How to set up US State Privacy (GPP)

What it is, and why it matters

CCPA/CPRA in California, and the growing list of comprehensive US state privacy laws that followed it (Virginia, Colorado, Connecticut, Utah, and others), give consumers a right to opt out of the "sale" or "sharing" of their personal information and, in several states, out of targeted advertising specifically. Ad tech's mechanism for signaling that opt-out to every downstream vendor at once is the IAB's Global Privacy Platform (GPP) — a successor to the older US Privacy (USP) string, which is deprecated but still read by plenty of vendors that haven't migrated yet.

This matters operationally because a single visitor decision — "don't sell/share my data" — has to reach every ad exchange, SSP, and analytics vendor on the page without you writing per-vendor integration code. GPP is that shared signal: publish it once, and every GPP-aware vendor reads the same string.

Unlike IAB TCF, GPP and the US Privacy String are free capabilities in Cookie Munch — they aren't gated behind a paid plan, and they don't require registering a CMP ID with the IAB the way TCF does.

How to enable it

1. In Studio, open the site's Settings drawer, go to the Consent tab, and find the US State Privacy section (it sits directly below IAB TCF, since both are "signaling framework" toggles).

2. Configure:

   Field	What it does
   Enable GPP	Turns on GPP string generation and the __gpp runtime API.
   US states	Comma-separated GPP section IDs to emit, e.g. usca, usva, usco. Each corresponds to a specific state's privacy law section as defined by the IAB (California, Virginia, Colorado, and more — the encoder supports the full current set of state sections; you list only the ones relevant to where your traffic is regulated).
   Enable US Privacy String	Turns on the legacy 4-character USP string alongside GPP, for vendors that haven't moved to GPP yet.
   CMP ID	Numeric ID written into the GPP CMP API header. Unlike TCF's CMP ID, this does not require IAB registration.

3. If you also enabled Auto framework by region under the TCF section, GPP/USP will only activate for visitors whose detected region resolves to the US — visitors elsewhere get the plain banner with no US-specific signaling. This toggle is shared with TCF's region auto-activation, not duplicated.

4. Publish from Studio.

There's no separate "opt-out" toggle to configure per state: the opt-out signal is derived automatically from the visitor's existing Marketing category choice, the same one that drives Consent Mode's ad signals and TCF's ad purposes.

What it does technically

GPP's US-state sections model consent as opt-out fields, not opt-in toggles — the opposite polarity from TCF's purpose consents. Cookie Munch maps the visitor's Marketing category choice onto every field the requested section actually defines:

Only fields the specific state section defines are written — if a given state's section doesn't define a SharingOptOut field, that field is simply omitted from the encoding rather than written as a false negative. This is why the "US states" field matters: each section you list gets its own correctly-shaped encoding, rather than one generic US-wide string.

The legacy USP string. The older 4-character format ([Version][Notice][OptOutSale][LSPA], e.g. 1YNN) is derived from the same Marketing choice: denied sets the opt-out flag to Y, granted sets it to N, the notice flag is always Y, and the LSPA (Limited Service Provider Agreement) flag is always N. If CCPA doesn't apply to a given visitor at all, the string is the not-applicable form 1--- instead. Because GPP and USP are derived independently and don't conflict, it's safe — and recommended — to run both together unless you're certain every downstream vendor on your site has already migrated to GPP.

The runtime API. Both strings are exposed the standard way vendor scripts already expect:

• __gpp(command, callback, parameter) — supports ping, getGPPData, hasSection, getSection, getField, and addEventListener/ removeEventListener. A ping response includes gppVersion, cmpStatus, signalStatus, supportedAPIs, sectionList, applicableSections, and the current gppString.

• __uspapi('getUSPData', 1, callback) → { version: 1, uspString }.

For third-party scripts running in nested iframes that can't call __gpp/__uspapi directly, Cookie Munch installs the standard __gppLocator and __uspapiLocator hidden bridge iframes plus the IAB's postMessage call/return protocol, mirroring exactly how the TCF locator works — so a creative several iframes deep can still discover and read the signal.

Verifying it's working

1. __gpp('ping', console.log) in the browser console should return cmpStatus: 'loaded' and a gppString, plus your configured section list in supportedAPIs/sectionList.

2. __gpp('getSection', console.log, 'usca') (swap in whichever state section you enabled) should decode the section back out — confirm the opt-out fields flip between 1 and 2 as you toggle Marketing consent on your test page.

3. __uspapi('getUSPData', 1, console.log) should return a 4-character string like 1YNN (or 1NNN, or 1--- if CCPA doesn't apply to the test visitor) — confirm the opt-out character tracks the Marketing choice.

4. Consent log cross-check. Every stored consent record includes the gppString that was active for that decision — check the dashboard's audit / consent log for a recent session and confirm it's present and reflects the choice made.

5. Region gating. If Auto framework by region is on, spoof x-cookiemunch-region: de against /config/:cbid and confirm GPP/USP are inactive; spoof x-cookiemunch-region: us-ca and confirm they activate.

See also: Google Consent Mode v2, IAB TCF v2.2, and Geo-targeting & regional rules for how the underlying Marketing category and region detection are shared across all three frameworks.