IAB Tech Lab Rewrites Privacy Signal Standards as Multi-State Compliance Complexity Grows
The Development
IAB Tech Lab released proposed updates to its Global Privacy Protocol on August 11, 2026, alongside the finalised Data Deletion Request Framework Version 2.0, with a public comment period open until September 11, 2026. The GPP updates are structurally significant: they remove the previous state-by-state MSPA coverage model, eliminate Service Provider and Opt-Out Option Modes, strip out secondary usage consents, and simplify notice and choice fields to align with the Fifth Amended and Restated Multi-State Privacy Agreement. DDRF 2.0, finalised after a comment period that opened in late 2025, clarifies JWT definitions for identity and deletion requests, improves error feedback, and supports implementation-specific extensions. Both updates were developed through IAB Tech Lab's Global Privacy Working Group and Privacy Rearc Commit Group.
Our Take
This is a forced rationalisation of consent infrastructure that the industry has needed since multi-state privacy law proliferation made the original GPP framework unworkable at scale. The elimination of state-by-state modes is not a simplification for its own sake — it reflects that the MSPA signatories have consolidated their legal position and the technical layer must follow. What matters for marketing leaders is the implementation deadline pressure this creates. Once the comment period closes and the standard is finalised, CMPs, DSPs, and publisher ad servers that have not migrated to the new architecture will be out of conformance. The DDRF 2.0 finalisation is equally consequential: regulators have been asking questions about deletion request mechanics, and this framework now provides the documented technical response that legal teams have been asking compliance vendors to produce.
What Changed
Organisations can now implement a single, consolidated consent and deletion signal architecture rather than maintaining parallel state-specific consent logic. The removal of Service Provider and Opt-Out Option Modes collapses the decision tree that ad tech vendors and publishers have had to manage separately per jurisdiction.
Marketing Impact
Marketing operations and martech teams face an immediate audit requirement across their consent management platform configurations. Any publisher or advertiser running MSPA-aligned consent flows through a CMP must verify that their vendor is updating to the revised GPP specification before finalisation — non-conformant signals will create legal exposure, not just technical debt.
Competitive Implication
Ad tech vendors and CMPs that ship GPP updates before the comment period closes gain a sales advantage with compliance-anxious enterprise buyers in Q4 2026. Publishers and advertisers relying on vendors slow to update face signal breakage that degrades addressable inventory and risks regulatory scrutiny precisely when Q4 spend is peaking.
Strategic Outlook
Expect CMP vendors to announce GPP compatibility updates within weeks of the September 11 close. DSPs will follow, with MSPA signal validation logic requiring updates across bid request parsing. The consolidation of consent modes will reduce friction in programmatic signal passing but will also compress the differentiation between CMP providers, accelerating vendor consolidation.
The Exploit
Action Item
Heads of marketing operations should formally request a GPP migration timeline from their CMP vendor before September 11, using the comment deadline as contractual leverage to ensure Q4 campaign infrastructure is conformant before peak spend begins.