Skip to main content
Cookie Gate
Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button
Category: Consent Records

US Privacy String

Also known as: USP String, IAB US Privacy String, IAB Tech Lab U.S. Privacy String, US Privacy (USP) String, IAB US Privacy (legacy)
Simply put

The US Privacy String was a standardized code, developed by the IAB Tech Lab, used to record and pass along a person's privacy choices, such as whether they opted out of the sale of their personal information. It was created to support compliance with early US state privacy laws, particularly the California Consumer Privacy Act (CCPA). It has since been deprecated and is now considered a legacy signal format.

Formal definition

The US Privacy String (USP String) is a compact, encoded data format defined by the IAB Tech Lab to communicate consumer privacy disclosures and opt-out choices across the digital advertising supply chain, developed specifically to support CCPA compliance. It captured elements such as whether notice was provided and whether the consumer had exercised opt-out rights (for example, opt-out of sale), reflecting the opt-out-oriented model of US state privacy laws rather than the opt-in consent model prevalent under EU frameworks. According to the evidence, the specification was deprecated as of January 31, 2024 and was not updated, and it is generally treated as a legacy signal, with the IAB's successor Global Privacy Platform intended to address broader US state requirements; practitioners should confirm current signal handling and the applicable legal requirements independently, as this definition does not address the full scope of US state privacy obligations or the technical details of any replacement framework.

Why it matters

The US Privacy String represented an early attempt to standardize how consumer privacy choices, most notably opt-outs of the sale of personal information, could be communicated across the digital advertising supply chain in the United States. Because US state privacy laws such as the California Consumer Privacy Act (CCPA) generally rely on an opt-out model rather than the opt-in consent model prevalent under EU frameworks, the advertising ecosystem needed a compact, machine-readable way to signal whether notice had been given and whether a consumer had exercised their rights. The USP String was developed by the IAB Tech Lab to fill that role, and understanding it remains relevant for anyone maintaining or auditing existing implementations.

For practitioners, the significance today is largely transitional. According to the evidence, the specification was deprecated as of January 31, 2024 and was not updated, and it is generally treated as a legacy signal format. Organizations that built CCPA compliance workflows around the USP String need to be aware that continued reliance on a deprecated standard carries operational and compliance risk, as vendor and platform support for legacy signals may diminish over time. The IAB's Global Privacy Platform is intended to address broader US state requirements going forward.

The practical takeaway is that recognizing the USP String helps teams identify where migration may be needed and avoid conflating a legacy signal with a current, actively maintained framework. This entry does not address the full scope of US state privacy obligations or the technical details of any replacement framework, and it makes no claim that using or having used the USP String satisfies any particular legal requirement. Signal handling supports compliance but does not replace independent legal judgment about the applicable state laws.

Who it's relevant to

Privacy and compliance officers at organizations subject to US state laws
Teams responsible for CCPA and other US state privacy compliance should understand the USP String's role in signaling opt-out choices and recognize that, as a deprecated legacy format, continued reliance may warrant review and migration planning. This does not by itself determine whether any given obligation is met, which depends on the applicable state laws.
Web developers and adtech engineers
Developers maintaining consent signaling in the advertising supply chain may encounter the USP String in existing implementations and should confirm current signal handling with their vendors, given that the specification was deprecated as of January 31, 2024 and has not been updated.
Consent management platform (CMP) users and administrators
Those administering CMPs that generated or read the USP String, including templated CCPA configurations and no-code deployments described by some vendors, should assess whether their tooling still relies on the legacy format and plan accordingly, remembering that a CMP supports but does not guarantee compliance.
Legal counsel advising on US digital advertising
Counsel evaluating advertising and data-sale practices under US state privacy regimes may need to distinguish the legacy USP String from current frameworks and advise on migration, without treating the presence or use of any signal format as conclusive evidence of lawful processing.

Inside USP String

Specification version
An identifier indicating which version of the US Privacy (USP) string specification is in use, allowing signal recipients to interpret the remaining characters correctly.
Notice given indicator
A value signaling whether the business provided the consumer with explanatory notice or the opportunity to exercise opt-out rights, typically before any relevant processing occurs.
Opt-out signal
A value reflecting whether the consumer has exercised an opt-out of the sale or sharing of their personal information, consistent with the opt-out model used under US state privacy laws such as California's CCPA/CPRA rather than the EU opt-in model.
Limited Service Provider Agreement indicator
A value indicating whether a signatory service provider agreement applies to the transaction, which can affect how downstream parties treat the data.
Compact encoding
The US Privacy String is a short, standardized character string designed to be passed programmatically between parties (for example in the advertising supply chain) to communicate a consumer's privacy choices.

Common questions

Answers to the questions practitioners most commonly ask about USP String.

Does the US Privacy String replace the need for a Consent Management Platform or GDPR-style consent?
No. The US Privacy String is a technical signal originally associated with the IAB CCPA Compliance Framework and reflects an opt-out model, not the opt-in consent standard used in most EU jurisdictions. It does not satisfy GDPR requirements for freely given, specific, informed, and unambiguous consent, and it does not replace a CMP or the broader consent management and record-keeping practices needed under EU or UK law. Legal judgment remains necessary regardless of the string's presence.
Does having a US Privacy String set to reflect an opt-out mean a business is automatically compliant with US state privacy laws?
Not necessarily. The string is a mechanism for communicating a user's opt-out status and related notice signals, but it is one component among many. Compliance with frameworks such as California's laws typically depends on how opt-out requests are actually honored across systems, how notices are presented, and how downstream vendors respond. A correctly formatted string supports these obligations but does not by itself guarantee compliance, and requirements vary between US states.
How is the US Privacy String typically structured?
The string generally encodes a small set of values reflecting matters such as whether notice was provided, whether the user has opted out of sale or sharing, and whether a limited service provider arrangement applies. The specifics are defined by the applicable IAB technical specification, and implementers should consult the current version of that specification, as the format and its status have evolved over time. This entry does not reproduce the exact character-by-character encoding.
How does the US Privacy String relate to Global Privacy Control (GPC) signals?
They are distinct mechanisms that may interact. GPC is a browser- or device-level signal expressing an opt-out preference, whereas the US Privacy String is a value passed within advertising and analytics data flows. In practice, a received GPC signal may be one input used to set opt-out values that are then reflected in a US Privacy String. How these are reconciled depends on the implementation and on how a given regime treats opt-out signals, so teams should verify their handling rather than assume automatic alignment.
Where should the US Privacy String be made available for downstream vendors to read?
Implementations commonly expose the value through a defined API surface and pass it within advertising or measurement requests so that partners and vendors can act on the signaled preferences. The precise transport and access method should follow the relevant IAB specification and your vendors' integration requirements. Because propagation depends on each vendor honoring the signal, testing across the vendor chain is generally advisable; the effectiveness of the string relies on downstream cooperation, which is outside the control of the publisher setting it.
How should the US Privacy String be maintained as privacy requirements change?
Because the underlying framework and specification have changed over time and US state laws continue to evolve, implementations should be reviewed periodically to confirm they use a current, supported format and correctly reflect applicable obligations. This may include coordinating updates with a CMP, verifying that opt-out logic still maps to the intended values, and confirming vendor support. Ongoing legal and technical review is recommended, as the string's role and specification are not static.

Common misconceptions

The US Privacy String is equivalent to, or interchangeable with, the IAB Europe TCF consent string.
They are distinct signals built for different legal environments. The US Privacy String reflects the opt-out framework common to US state privacy laws such as the CCPA/CPRA, whereas the TCF string is oriented toward the EU/UK opt-in consent model under the ePrivacy Directive and GDPR. They are not substitutes for one another, and this framework has been succeeded by newer signaling approaches, so practitioners should confirm which signal their partners currently expect.
Passing a valid US Privacy String means a business is compliant with applicable US privacy laws.
The string is a technical mechanism for communicating certain choices; it does not by itself demonstrate compliance. Meeting legal obligations still depends on providing adequate notice, honoring consumer rights, maintaining appropriate agreements, and other requirements that vary by state. The signal supports compliance efforts but does not replace legal judgment.
The US Privacy String captures the consumer's affirmative consent to processing.
Because US state regimes generally rely on opt-out rather than opt-in, the string primarily conveys whether notice was given and whether the consumer opted out. It does not represent freely given, specific, informed, and unambiguous opt-in consent as required for consent-based processing in most EU jurisdictions.

Best practices

Confirm with each downstream and upstream partner which privacy signal they currently support and expect, since signaling frameworks in the US advertising ecosystem have evolved and older strings may be deprecated in favor of newer specifications.
Do not treat a populated US Privacy String as proof of compliance; pair it with documented notice, functioning opt-out mechanisms, and applicable service provider or contractor agreements required by the relevant US state law.
Keep the US Privacy String separate from any EU/UK consent signals such as TCF strings, and ensure your systems select the correct signal based on the applicable jurisdiction rather than sending one signal universally.
Validate that the string's notice and opt-out values accurately reflect the consumer's actual experience and choices, and update the signal promptly when a consumer changes their preference.
Maintain records of how consumer choices were captured and encoded so you can demonstrate that the signal matches your notice and opt-out practices if questioned.
Seek legal review of how the string is generated and interpreted, because obligations differ across US states and enforcement positions may change over time.
Application Security Isn’t Optional Anymore.