1:11
Privacy and identity, 2026 edition

Ep 4: US privacy: GPP replaced the US Privacy string

1:11 · November 11, 2026

Myth. The old US privacy string still covers America.

Lesson notes

Myth. The old US privacy string still covers America.

Its replacement is GPP, the Global Privacy Protocol. One string that carries many privacy laws.

The old string looked like one, Y, Y, N. Version one, notice given, opted out of sale, plus one more flag. It spoke for one law, California’s, and IAB Tech Lab deprecated it on January thirty first, twenty twenty four. Newer state laws add opt-outs for sharing and targeted ads. GPP carries a header, then numbered sections. Seven is the US national section, eight is California, ten is Colorado. Say a reader in Denver opts out of targeted ads on game.example. The CMP writes the string, Prebid sends it with the section numbers that apply, and buyers stop targeting her.

Today, check that your CMP writes GPP for US visitors, and that your Prebid build includes the GPP consent module.

Next… GPC, the browser’s own opt-out signal.

Go deeper · 4 min readThe Impact of GDPR and CCPA on Ad Targeting

Up next in this series