Global Privacy Platform (GPP): how to comply guide

The IAB Global Privacy Platform (GPP) is a protocol developed by IAB Tech Lab to help the advertising industry solve the challenges that come with complying with the various and evolving privacy laws and regulations across the globe. A central part of the IAB privacy framework, it is designed to streamline the transmission of privacy, consent, and consumer choice signals from sites and apps to ad tech providers. 

For example, imagine a large publishing company collects consent choices from its readers: choices like opting out of data collection, specifying their data use for specific purposes like analytics or advertising, and more. The publisher needs to relay these consent choices–also referred to as “signals”–to the advertising partners that advertise on the publisher’s behalf. The GPP protocol gives the publisher and advertiser a common language and standard way for these privacy signals to be created. 

Who should use the GPP? 

The GPP string offers the digital advertising industry a sustainable way to adapt to changes in existing privacy regulations, and adopt new ones as they arise. The digital advertising industry includes any and all businesses participating in the ecosystem: advertisers, publishers, and technology vendors. 

If you are sharing data with partners in the digital advertising ecosystem and need to communicate consent choices about that data, you should likely adopt the GPP frameworks. The challenge lies in reconciling the Global Privacy Platform protocol with older IAB privacy strings. 

Understanding GPP vs. US privacy string

Formerly, advertising data was handled through a variety of IAB privacy strings, each carrying out a particular component related to privacy adherence. However, as the intricacy of the advertising ecosystem and volume of privacy regulations increased, there was a need for a more consolidated, versatile replacement. Enter IAB GPP: designed to simplify all. The GPP includes many substrings that address different regulatory clients, making it a single framework to help with compliance for all. 

The IAB recommends companies transition away from the US Privacy Specifications and adopt GPP, as this will be the only platform to accommodate upcoming and future privacy and consent management requirements in the US. The GPP will support all existing privacy signals and more to come, including: 

IAB Europe Transparency & Consent Framework‍

• EU TCF v2 signal

IAB Canada Transparency & Consent Framework

• CA TCF signal

IAB MSPA Signals

• 5 US State signals–CA, VT, CT, CO, UT
• US National signal
• Includes support for Global Privacy Control

With the GPP, IAB has established a platform to quickly incorporate new legislative requirements and respond with faster speed to market. However, there’s one significant challenge in migrating to this new framework: translation between old and new protocols. 

Support for the IAB US Privacy string will end on January 31, 2024. (This is an extension beyond the deprecation deadline of September 30, 2023.) This transition period will help businesses complete their technical implementation of the Global Privacy Platform by the IAB GPP deadline, and align their privacy practices with evolving privacy legislation.

The Global Privacy Platform IAB challenge: old to new protocols

Essentially, every vendor in the advertising string must use the same global privacy platform IAB protocol or else risk a breakdown in communication and data integrity. The migration to GPP poses one immediate challenge: synchronization. A business wanting to switch to GPP might face a translation issue if its partners are still using the older IAB privacy strings.

If your business is ready to make the switch from legacy strings to GPP, the last thing you want to worry about is waiting for your partners to make the change, too. This is precisely where data privacy software like Ketch comes in to help. Ketch consent management helps publishers and advertisers with backward compatibility: giving you the ability to indefinitely “speak both languages.” 

Imagine you need to send a GPP consent signal to an advertiser that is still using the old string. If you do this without consideration for the different signals, the advertiser won’t understand what you’re sending. If you use Ketch consent management to provide this signal, Ketch acts as your translation layer. Ketch is the translator between you and the ecosystem of participants in the framework, helping you support both protocols indefinitely. 

Getting started with GPP adherence 

Companies can leverage resources such as the TCF (Transparency and Consent Framework) vendor list – a global, standardized list of vendors that adhere to the TCF standards, such as an approved TCF CMP like Ketch. By referring to the tcf vendor list, organizations can ensure they are collaborating with parties committed to transparent user consent and compliance with privacy legislation.

Open-source platforms are another crucial resource for companies. For instance, the Global privacy platform IAB GitHub repository is a valuable resource for developers undertaking the shift to GPP. It offers access to privacy frameworks, supporting documentation, and valuable community insights. 

The bottom line: if you have pressure or need to start using the IAB GPP sanctioned protocol for respecting privacy choices, Ketch can help you use it without disrupting your digital advertising partnerships. Regardless of your compatibility with their GPP migration plans, you can plunge ahead, confident in their compliance and communication integrity.