IAB Tech Lab updates Global Privacy Protocol for MSPA compliance

The shift toward a unified Multi-State Privacy Agreement (MSPA) signaling framework reduces the fragmentation that has plagued the U.S. streaming and digital advertising markets as state-level regulations proliferated. By eliminating legacy Service Provider and Opt-Out modes, IAB Tech Lab is forcing a technical consolidation that helps publishers and ad tech providers prove compliance through auditable JSON Web Tokens rather than patchwork manual logic. For the streaming ecosystem, this creates a more predictable environment for cross-platform data handling, though it requires immediate updates to engineering roadmaps for all MSPA signatories. Watch for initial feedback from major supply-side platforms (SSPs) following the September 11 comment deadline to gauge adoption hurdles.

The updates to the Global Privacy Protocol (GPP) arrive as the number of U.S. states with comprehensive privacy laws has surpassed 20, creating significant technical debt for streaming platforms and ad tech providers. Per IAB Tech Lab's 2026 roadmap, the industry is shifting from a reactive posture toward standardized signaling to manage the erosion of traditional browser identifiers. The GPP, formerly known as the Global Privacy Platform, was renamed in early 2025 to emphasize its role as a technical encoding standard rather than a standalone database, working alongside Consent Management Platforms (CMPs) to propagate user preferences downstream. Relatedly, the Multi-State Privacy Agreement (MSPA) functions as a 'springing contract' that creates binding legal obligations between signatories, distinct from the technical signaling provided by the GPP. According to Usercentrics reporting from early 2026, the contractual framework of the MSPA is designed to fill gaps in commercial agreements, ensuring privacy terms follow personal information as it flows through the programmatic supply chain. The Fifth Amended MSPA, which these protocol updates now support, became effective in June 2026, marking a pivot away from the initial fragmented state string approach used during the rollout of laws in California and Colorado. Industry participation in these standards has expanded beyond traditional web publishers to include major Connected TV (CTV) players. According to IAB Tech Lab announcements from June 2024, early contributors to the Data Deletion Request Framework included Roku, Google, and Index Exchange. The finalization of Version 2.0 reflects two years of implementation experience, focusing on troubleshooting deletion results and strengthening the integrity of cryptographic signatures used to authenticate requests. This focus on auditable deletion is increasingly critical as regulators move toward enforcement actions focused on data minimization and 'Right to Delete' fulfillment.