Google Chrome's IP Protection has moved well beyond the broad proposal we first covered in 2023. Its current scope is specific: selected third-party requests in Incognito are proxied when the third-party domain appears on Chrome's Masked Domain List.
That detail changes the security discussion. IP Protection is not a general-purpose VPN and it does not replace the address for every request made by the browser.
What Chrome Proxies
Google's IP Protection overview says the feature applies to requests made in a third-party context to domains on the public Masked Domain List. A top-level site and its ordinary first-party requests are outside that stated scope.
Chrome replaces the user's original address with an address carrying coarse geolocation. The implementation uses two chained proxies so neither proxy should receive both the original client identity and the final origin identity. Blind-signed authentication tokens are intended to prevent the proxy from linking handled traffic back to the signed-in Chrome account.
This is a privacy control aimed at cross-site tracking. It should not be described as a general anonymity service.
What a Website Will Notice
A listed third party can receive requests from the proxy address rather than the user's direct address. That weakens IP-based linking across sites and may alter geolocation, rate and reputation assumptions at the third-party service.
The top-level application still has its own first-party request, session, account and route evidence. Security teams should avoid turning one network category into a verdict. A Chrome privacy relay, corporate VPN, consumer VPN and residential proxy have different operating models even when each obscures the original source address somewhere in the journey.
Keep Abuse Controls Attached to the Route
An application should handle the network change the same way it handles other privacy infrastructure: retain the category, then evaluate what the request is trying to do.
On public content, the changed address may require no action. On login, recovery or payment, combine it with account history, credential evidence, device continuity, request sequence and recent outcomes. Rate limits should use keys that survive shared or changing addresses.
Privacy Relay, Corporate VPN, or Residential Proxy? provides the operational policy. For the browser comparison, read Google Chrome IP Protection vs Apple Private Relay.
