How do I pass GDPR consent in an OpenRTB bid request?
Answer
Set regs.gdpr to 1 when the request is subject to GDPR and put the TCF consent string in user.consent. Both are first-class fields in OpenRTB 2.6; on 2.5 and earlier the same signals travel as regs.ext.gdpr and user.ext.consent. regs.gdpr is an integer flag (0 = no, 1 = yes, omitted = unknown), and user.consent carries the IAB Transparency and Consent Framework string. Sending a consent string without the gdpr flag, or the flag without the string, is a common integration bug worth validating for.
Fields in this answer
| Field | Type | Since | Status in 2.6 |
|---|---|---|---|
regs.gdpr | integer | 2.6-202204 | Current |
user.consent | string | 2.6-202204 | Current |
Go deeper
More questions on privacy, identity, supply chain, and versions
- How do I pass a GPP string in OpenRTB? Put the Global Privacy Platform consent string in regs.gpp and list the applicable section IDs in regs.gpp_sid.
- GPP vs us_privacy: which should I send? Send GPP (regs.gpp plus regs.gpp_sid) where your partners support it; the US Privacy signal was deprecated by IAB Tech Lab on January 31, 2024 in favor of GPP.
- How do I signal CCPA in OpenRTB? Put the US Privacy string in regs.us_privacy, which is a first-class field in OpenRTB 2.6; on 2.5 and earlier it travels as regs.ext.us_privacy per the IAB extension.
- How do I signal COPPA in an OpenRTB request? Set regs.coppa to 1 when the request is subject to the COPPA regulations established by the US FTC, and 0 when it is not.
- What is the DSA extension in OpenRTB? The DSA transparency extension carries EU Digital Services Act ad-transparency data through OpenRTB 2.x ext blocks.
- What is the difference between device.lmt and device.dnt? device.dnt is the browser Do Not Track header flag, while device.lmt is the OS-level Limit Ad Tracking signal from mobile platforms such as iOS and Android.
All 93 questions are listed in the OpenRTB FAQ.