IAB GPP

The IAB Global Privacy Platform (GPP) is a single API that carries consent for multiple privacy laws through one string and one interface. OptSens installs window.__gpp and encodes the sections it supports into a real GPP string.

What OptSens does on the wire

OptSens installs window.__gpp as a stub at page load, then upgrades it to loaded when the configuration arrives. A __gppLocator iframe is created for cross-frame access. The API answers these commands:

Command	Returns
ping	GPP version, CMP status, GPP string, supported APIs, applicable sections, parsed sections
addEventListener	Live updates as sections change
removeEventListener	Detaches a listener
hasSection	Whether a section is present in the GPP string
getSection	The parsed section object
getField	A single field, for example usnat.SaleOptOut

Section parameters use the API prefix name, for example usnat or tcfeuv2. The older 7:usnat and numeric forms are accepted too.

Sections

Section	ID	When it is enabled
TCF EU v2 (tcfeuv2)	2	IAB TCF mode is active
MSPA US National (usnat)	7	CCPA / opt-out mode is active

The GPP string always starts with an encoded header, then one segment per section, joined by ~. In TCF EU mode the string is the header plus the same TC string produced by IAB TCF. In CCPA mode the string is the header plus an encoded US National section, with this content:

• Notice flags are set, since the banner and the privacy choices link provide the required notices.
• SaleOptOut, SharingOptOut and TargetedAdvertisingOptOut carry the visitor's choice. The value 1 means opted out and 2 means not opted out.
• The GPC subsection reports the raw Global Privacy Control signal exactly as the browser sent it.
• Sensitive data and known child consent fields are set to 0 (not applicable). OptSens does not process these categories.
• The MSPA transaction fields signal a transaction outside the Multi-State Privacy Agreement.

OptSens uses the national approach. One US National section covers visitors from every US state with a privacy law, since geo detection works at country level. The encoded string is available from the first paint. Before any choice it reports the default not-opted-out state, and it updates the moment the visitor opts out.

Consent records store the GPP string in gpp_string and the legacy US Privacy string in a separate usp_string field, and both appear on the consent proof receipt.

Legacy __uspapi

For older US ad tech that calls window.__uspapi directly, OptSens installs a thin wrapper plus a __uspapiLocator iframe. getUSPData returns a US Privacy string in the 1YNN format, where the third character flips to Y when the visitor has opted out of sale. IAB retired this format in 2024 in favor of GPP, but major ad platforms still read it, and OptSens serves both.

How to enable it

GPP follows the frameworks and region you already configure. There is no separate GPP toggle. Section 2 turns on when you enable IAB TCF. Section 7 and the __uspapi wrapper turn on automatically for CCPA regions set in your geo rules. See also CCPA / CPRA.

How to verify it

Open your site and run this in the browser console:

window.__gpp('ping', function (data, ok) {
  console.log(ok, data.gppString, data.applicableSections);
});

On a CCPA page the string starts with DBABLA~. Read the parsed US National section or a single field:

window.__gpp('getSection', function (section, ok) {
  console.log(ok, section.SaleOptOut, section.Gpc);
}, 'usnat');

window.__gpp('getField', function (value, ok) {
  console.log(ok, value);
}, 'usnat.SaleOptOut');

Check the legacy endpoint:

window.__uspapi('getUSPData', 1, function (data, ok) {
  console.log(ok, data.uspString);
});

US sections

In CCPA regions, OptSens announces and encodes the US National section and carries the same opt-out in the __uspapi string. Any GPP decoder, including the IAB reference library, can read the emitted string.