Choose whether the Privacy Sandbox IP Protection feature should be enabled.
Last updated August 13, 2025
A policy to control whether the Privacy Sandbox IP Protection feature should be enabled.
IP Protection is a feature that limits availability of a user's original IP address for certain third-party network requests made while browsing in Incognito mode, enhancing protections against cross-site tracking during Incognito browsing sessions.
If the policy is set to Disabled, then IP Protection will be disabled and users won't be able to enable the feature via UI settings.
If the policy is set to Enabled, then IP Protection will be enabled and users won't be able to disable the feature via UI settings.
If the policy is not set, IP Protection will be enabled by default and users will be able to control the feature on their device via UI settings.
Some considerations regarding whether enterprises should disable IP Protection include:
- DNS lookups won't be performed for requests that are proxied, which may impact DNS-based monitoring or filtering.
- Enterprise applications may experience breakage when used in Incognito mode if they rely on requests to domains (or subdomains of those domains) on the Masked Domain List (https://github.com/GoogleChrome/ip-protection/blob/main/Masked-Domain-List.md) and require those requests to come from specific IP address ranges.
- Traffic might not be proxied in Incognito mode under certain conditions, for example when users launch Incognito mode from a Chrome profile they aren't signed in to. In general the feature requires the user to have been signed in to Chrome with a personal Google account when launching Incognito mode.
- The list of domains on the Masked Domain List may change over time, with new versions being pushed to users automatically. For more information on the Masked Domain List, see: https://github.com/GoogleChrome/ip-protection/blob/main/README.md#identifying-domains-and-the-masked-domain-list-mdl.
For more information on https://github.com/GoogleChrome/ip-protection/blob/main/README.md.
IP Protection will be launched no sooner than M139.