On third-party ad requests to Google Ad Manager, browser privacy proxies, IP protection settings, operating system features, and network configurations can mask client IP addresses. Masked IP addresses can inhibit use cases like geographic targeting accuracy and invalid traffic (IVT) detection.
Because your web server or content delivery network (CDN) interacts with users in a first-party context on incoming requests to your domain, your infrastructure still receives the user's unmasked IP address. Google Publisher Tag (GPT) provides the following features to recover and pass unmasked client IP addresses to Google ad servers:
- Recommended: First-Party Serving Path: You configure your CDN or reverse proxy to route a unique first-party serving path to Google ad servers. This option requires no client-side JavaScript changes. GPT reads the configured path from your Ad Manager settings and runs a recovery request. The recovery response returns the user's IP address as an encrypted payload, which GPT includes in ad requests.
- Publisher-provided IP: You capture the user's unmasked IPv4 or IPv6 address on your web server or CDN edge worker, fetch and cache an active key, and encrypt the address server-side using Hybrid Public Key Encryption (HPKE). Before requesting ads, you pass the encrypted base64url payload to GPT on the client.
For details about account-level configuration, see Pass unmasked publisher-provided IP.