Anti-Tracking Guide

Google's 2025 fingerprinting policy change

Since 16 February 2025 Google no longer bans fingerprinting by its ad customers. What changed, why the UK regulator objected and what you can do.

Official source: ICO, Our response to Google's policy change on fingerprinting. Verified on

2 min read · Review scheduled for 2027-01-24

Contents

What changed

From 16 February 2025, Google no longer prohibits organisations that use its advertising products from using fingerprinting techniques. That is how the UK Information Commissioner's Office summarised the change in a blog post dated 19 December 2024 (ICO).

The ICO also recalls Google's own earlier view, from 2019, that fingerprinting "subverts user choice and is wrong" (ICO).

What the regulator said

  • It is unfair tracking. The ICO's position is that fingerprinting reduces people's choice and control over how their information is collected (ICO).
  • The change is "irresponsible". That is the word the ICO used.
  • Not a cookie substitute. Businesses cannot treat fingerprinting as a simple swap for third-party cookies.
  • The law still applies. UK data protection law and the Privacy and Electronic Communications Regulations (PECR) require fair choices, consent where needed, transparency and respect for rights such as erasure. The ICO calls meeting that standard a high bar.
  • Guidance followed. The ICO published draft guidance on storage and access technologies, fingerprinting included, with a consultation set to open on 20 December 2024.

What it means for an ordinary browser

Before 16 Feb 2025 After
Google's rules for its ad customers banned fingerprinting That ban is gone; the law in each country remains
Clearing cookies removed the main ad identifier Clearing cookies does nothing to a fingerprint, which is not stored on your device (EFF)

So the defences that matter are the ones in your browser, not in your cookie settings. In the EU and UK, the legal side is on EU rules on tracking and fingerprinting.

Three things to do this week

  1. Run the browser check to see what a site can read from you without asking.
  2. Pick a browser with fingerprinting defences and leave them on: Firefox blocks known fingerprinting scripts and limits suspected ones (Mozilla); the side-by-side view is on browsers compared.
  3. Send the opt-out signal where it carries legal weight: turn on Global Privacy Control.

What we could not check

Google's own policy page did not load when we tried it on 26 October 2026, so the dates and wording above come from the ICO. We do not know which advertisers actually use fingerprinting under the new rules, and we make no claim about any specific company.

Outside this page: Rules outside the UK and EU, and the details of Google's advertising products.