1. Extreme Reach
  2. Advertising Campaign Management & Distribution
  3. TV, Cinema & Digital
  4. Digital Video Adserving
  5. General

IAB’s Multi-State Privacy Agreement (MSPA) & Global Privacy Platform (GPP)

Updated

Privacy compliance has become a hot topic across the ad tech industry, especially as several new US state privacy laws go into effect during 2023.

Certain states now require contracts to be in place for any interaction that is considered a “sale” of personal information, and that term is being very loosely defined by some states.
IAB Solution: Multi-State Privacy Agreement (MSPA) 		 

In addition, to support the growing number of privacy laws the industry needed a uniform way to honor and transmit a user’s privacy choices throughout the ad ecosystem.
IAB Solution: Global Privacy Platform (GPP)

What is the MSPA?
The IAB’s Multi-State Privacy Agreement (MSPA) provides a contractual framework for “sales” of personal information, by putting in place a set of privacy-protective terms among all signatories of the agreement. The contractual framework of terms applies as data flows through the digital ad supply chain. XR is a signatory of the MSPA, and for the MSPA to work effectively the IAB encourages all publishers, advertisers, and ad tech vendors to do the same.


What is the GPP?
In response to the growing number of international and US state privacy signals, the IAB Tech Lab developed the Global Privacy Platform (GPP). The GPP enables companies to use a consent management platform (CMP) to capture a user’s privacy signals, which is then turned into a privacy string, similar to a GDPR consent string, which can be passed to downstream supply chain partners. The GPP also supports the use of the Global Privacy Control (GPC) signal, and allows privacy consent to be passed via OpenRTB real-time bidding. Tags that support the GPP will include a GPP parameter/macro placeholder, similar to what is currently used for GDPR. The GPP privacy parameter supports both new and existing consent strings, including IAB Europe TCF v2, IAB Canada TCF, US Privacy (will be deprecated soon), US state-specific privacy strings for California, Virginia, Utah, Colorado, and Connecticut, and a US national string. To
encourage adoption, the GPP is the only IAB platform that will accommodate multi-state privacy consent signaling.

 

Main Takeaways

The MSPA was developed to support contractual requirements now required by new US state legislation.

The GPP was developed to simplify the transmission of privacy signals downstream.

To stay privacy complaint in 2023, the IAB encourages all relevant parties to become signatories of the MSPA, and to support usage of the GPP - as this will be the only platform to accommodate US privacy law consent
signaling. 

Items in this section