container in Preview and send a test conversion from the site. In the request, the Transformations tab shows whether your transformation was applied and to which tags; in the event data of a Google Ads or Floodlight tag, ip_override should end in .0 for an IPv4 visitor. With IP Anonymization on in Measurebase, the address already arrives shortened, so every tag in Preview shows the shortened value.

What we do not know yet

The date comes from Google's email to advertisers. Google's help article describes the transformation method but does not mention 11 January 2027 or the word opt-out yet, and the Tag Manager release notes have no entry for it. Google has also not said whether a simple switch per container or per tag will follow, how the change works with Consent Mode, or how long full addresses are kept. We will update this article when Google publishes more.

Frequently asked questions