Server-Side GTM Will Pass Full IP Addresses to Google Ads Tags — What Directors Should Decide Before January

Written by Digital Team

From 11 January 2027, Google’s own advertising tags in a server-side Google Tag Manager container will be able to accept the full visitor IP address.

Until then, IP redaction in a server container has worked across the whole container. Google’s notice to advertisers says that setup is changing to tag-level processing. Google Analytics tags keep redacting. Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 tags will accept the full IP — unless you change that with a Transformation.

For ecommerce and digital directors, the lesson is short: From 11 January, Google Ads tags in your server container can see the full visitor IP by default. Decide before the change, not on the day.

What Google announced

Search Engine Journal reported the notice on 3 November 2026. Google Ads specialist Adriaan Dekker shared it on LinkedIn on 2 November. The notice is titled “Updates to network signal processing in server-side tagging.” SEJ says it carries no issue date, and Google’s Tag Manager release notes did not mention the change as of 3 November.

According to the notice, server containers “will transition from container-wide IP address redaction to individual tag-level processing.” It then sets out four effects:

Tags sending data to Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 will now accept the full IP address.

Google Analytics tags will continue to apply IP redaction.

Third-party tags will maintain independent control over the signals that they accept.

Transformations can redact these signals before any tag accesses the data.

The notice covers server containers only. It says nothing about the Google tag or web containers in the browser.

On consent, SEJ reports that advertisers using Google’s advertising products “must ensure that proper end-user notices and legally required consents are in place before data collection begins,” and that advertisers in the EEA “must strictly adhere” to Google’s EU User Consent Policy — which also covers end users in the United Kingdom and Switzerland.

Sources: Search Engine Journal — Google Ad Tags In Server-Side GTM To Get Full IP Addresses (Matt G. Southern, 3 November 2026); Adriaan Dekker — From January 11, 2027, server-side GTM can send full IP addresses to Google Ads… (3 November 2026; notice shared on LinkedIn 2 November).

Google Tag Manager Help: IP address redaction for server-side tagging — Custom Template Variable with getAnonymizedIpAddress and Augment event transformation steps (captured 5 Nov 2026)

What it means, in plain terms

  • Server-side Tag Manager sits between your website and Google (and other vendors). Your tags fire from your server, not only from the shopper’s browser. That gives you more control over what leaves with each hit.
  • Today, IP redaction can cover the whole server container. From 11 January 2027, that becomes a per-tag choice for Google’s advertising tags.
  • Full IP means the complete network address of the visit, not the shortened form many teams have got used to. Google’s Help page for the opt-out path calls the shortened form a “partially redacted IP.” SEJ notes Google’s API zeroes the last octet of an IPv4 address and the last 80 bits of an IPv6 address.
  • Google Analytics tags in the same server container keep redacting by default. Your Ads tags and your Analytics tags can therefore behave differently after the change.
  • You can still redact before any tag sees the IP, using Transformations. That is the documented opt-out path in Tag Manager Help.
  • Third-party tags keep their own rules. Some read ip_override. Some use other fields. The Help page says you must check each vendor.

This sits next to two earlier notes. Your cookie banner is now the only switch between GA4 and Google Ads covered Consent Mode as the control for how Google uses ad identifiers. If your tags still load from Google's domain, you are measuring less of the journey than you think covered first-party tag serving. Today is about which IP leaves your server with each Google Ads hit.

Why it matters for the P&L

  • Consent and notices are a board risk, not a tag tweak. If full IPs start flowing to Google Ads tags without a clear decision on notices and consent, the cost is not a lost click — it is a compliance and brand problem. For UK and EU traffic, that sits under your privacy and legal owners, not only under marketing tech.
  • Ad platforms may get a stronger network signal. Google says the update “integrates privacy-enhancing technologies (PETs),” filters spam and invalid traffic, and will improve campaign performance (as reported by SEJ). Better matching can help paid media. It can also mean you are sending more precise location-linked data than your privacy notice describes.
  • Analytics and Ads can diverge. Boards often treat “what GA4 shows” and “what Ads optimises on” as one story. After January, Ads tags may see a full IP while Analytics tags stay redacted. That split needs a plain explanation before finance asks why the two systems look different.
  • Server-side was sold as more control. Many brands moved to server-side Tag Manager partly to decide what leaves the building. From January, the default for Google’s ad tags is full IP unless you set a Transformation. Control stays available — but only if someone owns the decision.
  • Third-party pixels on the same server still matter. Every script on your site can do what your customers can do was about supply-chain risk. The same discipline applies here: know which tags see which IP field, and who owns each one.

How to keep IPs partially redacted (director checklist)

Google’s notice points advertisers to the Help Centre for opt-out steps. The live Tag Manager Help page, IP address redaction for server-side tagging, describes this path. Hand these steps to your analytics or tag lead — do not invent screens that Help does not show.

  1. List every Google advertising tag in your server container. Include Google Ads, Floodlight, Display & Video 360, Search Ads 360 and Campaign Manager 360 tags. Note which ones fire for UK, EU and Swiss traffic.
  2. Decide the policy with privacy and legal. Full IP to Ads tags, or partially redacted IP via a Transformation? Write the decision down. We are not giving legal advice — ask your DPO or counsel.
  3. If you choose partial redaction, follow Google’s Help path:
    • In the server workspace, create a Custom Template Variable that calls getAnonymizedIpAddress (Help shows: const getAnonymizedIpAddress = require('getAnonymizedIpAddress'); then return getAnonymizedIpAddress();).
    • Create an Augment event Transformation that overrides the ip_override field with that variable.
    • Under Matching Conditions or Affected Tags, select the advertising tags that should get the partially redacted IP.
    • Use Preview, trigger the tags, and check the IP is redacted before data leaves the server.
    • Save and publish the server container.
  4. Check third-party tags separately. If a vendor does not use ip_override, Help says to override the custom field that vendor uses, then Preview again.
  5. Align your privacy notice and consent copy with whatever you decide — especially for EEA, UK and Swiss visitors under Google’s EU User Consent Policy.
  6. Diary 11 January 2027 in the marketing and privacy calendars. Add a Google Analytics annotation when you publish any Transformation, so the board can see when the setup changed.
  7. Retest after publish. Spot-check a UK and an EU journey in Preview. Confirm Ads tags and Analytics tags behave as you intend.

Questions to ask your team this week

  • Do we run Google Ads, Floodlight or other Google advertising tags in a server-side container today?
  • After 11 January 2027, should those tags receive a full IP or a partially redacted IP?
  • Who owns that decision — marketing, privacy, or both — and is it written down?
  • Does our privacy notice already describe IP use by advertising tags?
  • Have we tested the Help Centre Transformation path in Preview on a staging container?
  • Which third-party tags read ip_override, and which use another field?

Caveats

  • This is a notice shared publicly via industry channels, not (as of early November 2026) a line in Google’s Tag Manager release notes. SEJ checked release notes on 3 November and found no mention. Treat the Help page as the documented opt-out path, and watch release notes for an official product note.
  • Exact interaction with Consent Mode is not spelled out in the notice, per SEJ. Do not assume “consent denied” automatically blocks full IPs for Ads tags without checking your own setup.
  • Storage duration of full IPs is not stated in the notice (SEJ). Ask Google reps or counsel if that matters for your retention policy.
  • This is distinct from Google’s separate planned Analytics IP encryption for data passed to linked Google Ads accounts (dates Google said it would share later in 2026). Do not mix the two projects in one board update.
  • We are not giving legal advice. Notices, consents and the EU User Consent Policy need your DPO or counsel — especially for EEA, UK and Swiss traffic.

Final thoughts

#28/100 — From 11 January, Google Ads tags in your server container can see the full visitor IP by default. Decide before the change, not on the day.

Server-side Tag Manager still gives you control. From January, that control for Google’s advertising tags is opt-in via Transformations, not the old container-wide default. Make the call with privacy and legal now, test in Preview, and publish before 11 January 2027 — not in the week the change lands.

Not sure what your server container sends to Google Ads today? Run our free GA4 and GTM tracking scan at https://audit.taggurus.co.uk/, email info@taggurus.co.uk, or book a meeting today to discuss.

FAQ

Q: When does this change?
A: From 11 January 2027, according to Google’s notice as reported by Search Engine Journal and Adriaan Dekker.

Q: Does this affect Google Analytics?
A: Google Analytics tags in the server container continue to apply IP redaction, per the notice. The change is about Google’s advertising tags.

Q: Does this affect browser-side (web) containers?
A: The notice addresses server containers only. It says nothing about the Google tag or web containers in the browser.

Q: Can we keep sending a partially redacted IP to Ads tags?
A: Yes. Tag Manager Help describes a Custom Template Variable with getAnonymizedIpAddress, plus an Augment event Transformation that overrides ip_override, applied to the tags you choose, then Preview and publish.

Q: Is this the same as Google’s Analytics IP encryption change?
A: No. That is a separate planned update for Analytics IP data passed to linked Google Ads accounts, with dates Google said it would share later in 2026.

Q: What should directors do first?
A: Confirm whether you run Google advertising tags in a server container, then decide full vs partially redacted IP with privacy and legal — and diary the work before January.

Sources

Digital Team
Next

AI Agents Are Reaching Your Checkout — What Ecommerce Directors Should Check in Their Numbers