GPP

The Global Privacy Protocol (GPP) is an IAB Tech Lab specification for one string that carries a user's privacy and consent choices for several jurisdictions, such as the EU and US states.

Before GPP, each regime had its own signal: the TC String for the EU, the US Privacy String for California, and others. GPP wraps them in one container. A GPP string starts with a header that lists which sections are present, followed by each section, separated by a tilde (~) (IAB Tech Lab, GPP consent string specification). Version 1 was published as final on 28 September 2022 and clarified on 3 November 2023, according to the same document.

IAB Tech Lab has since renamed the Global Privacy Platform the Global Privacy Protocol, keeping the abbreviation. GPP supports the IAB Europe TCF, the IAB Canada TCF, the MSPA US National section and a set of US state sections. An update for the latest Multi-State Privacy Agreement (MSPA) was in public comment until 11 September 2026 (IAB Tech Lab, accessed 9 November 2026).

In OpenRTB 2.6 the string travels in regs.gpp, and regs.gpp_sid lists the sections that apply to the transaction (IAB Tech Lab, OpenRTB 2.6, section 3.2.3). Each vendor decodes the sections it needs and ignores the rest.

Example: The specification's own example, DBACNY~CPXxRfAPXxRfAAfKABENB-CgAAAAAAAAAAYgAAAAAAAA~1YNN, holds a header (DBACNY), an EU TCF v2 section and a US Privacy section (1YNN).

Related terms: US Privacy String, TCF, consent string, CMP, consent mode.

Authoritative source: IAB Tech Lab, Global Privacy Protocol, "Consent String Specification", version 1 (final 28 September 2022, clarified 3 November 2023).

Read the full guide: GPP consent string decoder.