You run Google Ads, you have a list of past customers sitting in a spreadsheet or CRM, and you just read that Google can now match people by customer match IP address and timestamp, not only by email or phone. The obvious questions follow fast. Will this help you reach people who already bought from you? Can your account even use it? And is it legal to hand that data to Google in the first place? The short answer is that Google added two optional upload fields, and whether they help you depends on three gates: your account, your list, and your privacy setup. A small account with a clean list can often use Customer Match in a limited way today. A messy or borrowed list should not go anywhere near an upload screen. By the end of this post you will know which side of those gates your business is on.
Key Takeaways
Customer Match uploads can now carry a user IP address and a user interaction timestamp, uploaded raw rather than hashed, and the timestamp only works alongside an IP.
Google says IP matching is unavailable for end users in the EEA, the UK and Switzerland, so records from those places need a different identifier or no upload.
Any account in good standing can use lists for Observation and exclusions; targeting needs 90 days of history and more than $50,000 in lifetime spend.
The data must be first-party, and a list needs at least 100 members added or refreshed within the last 540 days.
You stay responsible for notice, consent where required and where the data came from; this post is general information, not legal advice.
Know exactly what Google added, so you can decide if it matters to you
Google's Data Manager help page, Prepare your data for import, now lists two new optional Customer Match fields: "User IP address" and "User Interaction timestamp." The IP address is the one captured at the moment a customer interacted with your business, such as when they placed an order or filled in a form. The timestamp can mark the first and last recorded interaction from that IP. Search Engine Land reported the change on September 25, 2026.
Three details change how you would prepare a file. First, both new fields go up raw, not hashed. That is different from email addresses and phone numbers, which you normally hash before upload. Second, you cannot send a timestamp on its own; it only works paired with an IP. Third, Google says IP matching is not available for end users in the European Economic Area, the United Kingdom or Switzerland.
Nothing else about where your ads can run has moved. According to Google's About Customer Match page, Customer Match audiences still work across Search, Shopping, Display, YouTube and Gmail. The new fields simply give Google another way to connect a record on your list to a Google user. One note on sourcing: a separate Google announcement post for this change could not be found, so the help documentation above is the working source for the rules.
Find out whether your account can use Customer Match today
Before you think about IP addresses at all, check what your account is allowed to do with any customer list. Google's Customer Match policy sets two tiers, and a small advertiser can land in either one. The difference between them decides whether Customer Match is a reporting and exclusion tool for you or a way to actively show ads to past customers. The sections below cover both tiers and the list rules that apply to everyone.
What every account in good standing can do
Your account needs a good history of policy compliance and a good payment history. If it has both, you can use Customer Match lists for Observation and for exclusions. Observation lets you see how people on your list behave in your campaigns without narrowing who sees your ads. Exclusions let you stop paying to show ads to people who already bought, which can be useful when a campaign is aimed at new customers only.
What targeting requires
Targeting, manual bid adjustments and similar controls need more. Google requires at least 90 days of Google Ads history and more than $50,000 in lifetime spend, subject to its account rules. If your account is newer or smaller than that, you can still build lists and use them for Observation and exclusions, but you cannot yet aim ads only at the people on them.
The list rules that apply to everyone
The data must be first-party: information you collected directly from your own customers, such as purchasers, subscribers or loyalty members. You must upload through Google's approved interface or API. And a list needs at least 100 members added or refreshed within the previous 540 days to be usable.
| Requirement | What Google says | What to check |
|---|---|---|
| Account standing | Good policy compliance and payment history | Any policy warnings or billing problems in the account |
| Observation and exclusions | Available to all compliant accounts | Nothing extra beyond good standing |
| Targeting and bid adjustments | 90 days of history and more than $50,000 lifetime spend | Account age and total spend to date |
| Data source | First-party data collected directly from customers | Where every record on the list came from |
| List size and freshness | At least 100 members added or refreshed within 540 days | How many records are recent enough to count |
| New IP and timestamp fields | Raw, not hashed; timestamp only with an IP | Whether your systems captured an IP at the interaction |
| Regions | IP matching unavailable for EEA, UK and Swiss end users | Which records come from those places |
Understand what an IP match can and cannot tell you
An IP match links the address captured during a customer's interaction with the Google user tied to that address at that time. That is useful, but it is not the same as naming one person with certainty. Google's own explanation of IP addresses notes that several devices can share one IP, and that IP addresses can change.
In everyday terms, a household router puts every phone, tablet and laptop in the house behind one public address. An office network does the same for a whole staff. Mobile carriers, VPNs and proxies can put many unrelated people behind shared addresses too. The timestamp is there to narrow things down by tying the address to a specific window of time, which is why Google will not accept one without the other.
Google does not publish a match rate, an accuracy figure or a minimum improvement for the new fields. So, plan as if the gain is unknown until your own list shows it. If you already upload emails and phone numbers, the IP field is one more signal alongside them, not a replacement. Email, phone, mailing address and mobile device ID remain supported identifiers, and a small business does not need the IP field to use Customer Match at all.
For a small list, Customer Match earns its keep when the list is made of real customers, is refreshed regularly, and supports a clear job: keeping past buyers out of a new-customer campaign, bringing lapsed customers back with a specific offer, or watching how existing customers behave in your ads. A tiny or stale list may produce little usable reach no matter which identifiers you include.
Keep your upload on the right side of privacy rules
Everything in this section is general information, not legal advice. Privacy law depends on where your customers live, how you collected their data and what you told them at the time, so a qualified privacy lawyer is the right person for a firm answer on your own list. What follows is what Google and the named regulators publish, so you know which questions to ask.
What Google itself requires
Google's Customer Match policy requires your privacy policy to disclose that you share customer data with third parties to perform services. It also says to "obtain consent for such sharing where required by law or any applicable Google policies governing personalised ads and/or user consent." Google's rules on restricted targeting in personalized advertising also limit how sensitive categories can be used. If your privacy policy says nothing about sharing data for advertising, that is the first fix, and our post on whether your website needs a privacy policy covers the basics of having one at all.
The UK and the EEA
In the UK, the Information Commissioner's Office treats IP addresses and advertising identifiers as online identifiers. Its guidance on how the rules apply to online advertising says targeted online advertising commonly involves storage or access technologies that need consent under PECR, alongside UK GDPR. The ICO's direct marketing planning guidance adds that processing must be lawful, transparent and tied to a stated purpose, and that people have the right to object to direct marketing. In the EEA, GDPR and national ePrivacy rules may apply where IP addresses, cookies, pixels or account matching feed personalized ads. The IP fields do not work for those end users anyway, but other identifiers on the same list still fall under these rules.
The United States
In the US, obligations vary by state. In California, the CCPA as amended by the CPRA gives consumers rights over their personal information, including notice, access, deletion, correction and opting out of the sale or sharing of that information in the circumstances the law covers. The California Privacy Protection Agency's regulations page is the official source. No regulator found in the research for this post publishes a rule written specifically for Customer Match that tells every US advertiser to collect one particular kind of consent. The outcome depends on the state, the source of the data, your notices, your consent records and how the campaign runs.
Run a ten-minute check before you upload anything
You can answer most of the eligibility question yourself, today, without a consultant. Work through these in order and write down what you find.
- Check your account standing: Open your audience or Customer Match settings in Google Ads and look for policy warnings or billing problems. If you want targeting rather than Observation or exclusions, confirm the account has at least 90 days of history and more than $50,000 in lifetime spend.
- Count what is usable on your list: Export your customer records and look at the total, the purchase or interaction dates, duplicates and unsubscribed customers. Count how many were added or updated within the last 540 days; you need at least 100.
- Read your privacy policy: Look for a clear statement that customer data may be shared with third parties to provide advertising or related services.
- Look for real IP and timestamp data: Check whether your checkout, booking or CRM system actually captured the IP address at the moment of the interaction, with a time attached. If it did not, the new fields are not available to you yet.
- Separate out UK, EEA and Swiss records: Those records cannot use IP matching, so flag them before anything else happens.
If the list holds up, create a small test list through Google's approved interface, give it one clear job, and watch whether the segment becomes usable. If you are still growing a list from scratch, our post on how to start an email list from zero covers collecting it with permission from day one.
Save money by knowing when not to upload
Some lists should stay where they are. If yours was bought, scraped or borrowed from a partner, Google's first-party rule rules it out, whatever vendor sold it to you as an IP audience. If it is stale or smaller than 100 recent members, it will not be usable. If you have no record of what customers were told when you collected their details, or you sell something sensitive, the next step is cleanup or legal review, not an upload.
The common failures, ordered as a practical risk ranking rather than measured data, since Google publishes no frequency figures:
- No clean, current first-party list: Records are out of date, duplicated or from unclear sources.
- An account that cannot target yet: The list works for Observation or exclusions, but not for the targeting the owner wanted.
- Missing or vague privacy disclosure: No statement about sharing data for advertising, and no consent records where consent is required.
- Formatting mistakes: Hashing the IP or timestamp when they must stay raw, or sending one without the other.
- Expecting IP matching in the UK or Europe: Those end users are excluded from the feature.
- Mixing a list with narrow or sensitive targeting: Layering too many restrictions on a small list.
Each has a different fix. A dirty list needs deduplication, suppression of unsubscribes and a routine refresh. An eligibility gap needs policy or payment cleanup, or time. A privacy gap needs a review of notices, consent wording and opt-outs, which is legal and operations work rather than a campaign setting. Missing IP capture means changing how your site or CRM records interactions, which deserves its own privacy review before anyone builds it.
Is your business ready for Customer Match IP matching?
Pick an answer to begin.
1. How should the new IP address field be uploaded to Customer Match?
2. Your account is four months old with $8,000 in lifetime spend. What can you do with a Customer Match list?
3. You bought a list of 5,000 IP addresses from a data vendor. Can you upload it?
Frequently Asked Questions About customer match ip address
Does Google Ads Customer Match now support IP addresses?
Yes. Customer Match uploads can include an optional user IP address and an optional user interaction timestamp. The IP goes up raw, and the timestamp can only be sent with an IP.
Do I hash the IP address before uploading?
No. Google's import instructions say not to hash the IP address or the timestamp, unlike email addresses and phone numbers.
Does Customer Match IP matching work in the UK or EU?
No. Google says IP matching is unavailable for end users in the EEA, the UK and Switzerland. Other identifiers may still apply to those records, under local privacy law.
What are the Customer Match requirements for a small account?
Any account with good policy and payment history can use lists for Observation and exclusions. Targeting needs 90 days of history and more than $50,000 in lifetime spend. Lists need at least 100 members added or refreshed within 540 days.
Does Google guarantee more matches with the IP field?
No. Google publishes no match rate or accuracy figure for the new fields, so treat any gain as unknown until your own list shows it.
If Google accepts my upload, does that mean it is legal?
No. You remain responsible for how the data was collected, what customers were told and any consent the law requires. This is general information, not legal advice; a privacy lawyer can answer for your own list.
Wrapping Up
Customer Match IP matching adds two optional fields, a raw IP address and an interaction timestamp, to the identifiers you can upload. It does not work for end users in the EEA, the UK or Switzerland, and Google publishes no figure for how much it improves matching. Every compliant account can use lists for Observation and exclusions, while targeting needs 90 days of history and more than $50,000 in lifetime spend. The list itself still has to be first-party, recent and backed by a privacy policy that discloses sharing for advertising.
Run the ten-minute check, fix the list and the privacy notice before anything else, and you will either have a small, clean audience that does one clear job or a clear reason to wait. Either way, you stop paying to guess.
If you want a second pair of eyes on it, Web Leveling can check your account, your list and your upload setup with you before any data leaves your hands. Our Google Ads management work covers eligibility checks, list hygiene, testing and reporting, and our email marketing service helps you build the kind of permission-based list Customer Match expects. We are not your lawyer, and we will tell you when a privacy question needs one, or when a list should not be uploaded at all. We work with small and medium businesses across the country and overseas. Send us a note about your account and your customer list, and we will tell you what it can support.
Terms
Customer Match words in this post
Tap a term to see what it means.
Customer Match. A Google Ads feature that lets you upload your own customer data to reach, observe or exclude those customers in your campaigns.
First-party data. Information you collected directly from your own customers, such as buyers, subscribers or loyalty members.
IP address. The network address a device uses online; several devices can share one, and it can change.
Interaction timestamp. The time a customer interacted with your business, uploaded with the IP to narrow down a match.
Hashing. Turning data such as an email address into a scrambled code before upload; Google says not to hash the IP or timestamp.
Observation. A setting that shows how people on a list behave in your campaigns without limiting who sees your ads.
PECR. The UK's Privacy and Electronic Communications Regulations, which cover consent for cookies and similar technologies used in online advertising.
