Google has announced it is planning tests for a new tool on its Chrome web browser which would let users mask their IP address. The proposed feature, called IP Protection (and formerly known as Gnatcatcher), is designed to make it harder for third-parties – ad tech companies included – to use IP addresses for cross-site tracking. Apple launched a similar tool a few years back called Private Relay.
“An IP address is an effective cross-site identifier as it is highly unique, relatively stable, cheap to collect and the applications of IP addresses by websites are not detectable by the browser,” says an explainer of the proposed product. “Therefore limiting access to IP addresses is important to prevent other methods of cross-site tracking beyond third-party cookies.”
Google first released details of the tool earlier this year, via a GitHub page describing IP Protection. But the proposed feature has picked up attention following Google’s announcement that it will begin running early tests of the technology.
Should the feature make it to full release, it will place further limits on the ability for advertisers and ad tech companies to track user behaviour across different websites. IP addresses are a common component of some identity tools which seek to offer cookie-free cross-site tracking, IP Protection would likely make these identifiers less reliable and accurate. Google has said however that it will ensure IP address-based geotargeting by third parties will still be possible with IP Protection.
A Two Hop Solution
Google’s proposed tool specifically targets third-party collection of IP addresses. Websites which users interact with directly will still be able to see IP addresses, which is important, since IP addresses play a significant role in things like traffic routing and fraud prevention.
To do this, Google says it will (at least initially) maintain a list of scripts and domains which it knows are tracking users, and apply IP masking to those specific domains.
Without going into the technical specifics, Google will route traffic to third-parties which appear on this list through two proxies, one of which will be run by Google, and the other of which will be run by another company. Google says this will ensure that the third party can’t see the user’s IP address, and that neither proxy can see both the IP address of the user and their end destination.
The tool will be opt-in initially, meaning IP Protection won’t be turned on by default. But Google’s use of the world “initially” suggests this may change in the future.
Closing loopholes
Google frames IP Protection as a closing of loopholes, rather than new privacy restrictions. The tech giant says it’s designed to limit fingerprinting, where third-parties build up user profiles on individuals based on a variety of signals (including IP addresses) which can be used for tracking. Google promised to clamp down on fingerprinting alongside its decision to sunset third-party cookies.
But one person’s fingerprinting is another’s identity solution. New restrictions on IP addresses will have an impact on tools used by marketers to target and measure their ad campaigns.
And within IP Protection’s GitHub page, some users have complained that IP Protection is another example of Google acting unilaterally, in a way which benefits its own businesses.
Users have argued that the tool requires users to trust Google, since it owns one of the proxies which users are funnelled through, and ultimately controls the whole process (something which Google denies).
