What is CCPA?
CCPA, the California Consumer Privacy Act, is a California law that gives residents rights over the personal information businesses collect about them, including the right to opt out of its sale or sharing. It took effect in 2020 and was expanded by the CPRA. In OpenRTB its signals travel in the legacy US Privacy string or in the California and US national sections of GPP.
Also called: California Consumer Privacy Act, CPRA, California privacy.
How it works
Two encodings carry California signals. The older one is the US Privacy string in Regs.us_privacy (regs.ext.us_privacy before OpenRTB 2.6), a four-character code whose third character says whether the user opted out of sale; 1YYN means notice was given and the user opted out. The newer one is GPP: Regs.gpp carries the string, and Regs.gpp_sid lists 8 for the California section or 7 for the US national section, which decode into separate opt-out fields for sale and for sharing.
IAB Tech Lab has deprecated the US Privacy string, but many pipelines still send it next to GPP. When both arrive they should agree; a request whose US Privacy string shows an opt-out while the GPP section does not leaves buyers to choose which one to trust. A value of 1--- says the US Privacy string does not apply, which is not the same as a missing field.
These signals limit what a buyer may do with the user's data. How a company must respond to them is a question for its legal counsel, and this entry is not legal advice. The engineering work is narrower: pass the signal through unchanged, keep the two encodings consistent, and treat a GPP section a partner does not recognize yet as unknown, never as consent.
Read more
Related terms
Every term is in the glossary.