---
metadata:
  - name: generator
    content: Diplodoc Platform v5.56.0
alternate:
  - https://yandex.com/dev/rtb/doc/en/ssp/ccpa.md
  - https://yandex.com/dev/rtb/doc/ru/ssp/ccpa.md
  - href: https://yandex.com/dev/rtb/doc/en/ssp/ccpa.md
    type: text/markdown
    title: Markdown version
  - href: https://yandex.com/dev/rtb/doc/en/llms.txt
    type: text/markdown
    title: llms.txt
---
> **Documentation Index:** Fetch the complete configuration index at https://yandex.com/dev/rtb/doc/en/llms.txt

# US Privacy (CCPA)

US Privacy, or CCPA (California Consumer Privacy Act), is a framework designed to ensure compliance with US data privacy laws. It started with California and later extended through the Global Privacy Platform.

Unlike Europe's GDPR, which operates on an opt-in model where no data processing is allowed without prior consent, US Privacy uses an opt-out framework. Under this model, data collection is allowed unless a user explicitly opts out of having their personal data "sold" or "shared" (Do Not Sell My Personal Information).

### Why it's used

The main goal is to pass a signal down the entire ad chain (from the site or app to the ad exchange and buyer), which indicates:
- Whether the user was given the option to opt out of data sales.
- Whether the user exercised this right (opted out).
- Whether the intermediary agreed to comply with service provider terms, meaning they won't use the data for their own purposes.

### How the US Privacy (CCPA) string works

The IAB specifies a compact four-character string format (for example, `1YNN`), where each position represents:
1) Version (typically `1`).
2) Explicit notice: Whether the user received notice (`Y` for yes, `N` for no).
3) Opt-out: Whether the user opted out of data sales (`Y` for yes, meaning the user opted out, and `N` for no).
4) LSPA: Whether the advertiser agrees to act under the IAB Limited Service Provider Agreement (`Y` for yes, `N` for no).

### Examples

Data is passed in the `Bid Request` inside the `regs.ext` object.

This example shows that a user in California has opted out of having their data sold (`1YYN`).

``` json
{
  "id": "req_us_999",
  "imp": [{
    "id": "1",
    "banner": { "w": 300, "h": 250 }
  }],
  "regs": {
    "ext": {
      "us_privacy": "1YYN"
    }
  },
  "device": {
    "geo": { "region": "CA" }
  }
}
```

### Migrating to GPP (Global Privacy Platform)

OpenRTB 2.6 actively adopts the GPP object, which replaces the legacy `us_privacy` field. It provides a convenient way to pass compliance data across multiple US states, such as Virginia and Colorado.

``` json
{
  "regs": {
    "gpp": "DBABMA~CPQ7F6APQ7F6AAGABCENAJ-AAAAp77",
    "gpp_sid": [2, 6]
  }
}
```

Where:
- `gpp`: Universal consent string.
- `gpp_sid`: Section identifiers (for example, `2` for Europe TCF, `6` for California US Privacy).

Yandex DSP supports both US Privacy (CCPA) and GPP signals.