TCF Feature 3: When Google May Use the IP Address to Identify a Device

Feature 3 in the Transparency and Consent Framework (TCF) describes device identification using automatically transmitted information, such as an IP address. The declaration is neither a separate consent nor permission for unrestricted data use. The actual purpose, legal basis and effective privacy choices remain decisive.

Google’s policy help announces the launch of IP-based advertising measurement and personalisation in the EEA, the UK and Switzerland beginning in August 2026. That source does not establish one activation date for every product and account. Registering Feature 3 in the vendor list describes a processing method; registration alone does not demonstrate actual processing on a particular website.

Purpose and method

A purpose answers “What for?”, while a feature answers “How?”. Measuring advertising performance is a purpose. Recognising a device using automatically transmitted information is a possible method. Consent to measurement does not thereby authorise personalisation as well.

A Consent Management Platform (CMP) provides the consent interface. The Global Vendor List (GVL) contains registered vendors’ declarations. The TC String is an encoded message carrying information about disclosures and privacy choices.

What changed in TCF during 2026

As of 24 October 2026, the relevant technical specifications are 2.4 and the policies are 5.0.b. The deadline for new feature explanations and illustrations on the web was 23 October 2026; mobile apps and CTV have until 23 February 2027. The interface must explain that features are processing methods supporting disclosed purposes. Features must not be associated with controls in this presentation; a seemingly permanently enabled feature toggle would be misleading.

TCF 2.3 had already made the disclosedVendors segment mandatory for newly created TC Strings from 1 March 2026. This segment records vendor disclosure, not consent to every purpose of that vendor. Documented transition rules apply to older strings.

No feature toggle does not mean no change

The TC String carries vendor and purpose choices, special-feature opt-ins, publisher restrictions and the version of the Global Vendor List (GVL), among other information. There is no individual Feature 3 consent bit. Nevertheless, changes to the vendor list, disclosures or decisions can change the string.

Whether fresh consent is necessary depends on the scope of the previous informed consent and the new processing. The absence of a feature bit cannot settle that question. An unchanged consent count likewise does not prove unchanged data processing.

The IP use described by Google

Google lists tags, SDKs, HTTP calls and uploads as possible inputs. A direct browser request normally exposes a connection address to the destination server. Proxies and server-side uploads can involve different origins and transmission paths. It is therefore unsafe to assume that every end-user IP used for advertising was already present, unchanged, in every request.

Google’s policy help explains that consent requirements can extend to IP-based advertising measurement and personalisation; the obligations are not limited to cookies. Google also requires a prominent link to the Business Data Responsibility information. An updated or certified CMP alone does not guarantee a suitable implementation.

Technical safeguards can reduce risks. A network trace does not, however, establish a particular internal processing path inside a trusted execution environment. Additional technical evidence would be needed. An IP address can be personal data when linked to an identified or identifiable person; encryption or isolated processing alone does not establish anonymisation.

A meaningful integration check

1. Disclosures: comparison of the current GVL, Google entry, feature explanation, illustrations, privacy notice and link describing Google’s data use.
2. Choices: comparison of acceptance, rejection, individual-purpose selection and withdrawal against the transmitted vendor and purpose signals.
3. Data flows: an inventory of tags, SDKs and server-side forwarding, including IP fields. A correct-looking banner is insufficient evidence.
4. Evidence: documentation of the wording, configuration, time and results, followed by renewed checks after relevant changes.