Starting January 11, 2027, Google will send full visitor IP addresses to its ad tags in server-side Tag Manager by default, according to PPC Land.
If your high-ticket store runs a server-side GTM container, often set up to win back conversions that browsers drop, the container-wide IP redaction you chose stops applying to Google’s ad tags unless you opt out. For the store owners we teach at Ecommerce Paradise, that means a piece of customer data you used to control moves into Google’s ad systems on a date Google picked.
Below: what Google announced, why server containers redacted IPs in the first place, what the change does to your ad data and your consent setup, and the five checks I’d run before the switch flips.
When an ad platform changes what it collects, the email list you own is the one asset nobody can reset. Every checkout and quote request should feed a list you control. Start building your store’s email list with Klaviyo →
Server-Side GTM Sends Full IPs to Google Ads Tags Jan. 11
PPC Land reported on November 2, 2026 that Google emailed advertisers about the change. The email itself is undated. Per that report, Google says server-side Google Tag Manager will let tags process “standard network signals like IP address” for ads measurement and personalisation from January 11, 2027.
Server containers currently redact IP addresses for every tag at once. The new model moves the decision to each tag. Tags for Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 will accept the full address. Google Analytics tags will keep redacting it, and third-party tags keep their own control over which signals they accept, according to PPC Land.
Under the hood, a server container turns the visitor’s request into an event data object, and that object carries an ip_override field holding the IP address. Owners could previously hide it from every tag in one move. Transformations can strip signals before a tag reads them, PPC Land noted, but the transformation documentation does not mention IP addresses.
The change is opt-out. Owners who do nothing send full IP addresses to those four ad products from January 11. Google’s email points to a Help Center article without naming it, per PPC Land.
I checked Google’s own pages on November 3. The Tag Manager release notes carry entries for October 8 and October 12, 2026, and neither covers IP handling. The server-side send-data page, last updated October 13, does not mention IP addresses either. So as of this morning the opt-out mechanism is not documented anywhere I can read, and it is unclear whether it will be a container setting, a per-tag switch or a custom transformation.
On consent, Google’s email says end-user notices and “legally required consents” must be in place before collection begins, per PPC Land. Advertisers in the EEA must follow Google’s EU user consent policy, and other regions must follow local privacy law and platform terms. The email names only the EEA, while the policy itself covers the EEA, UK and Switzerland and does not mention IP addresses at all.
Google cites privacy-enhancing technologies and spam and invalid-traffic filtering as reasons for the update. It names no specific technology and gives no performance figures, according to PPC Land.
Why Server Containers Redacted IPs, and What Google Changed
Server-side tagging sends data from your server to Google instead of straight from the visitor’s browser, and by default the visitor’s IP rides along. In an August 2020 walkthrough, analytics consultant Simo Ahava showed that the Universal Analytics tag copied the user’s IP and user agent into the outgoing request, and that blank ip_override values stopped it. Google’s own release notes from March 16, 2021 say server-side Tag Manager can use Google Analytics server-side tags to redact or anonymize IP addresses before data is transmitted.
So for five years, redaction was the owner’s call. Part of the reason is legal. In Breyer v Germany (C-582/14), decided October 19, 2016, the European Court of Justice held that dynamic IP addresses collected by website operators must be treated as personal data, according to law firm Osborne Clarke. The firm’s summary also notes limits: the reasoning leaned on legal routes that let site operators compel internet providers to identify attackers, so it does not automatically reach every identifier.
The contrast with Google’s other recent IP move is sharp. AdSense added a “Share full IP address” control in June 2026, and per PPC Land’s June 1 report it is off by default. The server-side GTM change starts switched on.
Here is the counterpoint, and Google has a real one. Analytics tags keep redacting. You can still strip the signal with a transformation. The email puts the consent burden on the advertiser, which is where privacy law puts it anyway. And I found no independent measurement of what full IPs do for match quality or fraud filtering, which means I can’t tell you the upside is small. Google offered no figures either.
This also fits a pattern. I wrote last week about Safari 27.2’s fix for a 7-day cookie cap on CNAME domains, and server-side endpoints on cloaked subdomains still face that cap. Earlier this month Google claimed a 20% Demand Gen lift from its tag gateway, based on its own analysis with no independent audit, which I broke down in my tag gateway post. Google keeps asking advertisers for more first-party signal, and each ask comes with the privacy work attached.
What Full IPs Mean for Your Ad Data, Consent and Budget
My read is that this matters to a narrow group and matters a lot to them. If your store only uses the built-in Google channel on Shopify, as far as I know you have no server container of your own and nothing to change. If a freelancer or agency set up server-side tracking for you, you may own a container without remembering it. That is the first thing to find out, and my high-ticket tech stack post shows where tracking sits in the stack I’d build today.
For stores that do have a container, the exposure scales with how much of your traffic sits under strict privacy rules. Hypothetical math: a store gets 40,000 sessions a month and 25% come from the EU, UK or Switzerland. That is 10,000 sessions a month whose IP addresses would reach Google Ads tags without a decision from you. A US-only furniture or outdoor store has far less of that exposure, but its privacy policy still has to describe what it collects, and it can’t skip that step.
Three scenarios, with thresholds. If you have no server container, do nothing. If you have one and meaningful EU, UK or Swiss traffic, treat January 11 as a deadline and restrict IP at the tag level before then. If you have one and your traffic is almost entirely US, read your privacy policy and decide on purpose, because “Google flipped it” is a poor answer to a customer or a regulator. I’m not a lawyer, and anything with real exposure belongs in front of one.
Now the upside case. Google says IP signals help ads measurement and spam filtering. In high-ticket categories, where one click can cost real money and the buying cycle runs weeks, cleaner invalid-traffic filtering would be worth having. But nobody has shown that full IPs deliver it, and you can test it yourself. Take your conversion system baseline, Google Ads conversions against Shopify orders for the 30 days before January 11, and compare it with the 30 days after.
The consent side is where stores slip. Your banner has to describe ad measurement accurately, and your tool has to pass the visitor’s choice to the container. A banner tool such as Termly can handle the mechanics.
I walked through the setup in my Termly guide for ecommerce stores. Europe is also rewriting its cookie rules, as I covered in the EU Council cookie consent draft, so a banner you set once will not stay correct forever.
One more timing point. January 11 lands 69 days from today and after Black Friday (November 27) and Cyber Monday (November 30). Your last clean baseline will be muddied by holiday volume and January returns, so compare ratios, such as Google Ads conversions divided by Shopify orders, not raw counts. A ratio that drifts after the switch tells you something. A raw count that drops in January tells you almost nothing.
I would also not rip out server-side tracking in a panic. It still does the job it was built for, which is recovering signal that browsers drop. The question is narrower: which tags get which fields, and who decided. Write that down, even if the answer is “nobody has looked yet.”
The bigger lesson is who holds the data. Every few months an ad platform changes what it collects or what it will measure, and the stores that shrug are the ones with a strong customer list. Capture emails and phone numbers at the quote request, and put them to work with the flows in my high-ticket email flows post. If untangling tracking on top of running the store sounds like a second job, the turnkey done-for-you service exists so you aren’t the one owning the whole stack.
Want to pressure-test your tracking and consent setup with other store owners and me? The community starts with a 7-day free trial, then it is paid. Join the Skool community →
Audit Your Server Container Before January 11: 5 Steps
Run these five in order. None take more than an afternoon, and the first one tells you whether the rest apply.
- Find out whether you own a server container. Ask whoever built your tracking, then open Tag Manager and look for a container of the server type. A tracking subdomain in your DNS records is another tell. Safari’s tracker limits are a separate problem, covered in my audit of Safari 27 blocking email-to-ID ad trackers.
- List every tag in the container and sort it into three groups: Google Ads, DV360, SA360 and CM360 tags, Google Analytics tags, and third-party tags such as Meta. Only the first group changes on January 11.
- Plan the restriction. Until Google publishes the Help Center article, a transformation that clears the IP before the Ads tags read it is the documented way to hold a signal back. Build it in preview mode, and ask your tag vendor in writing how they will handle the opt-out.
- Check your consent banner and privacy policy against what the container sends. The legal requirements checklist covers the policy pages every store needs, and a lawyer should check the wording if you sell into Europe.
- Record your baseline now: Google Ads conversions against Shopify orders for the last 30 days, split by country. Compare ratios, not raw counts, because holiday volume will distort both windows. If you want a second set of eyes on the numbers, Explore Turnkey Builds. Then build your email list in Omnisend or Klaviyo so a share of your repeat sales never depends on ad tracking.
Frequently Asked Questions
Does this affect a standard Shopify store with the Google channel installed?
As far as I know, no, because the change applies to server-side Tag Manager containers, which a store only has if someone set one up. Confirm with whoever built your tracking, and see my high-ticket dropshipping guide if you are still building the store.
Will Google Analytics also get full IP addresses?
No. PPC Land reports that Google Analytics tags keep redacting the address. The change covers Google Ads, Display & Video 360, Search Ads 360 and Campaign Manager 360 tags.
How do I opt out?
Google has not documented it yet. Its email points to a Help Center article it does not name, and the release notes I checked show nothing. Watch for the article, and plan a transformation as the fallback.
Is a full IP address personal data?
In the EU, courts have treated dynamic IP addresses as personal data since the 2016 Breyer ruling, per Osborne Clarke. US rules vary, so talk to a lawyer about your own exposure, since I’m not one.
Will full IPs improve my Google Ads results?
Google claims better measurement and spam filtering but published no numbers. Test it against your own baseline. My post on Tag Manager skipping the extra gtag.js is another change worth measuring that way.
What data should I collect instead of leaning on ad tracking?
Emails and phone numbers from quote requests and checkouts. Keep them in a CRM such as HubSpot. I covered the free setup in my HubSpot guide.
What should I do if I’m still picking a niche and have no tracking yet?
Start with the basics before server-side anything. Grab my free high-ticket niches list first. Then read the niches breakdown.
Want my team to build and run your high-ticket store, so tracking decisions like this aren’t yours to carry? See the turnkey done-for-you service →
Check your container this week, because January 11 is closer than it looks. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.
Related Articles
If this was useful, these go deeper:
- Google Claims 20% Demand Gen Lift From Tag Gateway
- Meta Pixel Adds On-Device Conversion Counting Nov. 12
- Google Is Turning Every Google Tag Into a GTM Container
- My Google Merchant Center Optimization Checklist
- How to Set Up HubSpot Free for a High-Ticket Store (2026)
Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.
