In a significant policy change announced on December 18, 2024, Google will permit advertisers to use device fingerprinting techniques starting February 16, 2025, prompting immediate criticism from privacy regulators. The UK Information Commissioner's Office labeled the decision "irresponsible" in its official response released December 19.
According to Google's platform program policies announcement, the company will modify its advertising policies to allow the use of Internet Protocol (IP) addresses and device fingerprinting, particularly for Connected TV (CTV) advertising. Device fingerprinting involves collecting pieces of information about a device's software or hardware which, when combined, can uniquely identify specific devices and users.
The ICO's executive director of regulatory risk, Stephen Almond, stated that businesses do not have unrestricted permission to implement fingerprinting techniques. "Like all advertising technology, it must be lawfully and transparently deployed – and if it is not, the ICO will act," Almond emphasized in the official statement.
Google justified the policy shift citing two major changes in the advertising landscape. First, the advancement of privacy-enhancing technologies (PETs), including on-device processing, trusted execution environments, and secure multi-party computation. Second, the emergence of new advertising platforms, particularly Connected TV, which Google describes as one of the fastest-growing advertising channels.
The technical implementation will incorporate confidential computing within Google's advertising products. This approach aims to enable businesses to utilize first-party data without re-identifying users, marking a departure from traditional IP address targeting methods.
The ICO highlighted specific technical concerns regarding user control. Privacy controls built around existing technologies allow users to manage cookies through consent banners or browser settings. However, fingerprinting relies on signals that users cannot easily eliminate. Even when users select "clear all site data" in their browsers, organizations employing fingerprinting techniques can immediately re-identify them.
The timing of this announcement has drawn scrutiny from competition experts. Thomas Höppner, a competition lawyer and DMA litigator, pointed out that this move contradicts Google's previous privacy defense in pending cases. "When Google announced this week that it would allow fingerprinting from February 2025, it further confirmed that its 'privacy defence' in pending cases is a pretext," Höppner stated on social media.
Industry expert Ari Paparo noted the business implications, particularly in the Connected TV space where Google currently trails competitors. "Their business severely lags the competition (who all use IP), so this is an opening for them," Paparo commented.
The ICO announced plans to publish draft guidance on how data protection law, including the Privacy and Electronic Communications Regulations (PECR), applies to storage and access technologies such as fingerprinting.
Organizations implementing fingerprinting techniques must demonstrate compliance with data protection requirements, including providing transparency to users, securing freely-given consent, ensuring fair processing, and upholding information rights such as the right to erasure. Based on current understanding of fingerprinting techniques, the ICO indicated this represents a high compliance threshold.
Google maintains that its core privacy principles remain unchanged, stating users will retain choice over personalized advertisements. The company plans to partner with the broader advertising industry to make privacy-enhancing technologies more accessible, though specific details of these partnerships remain unclear.
The implementation timeline gives advertisers and technology providers approximately two months to prepare for these changes, which will affect various advertising surfaces, including Connected TVs and gaming consoles, reflecting the expanding scope of digital advertising beyond traditional web browsers.