Glossary
US Privacy String
Published · Last updated
Next scheduled review:
The US Privacy String is a deprecated four-character IAB Tech Lab signal for the California Consumer Privacy Act (CCPA) that tells partners whether notice was given and whether the user opted out of sale.
The specification became final in November 2019 and was clarified in March 2020 (IAB Tech Lab, US Privacy String specification). Each character has a fixed meaning. The first is the version, 1. The second says whether notice and the chance to opt out were given (Y, N or -).
The third says whether the user opted out of sale: only Y or N when the CCPA applies. The fourth says whether the publisher signed the IAB Limited Service Provider Agreement (LSPA) and treats the transaction as covered. A property can signal that the CCPA does not apply with 1---.
The publisher creates the string and sends it with each impression; in OpenRTB 2.6 it travels in regs.us_privacy. The signal covered only California, while other states passed their own laws. IAB Tech Lab deprecated the US Privacy signal as of 31 January 2024 and advises users to move to the Global Privacy Protocol (same source). A GPP string can still carry a US Privacy section.
Example: 1YNN means version 1, notice given, the user has not opted out of sale, and the transaction is not LSPA-covered. 1YYN means the user has opted out, so vendors that receive it should treat the data as not for sale.
Related terms: GPP, consent string, CMP, TCF, consent mode.