Chrome IP Protection: how it worked and where it stands

Originally published on proxymint.

Chrome IP Protection routed Incognito third-party traffic through two proxies. How it worked, the Masked Domain List, coarse geo, and its retirement status.

TL;DR

• Chrome IP Protection masked IPs from trackers in Incognito. Third-party requests to domains on the Masked Domain List went through two proxies, so the tracker saw a shared address near the user.
• Two hops split what each operator saw. Google's proxy saw the user's IP but not the site; a CDN's proxy saw the site but not the IP, using CONNECT and CONNECT-UDP tunnels.
• Google announced its retirement on October 17, 2025. The GitHub repository was archived on November 3, 2025, and the Chrome feature switch is gone from the network feature list by the Chrome 145 source.
• Location stayed coarse, never chosen. Exits mapped to areas of at least one million users, about 700 in the US, without crossing country borders.

Key takeaways

• Stop planning for IP Protection ranges. Code that handles Google proxy exits or Probabilistic Reveal Tokens can stay dormant; the feature is retired.
• Expect first-party traffic to be unchanged. A site visited directly always saw the real IP, before and after the retirement.
• Read the masked domain list as a map of tracking. Its 4,335 rows, 223 of them owned by Google, show which third parties Chrome treated as cross-site trackers.
• Pick a tool that can be targeted when location matters. IP Protection assigned an area; checking content as a home user in a chosen city needs a residential proxy with city targeting.

Read the full guide on proxymint, with the commands, tables and sources.