IAB MSPA

IAB Multi-State Privacy Agreement signal — encode/decode opt-out preferences for state privacy laws (CCPA, CPA, etc.).

The IAB Global Privacy Platform (GPP) is the successor to the patchwork of per-state US privacy strings. A GPP string carries multiple sections separated by ~, each tagged with a section ID. The MSPA-relevant sections cover the US national + state regimes (USNAT, USCA, USVA, USCO, USCT, USUT, plus 2025-26 additions) and carry sale / sharing / targeted-ads / sensitive-data / child-data opt-out flags alongside the W3C Sec-GPC browser-signal mirror.

The framework ships a partial-correct decoder (the binary tag layout is operator-side via the IAB's gpp-cmp libraries), an opt-out evaluator that returns mustHonor across in-scope sections, a throw-on-must-honor refusal helper, and a header reader for the Sec-GPC: 1 universal opt-out signal.

b.iabMspa.parseGpp(gppString) #

Parse the framing of a GPP string into { header, sections }. The decoder splits on ~, identifies each section by its positional claim in the header's section-ID list, and exposes the per-section raw payloads. The framework deliberately does not decode the binary section layout — operator-side libraries (@iabtechlab/gpp-cmp) own that surface and populate section.optOuts. Throws on missing input or strings exceeding the 8192-char defensive cap.

var parsed = b.iabMspa.parseGpp("DBABBg.7.8");
parsed.header.sectionIds;     // → [7, 8]
parsed.sections.length;       // → 0  (no payload segments yet)

b.iabMspa.checkOptOut(parsed, opts) #

{
  dataUse: "sale" | "sharing" | "targeted-ads" | "sensitive" | "child-data",
  state:   string,                       // optional GPP section label
}

Walk the parsed GPP sections and return { mustHonor, signals } for the requested data-use category. mustHonor is true when ANY in-scope section signals an opt-out for that use; signals lists the section labels that produced the verdict. Operators narrow the search to a specific state by passing opts.state. Sections whose optOuts field hasn't been populated by an operator-side decoder are skipped (no false positives from missing data).

var parsed = {
  header: { sectionIds: [8] },
  sections: [
    { id: 8, idLabel: "usca", raw: "",
      optOuts: { sale: true, sharing: false, targetedAds: true } },
  ],
};
var verdict = b.iabMspa.checkOptOut(parsed, { dataUse: "sale" });
verdict.mustHonor;   // → true
verdict.signals;     // → ["usca"]

b.iabMspa.refuseProcessing(parsed, opts) #

{
  dataUse: "sale" | "sharing" | "targeted-ads" | "sensitive" | "child-data",
  state:   string,                       // optional GPP section label
}

Throw IabMspaError when checkOptOut returns mustHonor:true — wires the framework's opt-out signal into the operator's data-flow code at the same point a CCPA do-not-sell header would halt processing. Audits the refusal under iabmspa.processing_refused before throwing. Returns the verdict object on the no-opt-out path so the caller can inspect signals.

var parsed = { header: { sectionIds: [] }, sections: [] };
var verdict = b.iabMspa.refuseProcessing(parsed, { dataUse: "sale" });
verdict.mustHonor;   // → false  (no signals → no throw)

b.iabMspa.gpcFromHeaders(req) #

Read the W3C Sec-GPC: 1 browser header from an inbound request. Returns true when the user's browser is asserting the universal opt-out signal (mandatory under California CCPA / CPRA §1798.135(b)(1) and Colorado, Connecticut, etc.). Defensive against missing req/headers shapes — never throws.

var req = { headers: { "sec-gpc": "1" } };
b.iabMspa.gpcFromHeaders(req);              // → true
b.iabMspa.gpcFromHeaders({ headers: {} });  // → false
b.iabMspa.gpcFromHeaders(null);             // → false

Last updated 2026-08-08T16:39:49.652Z by seeder.