Google Ads Customer Match now accepts raw IP addresses

What changed in the Customer Match product

Google Ads Customer Match, the product that lets advertisers upload first-party customer data to build audiences across Search, Shopping, Gmail, YouTube and Display, now accepts two new identifier types: a raw internet protocol (IP) address and a user interaction timestamp. The Data Manager application programming interface (API), the technical layer through which advertisers send audience data to Google, supports sending un-hashed IP addresses and timestamps in CompositeData for Customer Match from Q3 2026.^[1]

Lindsey Volta, from Google's Data Manager API Team, said the aim was higher match rates. "Providing IP addresses along with their corresponding observation timestamps in IpData will help drive higher match rates for Google Ads Customer Match beginning in Q3 2026," Volta said.^[6]

How the matching works

Email addresses and phone numbers have always required SHA256 hashing before upload to Customer Match. IP addresses and timestamps go in raw. Google secures the upload with Transport Layer Security (TLS) encryption, limits the data to audience matching and policy compliance checks, and says uploaded files are not used to build user profiles.^[3]

Upload an IP address without a corresponding timestamp and the system defaults to the most recently observed user of that IP address.^[2] In any household or office where one IP address is shared across multiple people and devices, the match lands on whoever Google last saw at that address, which may not be the person the advertiser intended to reach.

Where the feature does not apply

IP address matching is unavailable for end users in the European Economic Area (EEA), the United Kingdom and Switzerland.^[2] Those jurisdictions impose stricter consent and data-minimisation requirements on online identifiers. Australia has no equivalent carve-out.

Why Australian advertisers face a live compliance question

The Office of the Australian Information Commissioner (OAIC) is explicit: personal information under the Privacy Act 1988 includes IP addresses.^[4] That classification does not hinge on whether the data is hashed. An un-hashed IP address uploaded to a third-party platform is regulated from the moment it leaves the advertiser's server, triggering Australian Privacy Principle (APP) 3 obligations around collection and APP 6 obligations around use and disclosure.

The OAIC has already warned businesses about tracking technologies. "Given the potential privacy risks and significant community concern about the use of tracking technologies, the OAIC strongly encourages organisations to err on the side of caution and comply with the Privacy Act when using third-party tracking pixels on their website," the regulator said.^[7]

Tranche-2 reforms add further pressure

The federal government released the second tranche of Privacy Act reforms on 31 August 2026, proposing a fair-and-reasonable collection test, a right to erasure, and new controls on trading location and tracking data.^[5] Location data, like IP addresses, is explicitly named as personal information under the proposed framework.

For Australian advertisers, the practical sequence runs like this: confirm whether privacy notices disclose IP address collection for advertising purposes, check that the basis for collection satisfies APP 3, then assess whether forwarding the data to Google constitutes a disclosure to a third party requiring separate APP 6 justification. The tranche-2 consultation period closes before the Q3 2026 Customer Match rollout completes, so any advertiser already testing the feature is doing so while the legal floor beneath it is still being built.