---
title: GPP and the IAB Multi-State Privacy Agreement (MSPA)
description: The IAB Multi-State Privacy Agreement (MSPA) helps advertisers, publishers, agencies, and ad tech intermediaries comply with privacy laws in California, Virginia, Colorado, Connecticut, and Utah, effe
---

[Skip to content](https://support.didomi.io/gpp-and-the-iab-multi-state-privacy-agreement-mspa#main-content)

- [English](https://support.didomi.io/gpp-and-the-iab-multi-state-privacy-agreement-mspa)
- [Français](https://support.didomi.io/fr/gpp-et-le-multi-state-privacy-agreement-mspa-de-liab)

English

Show submenu for translations

[Customer portal](https://support.didomi.io/tickets-view)

![Didomi SAS](https://support.didomi.io/hs-fs/hubfs/Didomi-tail-name.png?width=182&height=34&name=Didomi-tail-name.png)

Open main navigation

Close main navigation

- - [English](https://support.didomi.io/gpp-and-the-iab-multi-state-privacy-agreement-mspa)
    - [Français](https://support.didomi.io/fr/gpp-et-le-multi-state-privacy-agreement-mspa-de-liab)
  
  
  
  
  
  
  English
  
  Show submenu for translations
- [Customer portal](https://support.didomi.io/tickets-view)
- Go to didomi.io

 Go to didomi.io

 Our documentation has moved to docs.didomi.io. Please update any bookmarks.

- There are no suggestions because the search field is empty.

1. [Help Center](https://support.didomi.io/)
2. [Consent notice creation](https://support.didomi.io/consent-notice-creation)
3. [IAB GPP Framework](https://support.didomi.io/consent-notice-creation#iab-gpp-framework)

# GPP and the IAB Multi-State Privacy Agreement (MSPA)

#### Overview of the IAB Multi-State Privacy Agreement (MSPA)

The IAB Multi-State Privacy Agreement (MSPA) helps advertisers, publishers, agencies, and ad tech intermediaries comply with privacy laws in California, Virginia, Colorado, Connecticut, and Utah, effective from 2023. The MSPA establishes privacy-protective terms among signatories, ensuring compliance as data flows through the digital ad ecosystem.

As an MSPA Signatory, you must configure the **mode**, **approach options**, and the **US National String**.

#### Service Provider Mode vs. Opt-Out Option Mode

### Service Provider Mode

In Service Provider Mode, you must meet the following (non-exhaustive) requirements:

### California (CPRA)

- **Choice Mechanisms**: Display opt-out options for "Share" and/or "Sale" on the homepage, data collection pages, app settings, and in the privacy policy.
- **Global Opt-Out**: Honor global opt-out requests and disclose this compliance in the privacy policy.
- **Consent for Other Purposes**: Obtain user consent before using personal data for unrelated purposes, as required by CPRA guidelines.

### Other States

- **Choice Mechanisms**: Provide opt-out options for "Targeted Advertising" and/or "Sale" on key pages and in the privacy policy.
- **Global Opt-Out**: Comply with global opt-out requirements starting July 1, 2024 (Colorado), and January 1, 2025 (Connecticut). Update the privacy policy accordingly.

### US National Consumers

- **Choice Mechanisms**: Offer opt-out options consistent with state laws as outlined above.

For the complete list of requirements, see the [IAB Multi-State Privacy Agreement (MSPA)](https://www.iabprivacy.com/#).

### Opt-Out Option Mode

In Opt-Out Option Mode, you must meet the following (non-exhaustive) requirements:

### California (CPRA)

- **Consumer Notice**: Provide notice per California Civil Code § 1798.100(a), detailing the types of personal information collected.
- **Additional Notice Obligations**: Fulfill all notice requirements, ensuring compliance with scope and delivery. Limit data collection to the scope described in the notice.

### Other States

- **Consumer Notice**: Ensure compliance with state-specific privacy laws, such as those in Colorado, Virginia, and Utah.

### US National Consumers

- **National Approach**: Provide notices that meet the requirements of each state’s privacy laws, treating U.S. national consumers as residents of applicable states.

When Opt-Out Option Mode is enabled, additional fields in the GPP String become relevant based on purpose mappings (e.g., `SaleOptOut`). If a notice is displayed, fields like `SaleOptOutNotice` are set to `1` (Yes, notice provided) in the GPP string; if no notice is displayed, they are set to `2` (No, notice not provided).

#### State vs. US National Approach

As an MSPA Signatory, you can choose between a **State Approach** or a **US National Approach**:

- **State Approach**: Uses state-specific strings when available and supported by GPP; defaults to the US National String otherwise.
- **US National Approach**: Uses the US National String across all U.S. states.

When using the State Approach, newly supported states will include the US National String by default after the next notice deployment.

### Configuring the String

To define a per-state approach:

1. Go to **Didomi Console → Consent Notices**.
2. Open your consent notice.
3. Navigate to the **Integrations** section under the **Customization** tab.
4. Select the **Advertising** tab.
5. Click **Configure String**.
6. Select the state to configure.
7. Choose the approach: 
     - **Generate national string across the United States**: Creates a US National String for this state.
     - **Generate national string only if the state string is not supported**: Generates a state-specific string for this state.

 

Define the string per state, especially if external systems rely on integrations.

![string-approach-gpp](https://support.didomi.io/hs-fs/hubfs/string-approach-gpp.gif?width=600&height=338&name=string-approach-gpp.gif)

#### US National String

The US National String provides a unified string across the United States.

### US National String Fields

### Based on User Status

- **SharingNotice**
- **SaleOptOutNotice**
- **SharingOptOutNotice**
- **TargetedAdvertisingOptOutNotice**
- **SensitiveDataProcessingOptOutNotice**
- **SensitiveDataLimitUseNotice**
- **SaleOptOut**
- **SharingOptOut**
- **TargetedAdvertisingOptOut**
- **SensitiveDataProcessing** (1–12): Covers racial/ethnic origin, religious/philosophical beliefs, health, sexual orientation, citizenship, genetic data, biometric data, precise geolocation, social security numbers, financial account credentials, union membership, and specific communications data.
- **KnownChildSensitiveDataConsents**
- **PersonalDataConsents**

### Other Fields

- **Version**: Indicates string encoding version (managed by Didomi).

For step-by-step guidance, see [Configure GPP fields based on user consent](https://support.didomi.io/configure-gpp-fields-based-on-user-consent).

- [Consent notice creation](https://support.didomi.io/consent-notice-creation#main-content)
  
  
  
  
  
    - [Basics](https://support.didomi.io/consent-notice-creation#basics)
    - [Consent notice per device](https://support.didomi.io/consent-notice-creation#consent-notice-per-device)
    - [Manage Vendors and Purposes](https://support.didomi.io/consent-notice-creation#manage-vendors-and-purposes)
    - [Customization](https://support.didomi.io/consent-notice-creation#customization)
    - [Multi-regulations](https://support.didomi.io/consent-notice-creation#multi-regulations)
    - [Frameworks](https://support.didomi.io/consent-notice-creation#frameworks)
    - [Integrations](https://support.didomi.io/consent-notice-creation#integrations)
    - [Console migration](https://support.didomi.io/consent-notice-creation#console-migration)
    - [IAB GPP Framework](https://support.didomi.io/consent-notice-creation#iab-gpp-framework)
    - [Accessibility](https://support.didomi.io/consent-notice-creation#accessibility)
- [Compliance report](https://support.didomi.io/compliance-report#main-content)
  
  
  
  
  
    - [CMP Vendor Sync](https://support.didomi.io/compliance-report#cmp-vendor-sync)
    - [Advanced Compliance Monitoring](https://support.didomi.io/compliance-report#advanced-compliance-monitoring)
- [Preference Management Platform](https://support.didomi.io/preference-management-platform#main-content)
  
  
  
  
  
    - [Configuration Tree](https://support.didomi.io/preference-management-platform#configuration-tree)
    - [Widget](https://support.didomi.io/preference-management-platform#widget)
    - [Deployment](https://support.didomi.io/preference-management-platform#deployment)
- [Google integrations](https://support.didomi.io/google-integrations)
- [Privacy Request](https://support.didomi.io/privacy-request#main-content)
  
  
  
  
  
    - [User Requests](https://support.didomi.io/privacy-request#user-requests)
    - [Widgets](https://support.didomi.io/privacy-request#widgets)
- [IAB TCF](https://support.didomi.io/iab-tcf#main-content)
  
  
  
  
  
    - [Google & TCF](https://support.didomi.io/iab-tcf#google-tcf)
    - [TCFv2 Presentation](https://support.didomi.io/iab-tcf#tcfv2-presentation)
    - [TCF v2.2](https://support.didomi.io/iab-tcf#tcf-v2-2)
- [Analytics](https://support.didomi.io/analytics#main-content)
  
  
  
  
  
    - [Consent Management Platform (CMP) Analytics](https://support.didomi.io/analytics#consent-management-platform-cmp-analytics)
    - [Preference Management Platform (PMP) Analytics](https://support.didomi.io/analytics#preference-management-platform-pmp-analytics)
    - [ACM (Advance Compliance Monitoring)](https://support.didomi.io/analytics#acm-advance-compliance-monitoring)
- [Integrations](https://support.didomi.io/integrations#main-content)
  
  
  
  
  
    - [AB testing](https://support.didomi.io/integrations#ab-testing)
    - [Paywalls](https://support.didomi.io/integrations#paywalls)
    - [CMS](https://support.didomi.io/integrations#cms)
    - [Generic integrations](https://support.didomi.io/integrations#generic-integrations)
    - [Marketing automation](https://support.didomi.io/integrations#marketing-automation)
    - [Customer Data Platform (CDP)](https://support.didomi.io/integrations#customer-data-platform-cdp)
    - [CRM](https://support.didomi.io/integrations#crm)
- [Lexicon](https://support.didomi.io/lexicon)
- [Legal Requirements](https://support.didomi.io/legal-requirements#main-content)
  
  
  
  
  
    - [Didomi SDK compliance](https://support.didomi.io/legal-requirements#didomi-sdk-compliance)
- [Privacy Center and Data Processing](https://support.didomi.io/privacy-center-and-data-processing)
- [FAQ](https://support.didomi.io/faq#main-content)
  
  
  
  
  
    - [CMP / Managing tags](https://support.didomi.io/faq#cmp-managing-tags)
    - [CMP / Data Privacy for publishers](https://support.didomi.io/faq#cmp-data-privacy-for-publishers)
    - [CMP / Implementing a consent notice](https://support.didomi.io/faq#cmp-implementing-a-consent-notice)
    - [Debugging](https://support.didomi.io/faq#debugging)
    - [CMP / CPRA](https://support.didomi.io/faq#cmp-cpra)
    - [CMP / Analytics](https://support.didomi.io/faq#cmp-analytics)
    - [PMP](https://support.didomi.io/faq#pmp)
    - [Share consent](https://support.didomi.io/faq#share-consent)
    - [Customization](https://support.didomi.io/faq#customization)
    - [Cookies](https://support.didomi.io/faq#cookies)
    - [IAB](https://support.didomi.io/faq#iab)
- [Versions & Proofs](https://support.didomi.io/versions-proofs)
- [Login & Security](https://support.didomi.io/login-security#main-content)
  
  
  
  
  
    - [SSO](https://support.didomi.io/login-security#sso)
    - [Users, Teams and Permissions](https://support.didomi.io/login-security#users-teams-and-permissions)
- [Privacy Hub widget](https://support.didomi.io/privacy-hub-widget)
- [Consent Notices (old flow)](https://support.didomi.io/consent-notices-old-flow)
- [Consent Notices (NEW FLOW)](https://support.didomi.io/consent-notices-new-flow)
- [Customer Portal - Tickets](https://support.didomi.io/customer-portal-tickets)
- [Organization settings](https://support.didomi.io/organization-settings)
- [SDK version control](https://support.didomi.io/sdk-version-control)

Didomi, verb in ancient greek (δ‌‌ιδο‌μι): consent.

Copyright © 2026, Didomi SAS

Cookies