IAB Tech Lab Overhauls Privacy Signals as State Law Complexity Reaches Breaking Point
The Development
IAB Tech Lab released proposed revisions to its Global Privacy Protocol and finalized Data Deletion Request Framework Version 2.0 on August 11, 2026. The GPP update aligns the protocol with the Fifth Amended and Restated Multi-State Privacy Agreement, removing state-by-state MSPA signal support, eliminating Service Provider and Opt-Out Option Modes, removing secondary usage consents, and consolidating notice and choice fields. The DDRF Version 2.0 finalizes a standardized JSON Web Token format for deletion requests, improves status reporting on completed deletions, strengthens framework integrity, and allows implementation-specific extensions. GPP proposed changes are open for public comment through September 11, 2026. DDRF Version 2.0 is finalized and ready for implementation now.
Our Take
This is a rationalization forced by an unsustainable situation. The proliferation of state privacy laws created a combinatorial problem for any organization operating a multi-party data supply chain — each new law added permutations that custom integrations could not scale to handle. IAB Tech Lab is acknowledging that the state-by-state architecture was a temporary fix that has now collapsed under its own weight. The consolidation is the right move, but it creates a discrete retrofit obligation: any implementation built around state-specific MSPA fields or the deprecated modes now requires remediation before final GPP specs are published. Organizations that treat the September 11 comment window as optional are forfeiting the ability to shape the final specification that will govern their data supply chain.
What Changed
Adtech stacks can now transmit privacy permissions and deletion requests through a single consolidated signal layer rather than maintaining parallel state-specific implementations. The complexity of accommodating divergent state privacy laws gets absorbed at the standards layer, not inside each organization's infrastructure.
Marketing Impact
Marketing operations and adtech infrastructure teams face an immediate audit requirement. Consent management platforms, data clean rooms, and downstream vendor integrations built on state-specific GPP fields need gap assessments before the final GPP spec locks. DDRF Version 2.0 also demands a deletion-workflow review across vendor contracts.
Competitive Implication
Organizations with modular, standards-aligned consent infrastructure absorb the transition at low cost and move faster when final specs publish. Organizations running bespoke or heavily customized GPP implementations face disproportionate retrofit costs and compliance exposure during the transition period.
Strategic Outlook
After the September 11 comment window closes, IAB Tech Lab will incorporate feedback and finalize GPP. Organizations that submitted comments will have earlier visibility into the final field structure, shortening their implementation lead time. Expect consent management platform vendors to release Version 2.0 migration tooling in Q4 2026.
The Exploit
Action Item
Adtech and martech legal operations leads should submit formal comments to IAB Tech Lab's Global Privacy Working Group before September 11 — organizations that engage here get advance sight of the final field structure and compress their post-publication implementation timeline.
Source
MarTech
IAB Tech Lab releases new privacy standards
Additional Sources
↗ MarTech: MarTech