Google Ad Tags in Server-Side GTM Will Get Full IP Addresses

Google is changing how server-side Google Tag Manager treats your visitors’ IP addresses.

From January 11, 2027, Google’s ad tags in a server container will accept the full IP address. You’ve got until then to decide if that’s what you want.

Advertisers heard by email.

Search Engine Journal reports that Google Ads specialist Adriaan Dekker shared it on LinkedIn on November 2, and the notice carries no issue date.

As of November 3, the Tag Manager release notes were silent.

What changes in your server container

Until now, a server container could redact IP addresses for every tag at once. Google is moving that choice down to each tag, and here’s how the notice splits it:

• Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 tags will accept the full IP address.
• Google Analytics tags keep redacting it.
• Third-party tags decide for themselves which signals they take.
• Transformations can still redact the IP before any tag reads it.

Why the change?

Google says the update brings in privacy-enhancing technologies, filters spam and invalid traffic, and will improve the performance of the campaigns you run on its ad products.

Not sure this touches you?

The notice covers server containers only, and it says nothing about web containers or the Google tag in your visitors’ browsers, so it describes no change for a site on plain GTM.

How to keep the IP partly hidden

So if you’d rather your ad tags keep getting a masked address, you’ll need to build it yourself. Google’s Help Center page on IP address redaction for server-side tagging shows two steps:

1. Create a Custom Template variable that calls Google’s getAnonymizedIpAddress function.
2. Create an Augment event transformation that overwrites the ip_override field with that value, for the tags you pick, such as Google Ads or Floodlight.

Then test in Preview.

According to Google’s API reference, the function zeroes the last octet of an IPv4 address and the last 80 bits of an IPv6 one, which Google’s Help page calls a partially redacted IP.

That said, third-party tags are the catch. Some read the IP from a custom header or an event parameter instead of ip_override, so your transformation has to target the field each tag uses.

What Google hasn’t said yet

The notice leaves gaps you’ll want answered before January:

• how this works with consent mode
• where the full IP addresses get stored, and for how long

It does say you must have proper notices and consents in place before you collect any data.

In the EEA, Google’s EU User Consent Policy applies, it also covers users in the UK and Switzerland, and anywhere else with privacy laws you follow those rules and Google’s terms.

Meanwhile, don’t mix this up with Google’s planned Analytics data controls, which will encrypt IPs from the Google tag for linked Google Ads accounts.

Search Engine Roundtable’s Barry Schwartz calls it a new default, not a requirement to send full IPs everywhere.

Why it matters

My read: most small sites run plain web GTM, so for you this is probably nothing. Still, if you or your agency moved tracking to a server container, this one’s yours.

The part I don’t like is the direction of the default. Google’s own ad tags get more data unless you act, and I’d bet most site owners never hear about the opt-out.

I wouldn’t panic, though.

Plenty of you will decide full IPs for Google Ads are fine, as long as your consent banner and privacy policy say so. Does yours?

What I’d check before January 11

• Open your server container and list every Google Ads, Floodlight and third-party tag in it, along with the IP field each one reads.
• Pick the full IP address or a masked one, tag by tag.
• Check your privacy policy and consent banner, especially for EU, UK and Swiss visitors.

It fits a bigger shift. Apple’s Safari block is pushing ad tech server-side too.

Though I’d expect more of these choices to move off the page, where your visitors can’t see them.

Common Questions

Does the January 2027 Google Tag Manager IP address change affect normal web containers?

Not according to Google’s notice, which covers server-side Google Tag Manager containers only. It says nothing about web containers or the Google tag that runs in the visitor’s browser.

Will Google Analytics 4 tags in a server-side container receive full IP addresses after January 11, 2027?

No. Google says Google Analytics tags in server containers will keep applying IP redaction. The full address goes only to tags for Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360.

How can I stop Google Ads tags in server-side Tag Manager from getting the full IP address?

Build a transformation. Google’s Help Center shows a Custom Template variable calling getAnonymizedIpAddress, then an Augment event transformation that writes the masked value into the ip_override field for the tags you choose.