US State Privacy (GPP)

For US traffic, Cookie Munch emits the IAB Global Privacy Platform (GPP) string — the current standard for signaling opt-outs under CCPA/CPRA and the growing set of other US state privacy laws — plus the legacy US Privacy String for vendors that haven't migrated to GPP yet. Unlike IAB TCF, this is a free capability, independent of any paid plan.

Enabling it

In banner settings → Consent → US State Privacy:

How the opt-out maps

GPP's US-state sections model consent as opt-out fields, not opt-in toggles. Cookie Munch maps your visitor's Marketing category choice onto every applicable field the requested section defines:

Only fields the specific state section actually defines are written — e.g. a state section without a SharingOptOut field simply omits it.

Legacy US Privacy String

The older 4-character USP string ([Version][Notice][OptOutSale][LSPA], e.g. 1YNN) was formally deprecated by the IAB in favor of GPP, but plenty of ad vendors still read it via __uspapi. Cookie Munch derives it from the same Marketing choice:

• Marketing denied → opt-out flag Y

• Marketing granted → opt-out flag N

• CCPA doesn't apply to this visitor → 1--- (not-applicable)

Note: Enable both GPP and US Privacy String together unless you're certain every downstream vendor already reads GPP — the two run side by side with no conflict.

Runtime API

Both strings are exposed the standard way: __gpp(command, callback, parameter) (ping, getGPPData, hasSection, getSection, getField, addEventListener/removeEventListener) and __uspapi('getUSPData', 1, callback) → { version: 1, uspString }. Cross-frame access is provided via the standard __gppLocator/__uspapiLocator bridge iframes for third-party scripts embedded on your page.

Auto-activation by region

If Auto framework by region is enabled, GPP/US Privacy only activate for visitors whose detected region resolves to the US — visitors elsewhere get the standard banner with no US-specific signaling.

See also: IAB TCF v2.2 · Geo-targeting & regional rules