The GPP standard is designed to be extensible so that support for new regulations can be added without the need to update existing capabilities defined by GPP and the GPP client side API. This document outlines the technical requirements for using the GPP specification with the IAB Privacy Multi-State Privacy Agreement (MSPA) legal requirements.
| Date | Version | Comments |
| December 2022 | 1.0 | Version 1.0 released |
| October 2024 | 2.0 | Version 2.0 – Added support for DE, IN, IA, KY, MD, MI, MT, NH, NE, NJ, OR, RI, TN, TX in accordance with the Second Amended and Restated MSPA. |
The MSPA US National Section string includes the components described below.
Implementers should employ the MSPA US National Privacy Section to adhere to the “National Approach” for their Processing of a Consumer’s Personal Information, as defined in Section 1.81 of the MSPA. The MSPA US National Privacy Section should be used by MSPA Signatories and Certified Partners in connection with a Covered Transaction pursuant to the MSPA. Click here to access the text of the MSPA and to review the Signatory and Certified Partner Identification List.
| Field Type | Value | Description |
| GPP SectionID | 7 | The MSPA US National Section is assigned GPP Section ID 7. |
| Client side API prefix | usnat | The MSPA US National Section is assigned the client side API prefix “usnat” in the GPP Client Side API. |
Note on the JS representation of the section: the field name should be in UpperCamelCase, with exactly the same spelling as the names in column "Field name". Follow this table to map the GPP field types to JavaScript native data types. Please refer to the PingReturn's parsedSections object for an example.
The core segment must always be present. Where terms are capitalized in the ‘description’ field they are defined terms in applicable State Privacy Laws and the MSPA. It consists of the following fields:
|
Field name |
GPP Field Type |
Description |
|---|---|---|
| Version | Int(6) | The version of this section specification used to encode the string. |
| SharingNotice | Int(2) | Notice Describing Your Processing of Personal Information pursuant to the National Approach as defined in Section 1.81(a) of the MSPA, which incorporates the statutory provisions and regulations set forth below:
0 Not Applicable. The Business does not share Process Personal Informatin.
|
| SaleOptOutNotice | Int(2) | Notice of the Opportunity to Opt Out of the Sale of the Consumer’s Personal Information pursuant to the National Approach as defined in Section 1.81(b) of the MSPA, which incorporates the statutory provisions and regulations set forth below:
0 Not Applicable. The Business does not Sell Personal Information.
|
| SharingOptOutNotice | Int(2) | Notice of the Opportunity to Opt Out of the Sharing of the Consumer’s Personal Information pursuant to the National Approach as defined in Section 1.81(b) of the MSPA, which incorporates the statutory provisions and regulations set forth below: (i) Cal. Civ. Code 1798.100(a)(1), (3), Cal. Civ. Code 1798.135(a), Cal. Civ. Code 1798.135(b), and 11 CCR 7013
|
| TargetedAdvertisingOptOutNotice | Int(2) | Notice of the Opportunity to Opt Out of Processing of the Consumer’s Personal Information for Targeted Advertising pursuant to the National Approach as defined in Section 1.81(b) of the MSPA, which incorporates the statutory provisions and regulations set forth below:
0 Not Applicable. The Business does not Process Personal Information for Targeted Advertising.
|
| SensitiveDataProcessingOptOutNotice | Int(2) | Notice to the Consumer of the Consumer’s right to opt out of the Processing of the Consumer’s Sensitive Personal Information that adheres to the requirements of an optional addendum to the MSPA that IAB may, in the future, promulgate to govern the Processing of Sensitive Personal Information by Signatories and Certified Partners for Digital Advertising Activities pursuant to Section 1.28 of the MSPA, which will incorporate the statutory provisions and regulations set forth below:
Note: A Business adhering to the National Approach must obtain consent from Consumers before processing their sensitive data or sensitive personal information. However, Utah Code 13-61-302(3)(a) and Iowa Code § 715D.4(2) requires a controller to provide a consumer with clear notice of the right to opt out of the controller’s processing of the consumer’s sensitive data prior to any such processing. To adhere to these requirements, Businesses following the National Approach should consider incorporating clear notice of the right to opt out as part the process they use to prompt the user to provide consent, for example, by informing Consumers that if they provide consent, they retain the right to opt out (i.e., withdraw consent) of the Business’s processing of their sensitive data at any time. 0 Not Applicable. The Business does not Process Sensitive Data.
|
| SensitiveDataLimitUseNotice | Int(2) | Link to the Consumer that enables the Consumer, or a person authorized by the Consumer, to limit the Business’s use or disclosure of the Consumer’s Sensitive Personal Information and that adheres to the requirements of an optional addendum to the MSPA that IAB may, in the future, promulgate to govern the Processing of Sensitive Personal Information by Signatories and Certified Partners for Digital Advertising Activities as provided in Section 1.28 of the MSPA, which will incorporate the statutory provisions and regulations set forth below:
0 Not Applicable. The Business does not use or disclose Sensitive Data.
|
| SaleOptOut | Int(2) | Consumer submitted a request to opt out of the Sale of Personal Information, pursuant to the National Approach as defined in Section 1.81(c) of the MSPA, which incorporates Cal. Civ. Code 1798.120(a) and 11 CCR 7026, Virginia Code 59.1-577(A)(5)(i), Colo. Rev. Stat. 6-1-1306(1)(a)(I)(B), Utah Code 13-61-201(4)(b), Conn. Gen. Stat. § 42-518(a), Iowa Code § 715D.3(1)(d), Ind. Code Ann. § 24-15-3-1(b)(5), Tenn. Code Ann. 47-18-3304(a)(2)(E)(i), Tex. Bus. & Com. Code § 541.051(b)(5)(B), Montana Act, Sec. 5(1)(e)(ii), Oregon Act, Sec. 3(1)(d)(B), Del. Code Ann. tit. 6, § 12D-104(a)(6)(b), New Jersey Act, Sec. 7(a)(5), N.H. Rev. Stat. 507-H:4(I)(e), Nebraska Act, Sec. 7(e)(ii), Kentucky Act, Sec. 3(2)(e), Minn. Stat. § 325O.05, Subd. 1(f), Maryland Act 14–4605(B)(7)(II), or Rhode Island Act 6-48.1-5(e)(4) using a Choice Mechanism (Sale) pursuant to the National Approach as defined in Section 1.81(b) of the MSPA, which incorporates the statutory provisions and regulations set forth below:
0 Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
|
| SharingOptOut | Int(2) | Consumer submitted a request to opt-out of the Sharing of the Consumer’s Personal Information pursuant to the National Approach as defined in Section 1.81(c) of the MSPA, which incorporates Cal. Civ. Code 1798.120(a) and 11 CCR 7026, using a Choice Mechanism (Share) pursuant to the National Approach as defined in Section 1.81(b) of the MSPA, which incorporates the statutory provisions and regulations set forth below:
0 Not Applicable. SharingOptOutNotice value was not applicable or no notice was provided.
|
| TargetedAdvertisingOptOut | Int(2) | Consumer submitted a request to opt out of the Processing of Personal Information for Targeted Advertising, pursuant to the National Approach as defined in Section 1.81(c) of the MSPA, which incorporates Virginia Code 59.1-577(A)(5)(i), Colo. Rev. Stat. 6-1-1306(1)(a)(I)(A), Utah Code 13-61-201(4)(a), Conn. Gen. Stat. § 42-518(a), Iowa Code § 715D.4(6), Ind. Code Ann. § 24-15-3-1(b)(5), Tenn. Code Ann. 47-18-3304(a)(2)(E)(ii), Tex. Bus. & Com. Code § 541.055(b)(5)(A), Montana Act, Sec. 5(1)(e)(i), Oregon Act, Sec. 3(1)(d)(A), Del. Code Ann. tit. 6, § 12D-104(a)(6)(a), New Jersey Act, Sec. 7(a)(5), N.H. Rev. Stat. 507-H:4(I)(e), Nebraska Act, Sec. 7(e)(i), Kentucky Act, Sec. 3(2)(e), Minn. Stat. § 325O.05, Subd. 1(f), Maryland Act 14–4605(B)(7)(I), or Rhode Island Act 6-48.1-5(e)(4) using a Choice Mechanism (Targeted Advertising) pursuant to the National Approach as defined in Section 1.81(b) of the MSPA, which incorporates the statutory provisions and regulations set forth below:
0 Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
|
| SensitiveDataProcessing | N-Bitfield(2,16) | For the specific category of Sensitive Personal Information that is identified in the String Component, have you obtained Consent from the Consumer to Process his or her Sensitive Personal Information in a way that adheres to requirements of an optional addendum to the MSPA that IAB may, in the future, promulgate to govern the Processing of Sensitive Personal Information by Signatories and Certified Partners for Digital Advertising Activities as provided in Section 1.28 of the MSPA, which will incorporate the statutory provisions and regulations set forth below? Two bits for each Data Activity: 0 Not Applicable. The Business does not Process the specific category of Sensitive Data.
(1) Consent to Process the Consumer’s Sensitive Personal Information Consisting of Personal Information Revealing Racial or Ethnic Origin. References:
References:
References:
References:
References:
References:
References:
References:
References:
References:
References:
References:
|
| KnownChildSensitiveDataConsents | N-Bitfield(2,3) | Consent from the Consumer to Process his or her Personal Information or Sensitive Personal Information in a way that adheres to requirements of an optional addendum to the MSPA that IAB may, in the future, promulgate to govern the Processing of Minor Information by Signatories and Certified Partners for Digital Advertising Activities as provided in Section 1.28 of the MSPA, which will incorporate the statutory provisions and regulations set forth below.
Two bits for each Data Activity: 0 Not Applicable. The Business does not have actual knowledge that it Processes Personal Data or Sensitive Data of a Consumer who is a known child.
(1) Consent to Process the Consumer’s Personal Information or Sensitive Personal Information for Consumers from Age 13 to 16. References:
References:
References:
|
| PersonalDataConsents | Int(2) | Consumer Consented to the Processing of the Consumer’s Personal Information for Digital Advertising Activities that would, but for providing Consent, not otherwise meet the Secondary Use Limitations. The Secondary Use Limitations, as set forth in the National Approach, incorporate the statutory provisions and regulations set forth below: References:
0 Not Applicable. The Business does not Process the Consumer’s Personal Data for advertising purposes that are not reasonably necessary for nor compatible with the disclosed purpose for which the Consumer’s Personal Data was processed.
|
| MspaCoveredTransaction | Int(2) | Publisher or Advertiser, as applicable, is a signatory to the IAB Multistate Service Provider Agreement (MSPA), as may be amended from time to time, and declares that the transaction is a “Covered Transaction” as defined in the MSPA.
|
| MspaOptOutOptionMode | Int(2) | Publisher or Advertiser, as applicable, has enabled “Opt-Out Option Mode” for the “Covered Transaction,” as such terms are defined in the MSPA.
|
| MspaServiceProviderMode | Int(2) | Publisher or Advertiser, as applicable, has enabled “Service Provider Mode” for the “Covered Transaction,” as such terms are defined in the MSPA.
|
GPC is signaled in user agent headers(Sec-GPC) and a simple javascript API (globalPrivacyControl). Entities creating GPC Subsections should check whether GPC is set and pass along the value from the headers or javascript API in this subsection. Refer to the GPC specifications for details on GPC including how to handle conflicts or inconsistencies.
| Field Name | GPP Field Type | Description |
|---|---|---|
| SubsectionType | Int(2) |
|
| Gpc | Boolean |
|