US Privacy (CCPA)

US Privacy, or CCPA (California Consumer Privacy Act), is a framework designed to ensure compliance with US data privacy laws. It started with California and later extended through the Global Privacy Platform.

Unlike Europe's GDPR, which operates on an opt-in model where no data processing is allowed without prior consent, US Privacy uses an opt-out framework. Under this model, data collection is allowed unless a user explicitly opts out of having their personal data "sold" or "shared" (Do Not Sell My Personal Information).

Why it's used

The main goal is to pass a signal down the entire ad chain (from the site or app to the ad exchange and buyer), which indicates:

• Whether the user was given the option to opt out of data sales.
• Whether the user exercised this right (opted out).
• Whether the intermediary agreed to comply with service provider terms, meaning they won't use the data for their own purposes.

How the US Privacy (CCPA) string works

The IAB specifies a compact four-character string format (for example, 1YNN), where each position represents:

1. Version (typically 1).
2. Explicit notice: Whether the user received notice (Y for yes, N for no).
3. Opt-out: Whether the user opted out of data sales (Y for yes, meaning the user opted out, and N for no).
4. LSPA: Whether the advertiser agrees to act under the IAB Limited Service Provider Agreement (Y for yes, N for no).

Examples

Data is passed in the Bid Request inside the regs.ext object.

This example shows that a user in California has opted out of having their data sold (1YYN).

{
  "id": "req_us_999",
  "imp": [{
    "id": "1",
    "banner": { "w": 300, "h": 250 }
  }],
  "regs": {
    "ext": {
      "us_privacy": "1YYN"
    }
  },
  "device": {
    "geo": { "region": "CA" }
  }
}

Migrating to GPP (Global Privacy Platform)

OpenRTB 2.6 actively adopts the GPP object, which replaces the legacy us_privacy field. It provides a convenient way to pass compliance data across multiple US states, such as Virginia and Colorado.

{
  "regs": {
    "gpp": "DBABMA~CPQ7F6APQ7F6AAGABCENAJ-AAAAp77",
    "gpp_sid": [2, 6]
  }
}

Where:

• gpp: Universal consent string.
• gpp_sid: Section identifiers (for example, 2 for Europe TCF, 6 for California US Privacy).

Yandex DSP supports both US Privacy (CCPA) and GPP signals.