Companies who participate in the AdTech and digital advertising eco-system are very familiar with the Interactive Advertising Bureau and its form advertiser agreements. Those agreements can help streamline negotiations, presenting the parties with, essentially, a pre-negotiated approach to common issues. When CCPA was passed, IAB updated its form to address that law and address consumer notice and consent. With the upcoming laws in California, Colorado, Connecticut, Utah and Vermont, the document is now outdated.

The IAB has thus updated its Multi-State Privacy Agreement (MSPA) and proposed what it is calling “US State Signals.” Signatories to the MSPA will need to respect those signals. The signals are intended to be used in conjunction with the IAB’s Global Privacy Platform (GPP), a protocol that is intended to support consumer rights within the AdTech infrastructure. The two allow users’ preferences to be communicated between advertisers, publishers and vendors. There are separate signals for each state, and cover sale, sharing, sensitive data, and other items as may be required under the relevant laws. These updates are timely as California, Colorado and Connecticut all require following “universal opt-out signals” and the IAB process might be a tool for respecting those signals. (For more about the status of state opt-out signals see our earlier article.

IAB is accepting comments to its draft US State Signals and update to the Multi-State Privacy Agreement until October 27.

Putting It Into Practice: As a reminder, the requirement for following universal opt-out signals is required first in California (2023), then in Colorado (July 2024), and finally Connecticut (January 2025). Until then, we anticipate seeing various technological approaches proposed for respecting consumers’ choices. AdTech companies will want to keep in mind that of the IAB, especially if they are asked to sign the MSPA.