Loading story…
Google told advertisers it will begin using users’ IP addresses for ad measurement and personalization in the European Economic Area, the UK, and Switzerland on or shortly after August 3, 2026. The company said it will register under IAB Europe’s Transparency and Consent Framework Feature 3 and use privacy-enhancing technologies including on-device processing, trusted execution environments, and secure multi-party computation, but the change repurposes IP data already collected for routing and ad delivery into a device-level identifier for profiling.
The move has drawn scrutiny because IP addresses are treated as personal data under GDPR and related UK privacy rules, and regulators have said profiling-based advertising and cross-service personalization still require valid user consent. Google has placed the compliance burden on advertisers under its EU User Consent Policy, while user-facing controls for IP-based personalization on Google properties are not expected until later in 2026 or early 2027, extending concerns about fingerprinting after Google’s 2024 reversal of its earlier anti-fingerprinting position.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
Google told advertisers that on or shortly after August 3, 2026, it will begin using IP addresses for ad measurement and personalization in the EEA, the UK, and Switzerland. Google said advertisers remain responsible for obtaining valid user consent under its EU User Consent Policy.
In December 2024, Google reversed its earlier anti-fingerprinting position by removing its ban on advertiser fingerprinting. The change is cited as a precursor to its later move to use IP addresses for ad personalization in Europe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceghacks.net
Open sourcebleepingcomputer.com
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission issued two binding decisions under the Digital Markets Act requiring Google to expand interoperability on Android and provide certain Google Search data to qualifying rivals. Under the Android ruling, third-party AI assistants must be allowed access to capabilities that Google Gemini already uses, including microphone, camera, screen interaction, ambient sensor data, hotword activation, background execution, and app-driving automation, with most changes tied to **Android 18** and a broader compliance deadline of **1 August 2027**. For a smaller set of more sensitive functions, Google may require certification through a **Qualified AI Assistant Programme**, but the Commission limited Google’s discretion and required equal treatment with Gemini. A second ruling compels Google to share anonymized search query, click, and ranking data with eligible rival search engines and AI chatbots that perform search, with rollout beginning in **2027** under contractual, audit, and independent review safeguards. Google said the measures could weaken privacy and security protections, expose sensitive search histories and trade secrets, and create broader national security risks, while the Commission said the final terms include tighter safeguards than earlier drafts. Google is expected to appeal the decisions.
Jul 18, 2026
OpenAI’s advertising-measurement infrastructure reportedly sets a cross-site `__obi` cookie through its `bzr.openai.com` collector, enabling activity on advertiser sites to be associated with a ChatGPT account or a persistent anonymous device identifier. The one-year cookie is configured with `Secure` and `SameSite=None`; advertiser pixels can reportedly transmit page paths, purchase-funnel activity, and conversion events to OpenAI. Researchers observed the mechanism in 936 pixels across 1,029 hostnames and said advertiser pages or data layers could expose identity and location fields. The reported implementation activated under analytics consent even where marketing consent was denied, creating potential consent-management and data-classification concerns; it was observed primarily in Chrome on Android, while Safari and other iOS WebKit browsers are expected to limit the approach through Intelligent Tracking Prevention.
Sep 21, 2026
Google has warned that proposed European Commission remedies under the Digital Markets Act for **Google Search** and **Android** could introduce new cybersecurity and privacy risks by forcing broader interoperability and data sharing with rivals. According to Google security executive Heather Adkins, requirements that would give alternative AI assistants system-level access similar to **Gemini** on Android could make fraud easier and expose sensitive user data, while mandated access to Google Search data could weaken existing protections built around tightly controlled internal handling. Google also argued that sharing so-called anonymized search information—including query content, rankings, and click-rate data—at the level sought by regulators could enable user de-anonymization and create attractive new targets for attackers among smaller third-party recipients. The dispute comes as the European Commission prepares final decisions in two DMA cases covering Search and Android, with Google contending that competition measures can be implemented only if they do not materially erode security and privacy safeguards for European users.
Jul 12, 2026