Build Your First AI Project This Weekend
Stop consuming tutorials. Start creating. Get the free step-by-step guide.
2026 Update:
AI agents change the leverage here. Use them to cluster converting IPs, flag datacenter ranges, and keep exclusion lists from going stale.
But the market still decides. And in 2026, IP targeting is not the cookie replacement a lot of vendors sold you.
This piece used to read like a media-buyer playbook for CIDR lists and cloaking. I’m leaving the useful mechanics. I’m also going to be blunt about what is dead, what is a policy risk, and what a plumber or a solo AI operator should actually do.
Every traffic buy includes waste.
Wrong geography. Bot traffic. Office networks that never book a job. You’re paying for this right now.
IP targeting can filter some of that before you spend. It is not a secret audience graph that lets you follow a person around the internet.
Most people skip it completely. Or they paste a public blacklist, wonder why nothing changes, and move on.
Here’s the honest version: how IPs actually work, what still works in 2026, and where you’ll get burned.
This is one piece of the larger campaign optimization system. It’s one of the most misunderstood.
What An IP Address Actually Is
“IP Address” stands for Internet Protocol Address.
It’s a number linked to a network connection. I put “unique” in quotes because things get messy fast.
On a home network with a router, every device (phone, laptop, tablet, smart TV) usually shares the same public IP. Target that IP and you hit the household, not one person.
On cellular, IPs are often shared, rotated, or NATed across lots of phones. Carrier traffic is a terrible place to pretend you have one-to-one targeting.
Why this matters for your ads:
IP targeting delivers ads (or blocks ads) at the network level. Powerful for “don’t show ads to my shop WiFi” and “this /24 keeps converting.” Weak for “show this ad to Jane on her phone at lunch.”
You do not need a networking degree. You do need to know the difference between a single address and a block:
| CIDR | Rough size | When you’d use it |
|---|---|---|
| /32 | 1 address | Exclude your office, a known bot, one venue WiFi |
| /24 | 256 addresses | A small ISP block or building range |
| /16 | 65,536 addresses | Almost always too wide. You’ll block customers. |
Most of the useful work in 2026 is exclusions, not giant whitelists.
The 2026 Scorecard: Alive, Weak, Dead
Still useful
1. IP exclusions on Google Ads
Google still lets you exclude IPs at campaign or account level (up to 500 per campaign). The documented use case is blocking your own office, competitors clicking your ads, and obvious junk (Google Ads Help).
If you run Google Ads for a local shop, do this on day one:
- Exclude the shop’s public IP so staff don’t click ads
- Exclude your home IP if you test from there
- Exclude repeat click-fraud IPs your call tracker or server logs flag
That is not “IP targeting.” That is hygiene. It still works.
2. First-party IP from your own conversions
Your tracker, form, or call log already sees the visitor IP. Clustering those IPs with AI can show you:
- Datacenter / hosting ranges that never book
- A handful of converting /24s on a cheap ad network
- Geo mismatches (ads targeted to Boise, conversions claiming Europe)
Use that to filter your own traffic, not to build a creepy dossier.
3. Specialized household matching for local CRM lists
Vendors such as El Toro still sell address-to-IP matching: upload a list of physical addresses (past customers, service area, new movers) and try to reach those households on display/CTV.
For an HVAC company with a real customer list, that can be a complement to local SEO and search. You already know the houses. You’re trying to stay on the TV in those living rooms.
Treat vendor accuracy claims as vendor claims. More on that below.
4. Venue / WiFi as a one-off
Trade show WiFi. Auto mall. Campus. Get the public IP of that network, buy cheap display, no frequency cap, “We’re in booth 1282.”
This still works when the venue IP is stable and the budget is small. It is a stunt, not a growth engine.
Weak or oversold
Household IP as a people identifier. Commercial IP-to-postal graphs are a lot less accurate than the sales decks. A November 2025 CIMM / Go Addressable study run by Truthset, benchmarking nearly one billion commercial IP records against ISP ground truth, found IP-to-postal linkages accurate about 13% of the time on average (16% for IP-to-email). Providers agreed with each other only 6.4% of the time on postal linkages (CIMM, AdExchanger).
El Toro still advertises 95%+ confidence on its matching algorithm (El Toro). That is a vendor number for a specific product, not the industry average. If you buy IP audiences, ask how they validate against ISP data. If they hand-wave, don’t.
Google Customer Match IP uploads. In May 2026 Google added IP address support to Customer Match via the Data Manager API, with match-rate gains expected later in 2026. It is not supported for end users in the EEA, UK, or Switzerland, and it is not a DV360 Customer Match feature (PPC Land). Useful if you already have first-party IPs and you’re outside those regions. Not a new targeting toy for a solo operator in Europe.
Cookies died, so IP replaced them. False. Chrome kept third-party cookies. Google retired most Privacy Sandbox ad APIs (Topics, Protected Audience, Attribution Reporting, and others) on October 17, 2025, citing low adoption (Google Privacy Sandbox update). Safari and Firefox still restrict cross-site tracking. iOS ATT still punches a hole in mobile. First-party email and server-side events beat IP lists for retargeting.
Dead or policy-risk
CIDR cloaking / geo spoofing. Showing one page to an affiliate network and another to a user based on IP ranges. Networks and platforms treat this as fraud. I’m not going to teach it. If you used to do this in 2018, assume it’s a ban waiting to happen.
Fingerprinting because “Google allows it now.” Google dropped its fingerprinting prohibition for advertisers in December 2024. The UK ICO called that reversal irresponsible the next day (TechTimes / ICO coverage). Under GDPR, IP addresses are personal data. “The ad platform stopped forbidding it” is not a lawful basis.
Buying a public IP whitelist and calling it targeting. That list is based on someone else’s offer, someone else’s fraud, last year’s ISP assignments. It’s already priced in, and it’s stale.
Cell-tower frequency-cap exploits. Some old ad servers capped frequency by IP. Shared carrier IPs meant one impression for thousands of phones. Rare now. Don’t build a business on it.
Competitor office stalking. Targeting a competitor’s office IP with recruitment or attack ads. Creepy, often against platform rules, and a great way to train their staff to click-report you.
How AI Changes the Grunt Work
The old way: Pull converting IPs from the tracker. Look them up one by one. Find the CIDR. Build a CSV. Repeat.
The new way: AI clusters. You decide.
Prompt: converting IP patterns
Analyze this list of converting IP addresses from MY campaigns only.
Identify:
1. Common CIDR ranges (group IPs that share the same /24, /16)
2. ISP or ASN patterns
3. Obvious datacenter / hosting / VPN ranges that should never have converted
4. Geographic mismatches vs my targeting
Here is my data: [paste IP list]
Do not invent ranges. If a lookup is uncertain, say so.
Prompt: exclusion candidates
Here is 30 days of click data: IP, impressions, clicks, conversions, spend.
Flag:
1. IPs or /24s with high spend and zero conversions (min $X spend)
2. Known hosting / cloud ASNs
3. IPs that clicked 10+ times with 0 conversions
Return a Google Ads exclusion list (one IP or 203.0.113.* wildcard per line).
Warn me if a range looks residential and I might block real customers.
AI does not replace a lookup against IPinfo or DB-IP. It batches the busywork.
Finding Useful IP Ranges (If You Even Need Them)
Don’t start here if you don’t have conversions yet. IP work is an optimization on top of a campaign that’s already running.
What you need:
- A tracker or server log that stores IP (tracking setup)
- Active campaigns generating conversions (even unprofitable)
- A reason this beats simpler filters (geo, device, schedule)
Step 1: Export conversions with IP, plus clicks with IP.
Step 2: Cluster. Look for /24s that show up more than once on conversions, and /24s that eat spend with nothing back.
Step 3: Look up the ASN. If it’s AWS, Google Cloud, a datacenter, or a VPN provider, exclude. If it’s a residential ISP in your service area, leave it alone unless you have a pile of conversions in that exact block.
Step 4: Implement as exclusions first. Whitelists shrink reach so fast that most local shops never recover volume.
Why your own lists beat public lists:
- You’re not trusting a traffic source’s carrier database
- The list is based on YOUR conversion data
- You can refresh it weekly instead of running a 2019 CSV forever
Residential ISPs reassign IPs. A whitelist from six months ago is compost.
What a Local Shop or Solo Operator Should Actually Do
Skip the DSP theater until the basics are done.
HVAC / plumber / dentist:
- Exclude shop + home IPs in Google Ads
- Send form and call events server-side so you’re not guessing
- If you have a customer address list and a budget for display/CTV, test one household-IP vendor against a geo-only control. Measure booked jobs, not “view-through.”
- Keep winning the Map Pack. IP ads do not replace GBP.
Solo AI / consulting business:
- Same IP exclusions (you clicking your own ads is expensive comedy)
- Put the real weight on email and Customer Match. A Kit list of people who downloaded your audit is a better audience than a scraped IP file. Build that list in Kit (formerly ConvertKit).
- Pair with retargeting on Meta Ads and Google, using first-party events.
Affiliate / paid traffic (advanced aside):
If you still buy from self-serve ad networks that accept IP lists (some native/push/pop sources still do), use your converting ranges as a whitelist and datacenter ranges as a blacklist. Do not cloak. Do not buy someone else’s “USA high-converting CIDR pack.” Refresh weekly.
Privacy: Don’t Be the Test Case
GDPR / UK: IP addresses are personal data. If you’re processing EU/UK traffic, you need a lawful basis, a privacy policy that says you collect IPs, and you should not store them longer than you need. Fingerprinting is not a loophole.
US state laws: Treat IPs as data you disclose. Offer opt-out where the law requires it. Don’t buy random third-party IP lists of unknown origin.
Best practices I actually follow:
- Use IP data from my own campaigns and site (first-party)
- Prefer exclusions over “follow this household”
- Don’t store raw IPs forever
- Disclose collection in the privacy policy
- For EU/UK, default to “don’t upload IPs into ad platforms”
Common Mistakes
Mistake 1: Using public blacklists without verification
Someone else’s junk is not your junk. Verify against your logs.
Mistake 2: Targeting too narrow
A single IP is a rounding error. Start with exclusions. If you whitelist, start at /24 and watch volume die.
Mistake 3: Ignoring dynamic and mobile IPs
Carrier NATs and rotating residential IPs will make a pretty whitelist miss most of the audience.
Mistake 4: Set and forget
Review monthly. Fraud patterns shift. ISP blocks get reassigned.
Mistake 5: Replacing email with IP
When cookies are blocked, the durable identifier is still a person who gave you an email or a phone number. IP is a network. Email is a relationship.
Implementation Checklist
Week 1
- Confirm your tracker or server logs capture IP
- Exclude shop, home, and agency IPs in Google Ads
- Pull 30-60 days of conversion + click IPs
Week 2
- Run the AI clustering prompt
- Exclude datacenter / VPN / obvious fraud ranges
- Document baseline CPA before any whitelist
Week 3
- If you buy on a network that supports IP lists, test exclusions vs control
- Do not roll a whitelist to 100% of budget
Week 4
- Compare CPA and volume
- Drop any range that killed reach without helping CPA
- Schedule a monthly refresh
What To Do Next
IP targeting is an edge when you use it as a filter. It is a liability when you use it as a fake cookie.
Keep lists fresh. Combine with other signals. Don’t outsource your ethics to a vendor PDF.
Your next step: Export the last 30 days of clicks and conversions with IPs. Run the exclusion prompt. Add the obvious junk to Google Ads. Then go back to the work that actually books jobs: offer, page, and follow-up.
Once the waste is cut, scale the campaigns that survived.
Sources: