Guide · Industry standard

GPP explained: one signal for many privacy laws

GPP puts into a single code the privacy choices that each law asks for, from US states to Canada and Europe. Here you will understand how it works, what Google reads and when your site needs it.

Audit my site's GPP Read the guide

✓Based on the IAB Tech Lab specification
✓Includes what Ad Manager accepts and ignores
✓Read-only scan, no changes to the site

2022year version 1.0 of the GPP string was published

20US state sections in the official GPP list

6US sections that Ad Manager reads within the GPP

7number of the US national section, usnat

What it is

A single box for privacy signals

GPP is an IAB Tech Lab protocol, the technical body of the advertising industry. It was born as Global Privacy Platform and now appears on the official site as Global Privacy Protocol. The acronym stays the same.

The idea is simple. Each privacy law asks for different information. California talks about sale and sharing of data. Other states talk about targeted advertising. Europe talks about consent by purpose. GPP stores all of this in a single code, the GPP string, divided into sections.

The site's privacy banner, the CMP, builds this string according to the region and the visitor's choice. Then the ad code sends the string to the platforms, which read only the section that applies to that visitor.

Like the TCF, GPP is not a law. It is a technical tool to carry the visitor's choice to ad partners in a standardized way.

Checklist

What you need to meet

The GPP is not a law, so these points come from US state laws and from what Google asks in order to read the signal.

Show the opt-out link to US visitors
In California, a business that sells personal data needs a clear, visible link called Do Not Sell or Share My Personal Information. Google's state regulations message creates that link.
Example
Footer for US visitors with the Do Not Sell or Share My Personal Information link.
Treat GPC as an opt-out
In California, the Global Privacy Control signal sent by the browser must be respected as a valid request to stop the sale or sharing of data.
Example
When the browser sends the GPC, the CMP records the opt-out in the GPP string without asking for a click.
Make the opt-out change the GPP string
Google turns on restricted data processing when the string shows an opt-out of sale, sharing or targeted advertising. If the click does not change the string, the opt-out does not reach Google.
Use the sections Google reads
In the GPP, Google accepts the US national section and the sections for California, Colorado, Connecticut, Florida and Virginia. It does not accept the Utah section, the Canadian TCF or GPP version 1.0.
Keep the TCF for Europe
For visitors from the EEA, the United Kingdom and Switzerland, Google keeps using the IAB Europe TCF with a certified CMP. The European TC string inside the GPP is not accepted.
Send gpp and gpp_sid in every request
Google receives the string in the gpp parameter and the section numbers in the gpp_sid parameter. Check that header bidding partners also receive both.
Example
In the ad request of a visitor with the national section, the gpp_sid parameter carries the number 7.
7
Without GPP, mark the opt-out in the tag
Google does not require GPP or a CMP for US states. Anyone with their own opt-out link can turn on restricted data processing directly in the Ad Manager tag for people who opted out.
```
googletag.pubads().setPrivacySettings({
  restrictDataProcessing: true
});
```
Replace the US Privacy String with the GPP
The IAB deprecated the US Privacy String in January 2024. Google still reads that signal, but recommends migrating to the GPP.

In practice

Right and wrong

WrongThe site has no opt-out link, or the click does not change the GPP string.
RightUS visitors see a footer link to opt out of sale or sharing.
WrongThe site ignores the GPC and keeps sending the string with no opt-out.
RightThe browser sends the GPC and the CMP records the opt-out immediately.

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US states, so use these official pages to generate the signal and show the opt-out.

Definitions

The terms you will see in the dashboard and in reports

Six concepts explain almost everything that happens with GPP on a site.

GPP string

The complete code, with a header and one or more sections. It is what travels along with ad requests.

Header

The first part of the string. It says which sections come inside it, so that each partner finds the one it needs.

Section

The block of a jurisdiction, such as the US national section or a state's. Each has a number and a short name.

gpp_sid

The list of the numbers of the sections that apply to that request. It goes along with the string so the partner knows which one to read.

__gpp API

The CMP's standard command on the page. Ad scripts ask it whether the string is ready and what its content is.

MSPA

IAB's multi-state agreement for ad transactions in the US. The national section has fields that indicate whether the transaction is covered by it.

The sections

What fits inside a GPP string

The official list of sections is in the IAB Tech Lab repository and grows as new laws take effect.

Europe's TCF (tcfeuv2)

Carries the European TC string inside the GPP. Useful for partners that read everything through GPP, but Google does not accept this path for European visitors.

Canada's TCF (tcfcav1)

Canadian version of the TCF, created by IAB Canada for the country's consent rules.

US Privacy (uspv1)

The old California signal, also called the four-character string. It remains on the list, but was discontinued by the IAB.

US National (usnat)

A section that covers state laws in a unified way. Many CMPs use only it for all states.

State sections

Own blocks for states such as California, Virginia, Colorado, Connecticut, Texas, Oregon and others. The official list has 20.

GPC subsection

The national section can carry the notice that the browser sent Global Privacy Control, the automatic opt-out signal.

Who it applies to

When your site needs GPP, and where it does not help

GPP makes the most difference for sites with US visitors that show programmatic ads. It is through it that platforms learn whether the visitor asked not to have their data sold, shared or used in targeted advertising.

If your audience is almost all Brazilian, GPP has little effect. The LGPD does not use this standard and Google does not ask for GPP for visitors from Brazil. Even so, it is worth setting up the CMP by region so the US audience receives the right signal.

For Europe, GPP does not replace the TCF at Google. Ad Manager does not accept the European TC string sent inside GPP for visitors from the EEA, the UK and Switzerland. In these regions, the certified CMP with TCF remains mandatory for personalized ads.

The laws behind GPP are enforced by the authorities of each country or state, such as US state attorneys general. GPP itself does not impose fines. It is the technical proof that the visitor's choice was carried forward.

Visitor rights

What the US national section records

The usnat section holds two kinds of information. The first is whether the site notified the visitor: sharing notice, sale notice, targeted advertising notice and notices about sensitive data.

The second is what the visitor decided. There are fields for opt-out of the sale of data, opt-out of sharing, opt-out of targeted advertising, use of sensitive data and consent for children's data.

These fields reflect the rights that state laws give people. When a visitor clicks Do Not Sell or Share My Information, the CMP changes the corresponding field and all partners receive the opt-out on the next ad request.

The section also indicates whether the transaction is covered by the MSPA agreement and may carry the value of the Global Privacy Control sent by the browser.

How to implement

Five steps to make GPP work on the site

Choose a CMP with GPP supportMost commercial CMPs and Google's Privacy message offer options for US states. Check which sections your CMP generates.
Set the regionsShow the message and generate the US section for visitors from there. For Europe, keep the TCF itself. For the rest of the world, follow local law.
Add the opt-out linkLaws such as California's ask for a visible link so the visitor can opt out of sale or sharing. It must update the GPP string right away.
Pass the string to partnersGoogle's tag reads the string through the CMP API. In header bidding and extra networks, confirm that the string and the gpp_sid go along with each request.
Test with and without an opt-outOpen the site as a US visitor, opt out of sale and see whether the string changes and whether ad requests now carry the opt-out.

Quick test in the browser console with the standard GPP API

// Pergunta à CMP se a GPP string está pronta
__gpp('ping', function (data, ok) {
  if (!ok) return;
  console.log('status:', data.signalStatus);         // 'ready' ou 'not ready'
  console.log('seções:', data.applicableSections);   // ex.: [7]
  console.log('string:', data.gppString);
});

AdSense and Ad Manager

How Google reads GPP

Ad Manager receives the string in two ad request parameters: gpp, with the string, and gpp_sid, with the section numbers. Google's tag handles this when the CMP exposes the standard API.

Within GPP, Ad Manager accepts the US national section and the sections for California, Colorado, Connecticut, Florida and Virginia. It does not use GPP for the European TCF, the Canadian TCF and the Utah section.

When the string shows an opt-out, Google turns on restricted data processing. In the national section, this happens with an opt-out of sale, sharing or targeted advertising. The ad is still shown, but without personalization based on that visitor's data.

Google does not require the publisher to sign the MSPA. Ad Manager takes part in the MSPA certified partners program. Since September 2025, Google accepts the second version of the national section and keeps accepting the first.

Timeline

How GPP got here

The standard is updated whenever new state laws take effect.

September 28, 2022
Version 1.0 published
The IAB Tech Lab publishes the final GPP string specification and the first version of the CMP API.
December 2022
The US national section is born
The usnat section is launched to gather state laws in a single block.
June 2023
CMP API version 1.1
The API starts responding through callback functions, and some old commands are removed.
January 2024
US Privacy String discontinued
The IAB discontinues the old California signal. Google keeps reading that signal, but the recommended path becomes GPP.
September 2025
Google accepts national section v2
Ad Manager starts reading the second version of the national section, while still accepting the first.
Late 2025
New states
The Maryland, Indiana, Kentucky and Rhode Island sections are finalized after public consultation.
August 2026
Update for the new MSPA
The specification is updated to the latest version of the multi-state agreement.

Common errors

What most often breaks GPP on sites

Almost all go unnoticed, because the banner keeps appearing normally.

Opt-out link that changes nothing

The visitor clicks do not sell, but the GPP string stays the same. For the partners, the opt-out never happened.

European TCF only inside GPP

The CMP sends the TC string only through GPP. Google does not accept this path for the EEA, the UK and Switzerland, and ads become limited.

Wrong or empty gpp_sid

The string arrives, but the list of sections does not match the content. The partner does not know which block to read.

Ads before the string

The ad code fires before the CMP is ready. The first requests go out with no privacy signal.

Header bidding without GPP

Google's tag receives the string, but the header bidding partners do not. Part of the auction ignores the visitor's opt-out.

GPC ignored

The browser sends Global Privacy Control, but the CMP does not record the opt-out. In several states, this is treated as a valid opt-out.

In practice

What is and is not allowed with GPP

Practical examples for those with traffic from the United States and other countries.

Allowed

Using only the US national section, if the CMP and partners accept it
Generating the string only for US visitors and keeping the TCF for Europe
Showing a permanent Do Not Sell or Share link in the footer
Recording the browser's GPC as an opt-out in the string
Checking in the console that the string changes after the opt-out

Not allowed

Using GPP in place of the certified CMP with TCF for Europe
Letting the opt-out link open only an email form
Sending sections for states that do not match the visitor
Loading ads before the CMP responds
Keeping only the old US Privacy String without planning the switch

In ConsentMode

What the audit checks about GPP

Opens the site as a US visitor and from other regions and sees whether the CMP generates the GPP string.
Identifies the CMP and the sections present in the string, such as the national or state ones.
Checks whether the string and the gpp_sid go along with the page's ad requests.
Checks whether there is an opt-out link and whether the string changes after the click.
Points out whether Europe depends only on GPP, without the TCF that Google requires.

Run an audit See everything that is checked

Frequently asked questions

Are GPP and TCF competitors?

No. The TCF is the European consent standard. GPP is an envelope that can carry the TCF and signals from other laws. At Google, Europe keeps using the TCF directly, and GPP serves mainly the US.

My site is Brazilian. Do I need GPP?

Only if you have visitors from the United States and want their opt-out to reach ad partners. For the Brazilian audience, GPP is not required by Google.

Does GPP replace the US Privacy String?

It is the path recommended by the IAB, which discontinued the old string in January 2024. Google still reads the old string, so the switch can be planned calmly.

Do I need to sign the MSPA to use GPP?

Google does not require the publisher to sign. If other partners ask, assess with your legal team. The MSPA is a contract, not a technical setting.

Does restricted data processing remove the ads?

No. Google keeps showing ads, but without using that visitor's data for personalization. Revenue per visit is usually lower.

How do I see my site's GPP string?

Open the browser console and use the ping command of the __gpp API, as in this guide's example. Or run a ConsentMode audit, which shows the string and the sections.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Find out whether your visitors' opt-out reaches the ads

The audit reads the GPP string as a US visitor and shows what to fix, without changing anything.

Start the audit

GPP explained: one signal for many privacy laws

A single box for privacy signals

What you need to meet

Show the opt-out link to US visitors

Treat GPC as an opt-out

Make the opt-out change the GPP string

Use the sections Google reads

Keep the TCF for Europe

Send gpp and gpp_sid in every request

Without GPP, mark the opt-out in the tag

Replace the US Privacy String with the GPP