The single most consequential data change of the week is also one of the quietest. On June 1, Google launched a new AdSense control that lets publishers include the full IP address in programmatic bid requests sent to demand partners. It arrived through a Help Center note, with no fanfare, and it is blocked by default. Yet the toggle restores a signal that quietly underwrites a large share of geographic, fraud, and business-to-business targeting, and its arrival reframes a week in which AI moved deeper into the rest of the ad stack.

What the fourth octet actually carries

A standard IPv4 address is four numeric groups separated by dots — 93.184.216.34, for instance. In the default AdSense configuration, bid requests carry only the first three: 93.184.216.0. That final group, the fourth octet, is withheld. The difference sounds trivial and is anything but. Each octet's last segment corresponds to a specific host within a /24 subnet, so removing it collapses precision from a narrow block of 256 addresses to the subnet as a whole. Google's own framing is blunt: many buyers consider the full IP address a critical signal for assessing the quality and relevance of an impression. The new feature provides that complete signal to three demand channels simultaneously when a publisher opts in — Authorized Buyers, which spans the DSPs and networks with programmatic access to Google Partner Inventory; Display & Video 360, Google's own demand-side platform; and Google Ads. There is no partial setting. The full address either flows to all three or to none.

Why does the host octet matter so much? The source documents three buyer use cases. Geolocation is the most immediate: city, metro, and ZIP-level targeting depend on IP-derived location when users provide none, and a truncated address forces buyers to discount or skip impressions whose location resolution falls below their threshold. Invalid-traffic detection is the second: verification vendors cross-reference addresses against known data-center ranges and residential proxy networks, and patterns that cluster within a /24 become harder to spot once the host octet disappears. Frequency management is the third: as third-party cookie coverage has contracted, buyers lean on IP as a probabilistic proxy for a unique household, and a truncated address inflates perceived reach by folding distinct hosts onto one subnet-level identifier, distorting frequency caps.

The B2B targeting dimension

Beyond those three, the restored octet speaks directly to a discipline the source does not name but which depends on exactly this precision: business-to-business account targeting. IP-to-company matching — the firmographic backbone of account-based marketing — works by resolving an impression's address to the organization that owns the corresponding range. A great deal of that resolution depends on the host portion of the address; truncated to the /24, an impression from a specific corporate network blurs into a broader pool, weakening the confidence with which a buyer can say a given ad reached a target account rather than a residential neighbor on the same subnet. For B2B advertisers who build campaigns around named-account lists and company-level reach rather than individual cookies, the fourth octet is not a marginal enrichment. It is the part of the signal that makes firmographic targeting and company-level frequency capping viable on open-web inventory at all. Restoring it on AdSense supply, the long tail of independent publishers, potentially widens the addressable pool for that kind of targeting — to the precise extent that publishers choose to switch it on.

A toggle that means the opposite of what it says

The control is easy to misread, and Google's own interface invites the error. The setting lives under Brand safety, then Content, then Blocking controls, then Manage Ad serving, where publishers find a row labeled "Share full IP address." It operates counter-intuitively: to allow sharing, a publisher must disable the toggle; to block it, the toggle must be enabled. The logic is architectural rather than perverse — the control sits inside a blocking-controls panel, where the on-state represents an active restriction, so enabling the block withholds the data and disabling it lets the data flow. The same inverted logic governed the Authorized Buyers control Google introduced in November 2025. No tag changes or page-code edits are required; the control operates at the account level, and publishers must click Save. Crucially, the default is the restricted state. Google's documentation guarantees that when the feature is off, only the truncated address is shared and current serving logic is unaffected, a non-disruption promise that matters for a platform serving everyone from individual bloggers to large independent media sites.

Where the data still will not flow

Even with the toggle set to share, a substantial share of impressions stays on the truncated path. Google restricts full IP sharing on three request types. Non-personalized ads, which serve when users decline behavioral targeting, will not carry the full address; Google removed the account-level NPA control from European AdSense settings in May 2025, pushing publishers to code-based implementation. Limited ads apply where valid consent is absent under IAB Europe's Transparency and Consent Framework, a mode that became more common after the TCF v2.3 transition turned mandatory on March 1, 2026. Restricted Data Processing activates for users in US states with applicable privacy laws, a list Google has expanded repeatedly to cover jurisdictions where it limits data use for Global Privacy Control signals. The net effect is that full IP data flows only on personalized requests where consent is established and no processing restriction applies. For publishers with heavy European traffic or large US privacy-state audiences, much of the inventory remains truncated regardless of the setting — a meaningful constraint on how far the B2B targeting benefit can actually reach.

The timing is not incidental. European data protection authorities have consistently classified IP addresses as personal data under GDPR, and the Belgian regulator's 2022 ruling on IAB Europe's TCF addressed IP flows in real-time bidding directly. The feature also lands in the shadow of US litigation: a federal judge approved Google's RTB consumer privacy settlement on March 26, 2026, and the partner ad opt-out Google introduced in May strips IP addresses from bid requests when users activate the RTB Control. The AdSense toggle sits on the opposite side of that dynamic — a publisher-facing control that optionally adds IP data, rather than a user-facing one that removes it. Separately, Google's Analytics consent overhaul, with key changes effective June 15, consolidates internal IP handling under Consent Mode. The consistent pattern across these moves is optional expansion with conservative defaults: Google surfaces a new data-sharing capability, sets it to the most restricted state, and delegates both the revenue upside and the compliance responsibility to publishers.

This AdSense change did not arrive in isolation. It was one of three Google measurement and data changes inside roughly 48 hours. Starting June 2, the Google Ads API adopted the Total Co-view definition for seven reach and frequency metrics, so reach now counts every person in front of a connected TV when an ad plays rather than only the account holder — expanding unique-user denominators and lowering per-person frequency, with a definitional break that pre-June 2 comparisons will not flag. Google added a native Leads screen inside the Conversions section, showing 60 days of lead stages that feed back into Smart Bidding. And Search Engine Roundtable reported that the Google May 2026 core update hit hard over the May 30-31 weekend, alongside a confirmed limited test of healthcare ads in AI Mode.

The wider current: AI into the plumbing

The IP change reflects a broader theme running through the week — control over the signals and intelligence at the core of advertising is being renegotiated. PubMatic launched Decision Fabric on June 1, letting DSPs and algorithm firms deploy AI decisioning models as Docker containers natively inside the supply-side platform, returning segment IDs in under ten milliseconds against the richer signal that lives before traffic shaping. Hightouch announced Exposure Log Matching with The Trade Desk, resolving raw impression logs against a brand's own warehouse keys — a move toward neutral, brand-owned measurement that gained urgency after Publicis agreed to acquire LiveRamp for $2.5 billion. OpenAI pushed ChatGPT toward performance, activating cost-per-action ads and rolling out conversion-optimized campaigns on June 5 via a pixel-and-Conversions-API architecture echoing Meta's. And Microsoft launched Web IQ, a grounding API built for AI agents rather than people, claiming sub-165-millisecond latency. Each is a fight over who owns the signal — and the AdSense octet is the same fight, fought at the level of a single number in an address.

When the AI layer becomes the attack surface

The week's cautionary note showed the cost of routing decisions through AI. On June 2, AdExchanger reported that Meta's AI customer support chatbot, live across the full ads platform since March, contained a security hole. As 404 Media first reported, hackers seized high-profile Instagram accounts, including those of Sephora and Barack Obama, by convincing Meta's AI support they were the rightful owners; the bot then linked new admin emails without adequate verification. Meta appears to have patched it. The episode is a sharp illustration of the social-engineering surface that opens when AI is handed authority over account decisions, a risk that grows as every platform pushes automation deeper into its core.

Also noted