Blog

Server-side GTM will share full IP addresses with Google's ad tags from January 2027

Published JAYC Consultancy6 min read

  • Privacy & Consent
  • Server-Side Tagging
  • Google Ads
  • Google Tag Manager

If your website sends its tracking data through a server-side Google Tag Manager (GTM) container, a change is coming on 11 January 2027 that's worth putting in the diary now. From that date, Google's advertising tags in server containers will receive your visitors' full IP addresses, unless you take steps to stop them.

What's changing

Google has been emailing advertisers a notice titled "Updates to network signal processing in server-side tagging". We haven't seen it first-hand, but it was shared on LinkedIn on 2 November 2026 and reported by PPC Land and Search Engine Journal.

According to those reports, the notice says server containers will move from redacting IP addresses across the whole container to handling them tag by tag. In practice:

  • Google's ad tags get the full IP address. That covers tags sending data to Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360.
  • Google Analytics tags keep redacting it. Google's help page on IP address redaction also says that Google Analytics server tags already apply partial IP redaction by default.
  • Third-party tags keep their own controls. Tags from Meta, LinkedIn, TikTok and others decide for themselves which signals they accept.
  • Transformations can redact the data first. You can strip or change the IP address before any tag sees it.

Google describes the way out as an opt-out, so the change is on by default. If you do nothing, Google's ad tags will receive more information than they do today.

Why Google says it's doing this

As reported, the notice says the change allows tags to process "standard network signals like IP address" to improve ads measurement and personalisation. It also says the update builds in privacy-enhancing technologies and helps filter spam and invalid traffic, with the aim of improving campaign performance.

It doesn't name the technologies, give any figures or say what other "network signals" are covered. We'd treat the performance claims as Google's stated aim, not a proven result.

Who it affects

This applies only to server-side GTM containers. If your site runs Google's tags only in the browser, through a standard web container or the Google tag, the notice doesn't cover you, according to Search Engine Journal's reading of it.

You're most likely to be affected if:

  • you run a server-side GTM container with Google Ads conversion or remarketing tags, or Floodlight tags for Campaign Manager 360 or Search Ads 360
  • you, or your agency, chose server-side tagging partly to limit what reaches Google's ad systems
  • you have visitors in the UK, the EEA or Switzerland

If you're not sure whether you have a server container, ask your developer or agency. If you're new to the idea, our post on why server-side tracking still needs consent explains how it works.

The consent and privacy angle

According to the reports, the notice says advertisers must have "proper end-user notices and legally required consents" in place before data collection begins. Advertisers in the EEA must follow Google's EU user consent policy. The email only mentions the EEA, but the policy itself covers end users in the UK and Switzerland too.

That policy requires valid consent for cookies where the law requires it and for using personal data to personalise ads, along with records of consent and clear information about who receives the data.

For UK businesses, the wider legal background is worth knowing:

  • UK GDPR. It lists "online identifiers" as one way a person can be identified, and the ICO's guidance names IP addresses as an example. So an IP address can be personal data.
  • PECR. The Privacy and Electronic Communications Regulations cover cookies and similar technologies. The ICO's cookie guidance explains when consent is needed.

Moving tags to a server changes where data is processed, not whether consent matters. The notice doesn't explain how the new IP handling works alongside Consent Mode, so check rather than assume. Our Consent Mode v2 guide covers the basics.

This article is for general information only and isn't legal advice. If you're unsure how these rules apply to your business, speak to a qualified data protection adviser.

Opting out: what we know so far

The notice points to a Help Centre article for opt-out instructions but doesn't name it. Google's Tag Manager Help Centre does have a page called IP address redaction for server-side tagging. In outline, it describes:

  1. Creating a custom variable that uses Google's getAnonymizedIpAddress function.
  2. Adding an "Augment event" transformation that replaces the ip_override field with that anonymised value, for the tags you choose.
  3. Testing in Preview mode, then publishing the server container.

According to Google's server-side API reference, this function masks the last section of an IPv4 address to zero, and keeps only the first 48 bits of an IPv6 address. So the result is a partially redacted IP address, not one removed entirely. Google's transformations documentation also describes an "Exclude parameters" option, but warns that removing data a tag relies on can stop it working, so test carefully.

The help page adds that some third-party tags read the IP address from other fields, so they may need their own transformation.

Two points are still unclear. Google hasn't said whether this help page is the article its notice refers to, and its Tag Manager release notes didn't mention the change when we checked on 3 November 2026. It's worth checking both again before you make changes.

Your pre-January checklist

  • Confirm whether you use server-side GTM. Ask your developer or agency if you're not sure.
  • List the tags in your server container. Note any Google Ads, Floodlight (Campaign Manager 360), Search Ads 360 or Display & Video 360 tags.
  • Find out how IP addresses are handled now. Is anything redacted today, and where?
  • Decide what you want. Should Google's ad tags get the full IP address, a partially redacted one or none? Record the decision and the reason.
  • If you're opting out, build and test the transformation. Use Preview mode to check what each tag actually receives.
  • Check your third-party tags. Find out which field each one reads the IP address from.
  • Review your cookie banner and consent setup. Make sure it matches how your server container now behaves, including Consent Mode.
  • Update your privacy notice if needed. It should accurately describe what you share with Google and other vendors, and why.
  • Note the date in your reporting. If Google Ads conversions shift after 11 January, you'll know why. Our post on why GA4 and Google Ads report different numbers explains why the two tools can drift apart anyway.
  • Recheck Google's documentation before January for any updates.

For more on recent changes to the wider tagging setup, see our round-up of this year's GTM updates, and what server-side GTM costs per month.

Need a second pair of eyes?

If you'd like help working out what this means for your setup, we offer server-side tagging and consent reviews. We'll look at your server container, consent setup and privacy notice, and tell you clearly what, if anything, needs to change before January.

Find out more about our services

Sources

Back to blog

Want this sorted for your own tracking?

A free 30-minute call. We'll look at your tracking with you and tell you what's broken and what to fix first.

Book a free call See all services