Regs.gdpr

Whether the request is subject to the EU General Data Protection Regulation: 0 means no, 1 means yes, and leaving it out means unknown. A core field since 2.6; earlier integrations send regs.ext.gdpr.

CurrentintegerOptionalSince 2.6-202204

Field facts

Path: regs.gdpr
Object: Regs
Type: integer
Requirement: Optional
Added: OpenRTB 2.6-202204
Spec section: 3.2.3

How it is used

When gdpr is 1, bidders look for a TCF consent string in User.consent and use personal data only for the vendors and purposes that string allows. On a request declared as 2.6 the validator expects the value at regs.gdpr and reports regs.ext.gdpr as a moved field. During a migration some senders fill both locations, which works only while the two values agree.

Allowed values

0, 1.

Example

Where the field sits in a payload, with everything else left out:

{
  "id": "req-1",
  "regs": {
    "gdpr": 1
  }
}

Common mistakes

Sending only regs.ext.gdpr on a 2.6 request, so bidders that read the core field see no signal.
Carrying different values at regs.gdpr and regs.ext.gdpr. The validator reports a privacy signal conflict instead of picking one.
Putting the consent string in regs. It belongs in User.consent.

Version history

Added in OpenRTB 2.6-202204, and present in the latest snapshot. The table shows how each version's spec text types the field.

Versions	Type in the spec	Required	Deprecated
2.6-202204	Added in the first 2.6 release, published without a structured text archive; the 2.6-202210 republication is the first tagged text.
2.6-202210 to 2.6-202606	integer	No	No

Versioned rules that name this field

openrtb.2.6.regs.gdpr OpenRTB 2.6 moved GDPR signaling out of regs.ext into the core regs object.

Related fields

Other Regs fields

For a walkthrough of the whole object, read Privacy signals.