Privacy & regulation · also called GPP, Global Privacy Platform
IAB Global Privacy Platform (GPP)
The IAB Global Privacy Platform (GPP) is an IAB Tech Lab standard that packages privacy and consent signals for many jurisdictions, like US states and the EU, into one string.
Different privacy laws require different signals: consent in Europe, opt-outs of sale and sharing in California, other variations in Virginia, Colorado and elsewhere. Before GPP, each had its own format, such as the EU IAB TCF string and the older US Privacy String. The Global Privacy Platform, launched by IAB Tech Lab in 2022, gives them one container.
A GPP string has a header listing which sections it contains, then an encoded section for each relevant framework, for example the EU TCF, Canada's TCF, a US national section and individual US state sections. CMPs generate the string, and ad tech passes it in bid requests through OpenRTB fields alongside an indicator of which sections apply.
GPP matters most in the US, where a patchwork of state laws makes signalling complex. It also carries opt-out preference signals such as Global Privacy Control once they are captured. As with any signal, it only protects users if downstream vendors actually read and respect it, which is increasingly part of regulators' enforcement.
Think of it like this
GPP is like a multi-country travel adaptor: one plug that holds the right pin shape for each country's socket.
An example
A publisher with readers in California, Texas and France uses one CMP that writes a GPP string containing US state and EU TCF sections, and its SSP passes it to every bidder.
Related terms
IAB TCF (Transparency & Consent Framework)
The IAB TCF (Transparency & Consent Framework) is IAB Europe's standard for collecting users' GDPR consent and objections through CMPs and passing those choices to ad tech vendors in a consent string.
CCPA / CPRA
The CCPA, as amended by the CPRA, is California's consumer privacy law giving residents rights to know, delete, correct and opt out of the sale or sharing of their personal information.
CMP (consent management platform)
A CMP (consent management platform) is software that shows users privacy choices, such as a cookie banner, records their consent or opt-outs, and passes them to the site's partners.
Consent string
A consent string is a compact encoded value recording a user's privacy choices, such as the TCF TC String or a GPP string, that travels with ad requests to vendors.
Global Privacy Control (GPC)
Global Privacy Control (GPC) is a browser or extension setting that automatically tells every website a user visits that they do not want their personal data sold or shared.
Sources: IAB Tech Lab Global Privacy Platform, IAB Tech Lab OpenRTB