789101112The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
+The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
-The National Privacy Section is a string that consists of the following components. Users should employ the National Privacy Section only if they will adhere to the National Approach for their processing of a consumer’s personal data.
+| Date | +Version | +Comments | +
| November 2022 | +1.0 | +Version 1.0 released | +
The US National Privacy Section is a string that consists of the components described below. Users should employ the US National Privacy Section only if they will adhere to the National Approach for their processing of a consumer’s personal data.
| Client side API prefix | -uspnat | -The National Privacy section is registered with client side API prefix “uspnat” in the GPP Client Side API. | +usnat | +The US National Privacy section is registered with client side API prefix “usnat” in the GPP Client Side API. |
The core segment must always be present. Where terms are capitalized in the ‘description’ field they are defined terms in applicable State Privacy Laws and the MSPA. It consists of the following fields:
+| Version | +Version | Int(6) | -The version of this section specification used to encode the string. | +The version of this section specification used to encode the string. |
| SharingNotice | +SharingNotice | Int(2) | -Notice of the Sharing of the Consumer’s Personal Data with Third Parties. References: + | Notice of the Sharing of the Consumer’s Personal Data with Third Parties. References:
0 Not Applicable. The Business does not share Personal Data with Third Parties.
|
+
| SaleOptOutNotice | +SaleOptOutNotice | Int(2) | -Notice of the Opportunity to Opt Out of the Sale of the Consumer’s Personal Data. References: + | Notice of the Opportunity to Opt Out of the Sale of the Consumer’s Personal Data. References:
0 Not Applicable. The Business does not Sell Personal Data.
|
+
| SharingOptOutNotice | +SharingOptOutNotice | Int(2) | -Notice of the Opportunity to Opt Out of the Sharing of the Consumer’s Personal Data. References: (i) Cal. Civ. Code 1798.100(1)(1), (3), (ii) Cal. Civ. Code 1798.135(1) and/or (iii) Cal. Civ. Code 1798.135(2)0 Not Applicable.The Business does not Share Personal Data.
|
+Notice of the Opportunity to Opt Out of the Sharing of the Consumer’s Personal Data. References: (i) Cal. Civ. Code 1798.100(1)(1), (3), (ii) Cal. Civ. Code 1798.135(1) and/or (iii) Cal. Civ. Code 1798.135(2)
|
| TargetedAdvertisingOptOutNotice | +TargetedAdvertisingOptOutNotice | Int(2) | -Notice of the Opportunity to Opt Out of Processing of the Consumer’s Personal Data for Targeted Advertising References: + | Notice of the Opportunity to Opt Out of Processing of the Consumer’s Personal Data for Targeted Advertising References:
0 Not Applicable.The Business does not Process Personal Data for Targeted Advertising.
|
+
| SensitiveDataProcessingOptOutNotice | +SensitiveDataProcessingOptOutNotice | Int(2) | -Notice of the Opportunity to Opt Out of the Processing of the Consumer’s Sensitive Data References: + | Notice of the Opportunity to Opt Out of the Processing of the Consumer’s Sensitive Data References:
0 Not Applicable. The Business does not Process Sensitive Data.
|
+
| SensitiveDataLimitUseNotice | +SensitiveDataLimitUseNotice | Int(2) | -Notice of the Opportunity to Limit Use or Disclosure of the Consumer’s Sensitive Data References: + | Notice of the Opportunity to Limit Use or Disclosure of the Consumer’s Sensitive Data References:
0 Not Applicable. The Business does not use or disclose Sensitive Data.
|
+
| SaleOptOut | +SaleOptOut | Int(2) | -Opt-Out of the Sale of the Consumer’s Personal Data References: + | Opt-Out of the Sale of the Consumer’s Personal Data References:
0 Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
|
| SharingOptOut | +SharingOptOut | Int(2) | -Opt-Out of the Sharing of the Consumer’s Personal Data References: + | Opt-Out of the Sharing of the Consumer’s Personal Data References:
0 Not Applicable. SharingOptOutNotice value was not applicable or no notice was provided.
|
| TargetedAdvertisingOptOut | +TargetedAdvertisingOptOut | Int(2) | -Opt-Out of Processing the Consumer’s Personal Data for Targeted Advertising References: + | Opt-Out of Processing the Consumer’s Personal Data for Targeted Advertising References:
0 Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
|
| SensitiveDataProcessing | +SensitiveDataProcessing | N-Bitfield(2,12) | -Two bits for each Data Activity:0 Not Applicable. The Business does not Process the specific category of Sensitive Data.
References: | Two bits for each Data Activity:0 Not Applicable. The Business does not Process the specific category of Sensitive Data.
References:
References: +(2). Consent to Process the Consumer’s Sensitive Data Consisting of Personal Data Revealing Religious or Philosophical Beliefs.References:
References: +(3). Consent to Process the Consumer’s Sensitive Data Consisting of Personal Data Concerning a Consumer’s Health (including a Mental or Physical Health Condition or Diagnosis; Medical History; or Medical Treatment or Diagnosis by a Health Care Professional).References:
References: +(4). Consent to Process the Consumer’s Sensitive Data Consisting of Personal Data Revealing Sex Life or Sexual Orientation.References:
References: +(5). Consent to Process the Consumer’s Sensitive Data Consisting of Personal Data Revealing Citizenship or Immigration Status.References:
References: +(6). Consent to Process the Consumer’s Sensitive Data Consisting of Genetic Data for the Purpose of Uniquely Identifying an Individual / Natural Person.References:
References: +(7). Consent to Process the Consumer’s Sensitive Data Consisting of Biometric Data for the Purpose of Uniquely Identifying an Individual / Natural Person.References:
References: +(8). Consent to Process the Consumer’s Sensitive Data Consisting of Precise Geolocation Data.References:
References: +(9). Consent to Process the Consumer’s Sensitive Data Consisting of a Consumer’s Social Security, Driver’s License, State Identification Card, or Passport Number.References:
References: +(10). Consent to Process the Consumer’s Sensitive Data Consisting of a Consumer’s Account Log-In, Financial Account, Debit Card, or Credit Card Number in Combination with Any Required Security or Access Code, Password, or Credentials Allowing Access to an Account.References:
References: +(11). Consent to Process the Consumer’s Sensitive Data Consisting of Union Membership.References:
References: +(12). Consent to Process the Consumer’s Sensitive Data Consisting of the contents of a Consumer’s Mail, Email, and Text Messages unless You Are the Intended Recipient of the Communication.References:
|
| KnownChildSensitiveDataConsents | +KnownChildSensitiveDataConsents | N-Bitfield(2,2) | -Two bits for each Data Activity:0 Not Applicable. The Business does not have actual knowledge that it Processes Personal Data or Sensitive Data of a Consumer who is a known child.
References: | Two bits for each Data Activity:0 Not Applicable. The Business does not have actual knowledge that it Processes Personal Data or Sensitive Data of a Consumer who is a known child.
References:
References: +(2). Consent to Process the Consumer’s Personal Data or Sensitive Data for Consumers Younger Than 13 Years of Age.References:
|
| PersonalDataConsents | +PersonalDataConsents | Int(2) | -Consent to Collection, Use, Retention, Sale, and/or Sharing of the Consumer’s Personal Data that Is Unrelated to or Incompatible with the Purpose(s) for which the Consumer’s Personal Data Was Collected or Processed References: + | Consent to Collection, Use, Retention, Sale, and/or Sharing of the Consumer’s Personal Data that Is Unrelated to or Incompatible with the Purpose(s) for which the Consumer’s Personal Data Was Collected or Processed References:
0 Not Applicable. The Business does not use, retain, Sell, or Share the Consumer’s Personal Data for advertising purposes that are unrelated to or incompatible with the purpose(s) for which the Consumer’s Personal Data was collected or processed.
|
+
| MspaCoveredTransaction | +MspaCoveredTransaction | Int(2) | -Publisher or Advertiser, as applicable, is a signatory to the IAB Multistate Service Provider Agreement (MSPA), as may be amended from time to time, and declares that the transaction is a “Covered Transaction” as defined in the MSPA. 0 Not Applicable
|
+Publisher or Advertiser, as applicable, is a signatory to the IAB Multistate Service Provider Agreement (MSPA), as may be amended from time to time, and declares that the transaction is a “Covered Transaction” as defined in the MSPA.
|
| MspaOptOutOptionMode | +MspaOptOutOptionMode | Int(2) | -Publisher or Advertiser, as applicable, has enabled “Opt-Out Option Mode” for the “Covered Transaction,” as such terms are defined in the MSPA.0 Not Applicable.
|
+Publisher or Advertiser, as applicable, has enabled “Opt-Out Option Mode” for the “Covered Transaction,” as such terms are defined in the MSPA.
|
| MspaServiceProviderMode | +MspaServiceProviderMode | Int(2) | -Publisher or Advertiser, as applicable, has enabled “Service Provider Mode” for the “Covered Transaction,” as such terms are defined in the MSPA.0 Not Applicable
|
+Publisher or Advertiser, as applicable, has enabled “Service Provider Mode” for the “Covered Transaction,” as such terms are defined in the MSPA.
|
GPC is signaled in user agent headers(Sec-GPC) and a simple javascript API (globalPrivacyControl). Entities creating GPP strings should check for whether GPC is set and pass along the value they find (from the headers or javascript API) in this sub-section.
| Field Name | -GPP Field Type | -Description | -|||
| Gpc | -Boolean | -0 false
|
+Field Name | +GPP Field Type | +Description |
|---|
In the mobile or CTV context, the key names to be used in GPP are listed below.
-| GPP Key Name | -Value(s) | +SubsectionType | +Int(2) | +
|
| IABGPP_7_String | -String: Full encoded USPNAT string | +Gpc | +Boolean | +
|
The section specifications included in this directory are in public comment until October 27, 2022. Comments may be submitted to support@iabtechlab.com.
Contained in this directory are technical specifications for the National privacy strings to support the National Approach as defined in the MSPA. diff --git a/Sections/US-States/.DS_Store b/Sections/US-States/.DS_Store new file mode 100644 index 0000000..f6f8431 Binary files /dev/null and b/Sections/US-States/.DS_Store differ diff --git "a/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" "b/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" index 18e01cd..5691743 100644 --- "a/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" +++ "b/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" @@ -1,8 +1,29 @@The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
+The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
+ +| Date | +Version | +Comments | +
| November 2022 | +1.0 | +Version 1.0 released | +
The California Privacy Section consists of the following components. Users should employ the California Privacy String only if they have determined the CPRA applies to their processing of a consumer's personal information.
+The California Privacy Section consists of the components described below. Users should employ the California Privacy String only if they have determined the CPRA applies to their processing of a consumer's personal information.
| Client side API prefix | -uspca | -The California Privacy Section is registered with client side API prefix "uspca" in the GPP Client Side API. | +usca | +The California Privacy Section is registered with client side API prefix "usca" in the GPP Client Side API. |
The core segment must always be present. Where terms are capitalized in the ‘description’ field they are defined terms in Cal. Civ. Code 1798.140. It consists of the following fields: +
The core sub-section must always be present. Where terms are capitalized in the ‘description’ field they are defined terms in Cal. Civ. Code 1798.140. It consists of the following fields:
| SaleOptOutNotice | Int(2) | -Notice of the Opportunity to Opt Out of the Sale of the Consumer's Personal Information
|
+Notice of the Opportunity to Opt Out of the Sale of the Consumer's Personal Information
|
| SharingOptOutNotice | Int(2) | -Notice of the Opportunity to Opt Out of the Sharing of the Consumer's Personal Information
|
+Notice of the Opportunity to Opt Out of the Sharing of the Consumer's Personal Information
|
| SensitiveDataLimitUseNotice | Int(2) | -Notice of the Opportunity to Limit Use or Disclosure of the Consumer's Sensitive Personal Information
|
+Notice of the Opportunity to Limit Use or Disclosure of the Consumer's Sensitive Personal Information
|
| SaleOptOut | Int(2) | -Opt-Out of the Sale of the Consumer's Personal Information
|
+Opt-Out of the Sale of the Consumer's Personal Information
|
| SharingOptOut | Int(2) | -Opt-Out of the Sharing of the Consumer's Personal Information
|
+Opt-Out of the Sharing of the Consumer's Personal Information
|
| SensitiveDataProcessing | N-Bitfield(2,9) | -Two bits for each Data Activity:
(1) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Social Security, Driver's License, State Identification Card, or Passport Number. (2) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Account Log-In, Financial Account, Debit Card, or Credit Card Number in Combination with Any Required Security or Access Code, Password, or Credentials Allowing Access to an Account. (3) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Precise Geolocation. (4) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Racial or Ethnic Origin, Religious or Philosophical Beliefs, or Union Membership. (5) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals the contents of a Consumer's Mail, Email, and Text Messages unless You Are the Intended Recipient of the Communication. (6) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Genetic Data. (7) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Consisting of Biometric Information tor the Purpose of Uniquely Identifying a Consumer. (8) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Consisting of Personal Information Collected and Analyzed Concerning a Consumer's Health. (9) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Consisting of Personal Information Collected and Analyzed Concerning a Consumer's Sex Life or Sexual Orientation. |
+Two bits for each Data Activity:
Data Activities: (1) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Social Security, Driver's License, State Identification Card, or Passport Number. (2) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Account Log-In, Financial Account, Debit Card, or Credit Card Number in Combination with Any Required Security or Access Code, Password, or Credentials Allowing Access to an Account. (3) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Precise Geolocation. (4) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Racial or Ethnic Origin, Religious or Philosophical Beliefs, or Union Membership. (5) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals the contents of a Consumer's Mail, Email, and Text Messages unless You Are the Intended Recipient of the Communication. (6) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Which Reveals a Consumer's Genetic Data. (7) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Consisting of Biometric Information tor the Purpose of Uniquely Identifying a Consumer. (8) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Consisting of Personal Information Collected and Analyzed Concerning a Consumer's Health. (9) Opt-Out of the Use or Disclosure of the Consumer's Sensitive Personal Information Consisting of Personal Information Collected and Analyzed Concerning a Consumer's Sex Life or Sexual Orientation. |
| KnownChildSensitiveDataConsents | N-Bitfield(2,2) | -Two bits for each Data Activity:
(1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age (2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age |
+Two bits for each Data Activity:
Data Activities: (1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age (2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age |
| PersonalDataConsents | Int(2) | -Consent to Collection, Use, Retention, Sale, and/or Sharing of the Consumer's Personal Data that Is Unrelated to or Incompatible with the Purpose(s) for which the Consumer's Personal Data Was Collected or Processed
|
+Consent to Collection, Use, Retention, Sale, and/or Sharing of the Consumer's Personal Data that Is Unrelated to or Incompatible with the Purpose(s) for which the Consumer's Personal Data Was Collected or Processed
|
| MspaCoveredTransaction | Int(2) | -Publisher or Advertiser, as applicable, is a signatory to the IAB Multistate Service Provider Agreement (MSPA), as may be amended from time to time, and declares that the transaction is a "Covered Transaction" as defined in the MSPA.
|
+Publisher or Advertiser, as applicable, is a signatory to the IAB Multistate Service Provider Agreement (MSPA), as may be amended from time to time, and declares that the transaction is a "Covered Transaction" as defined in the MSPA.
|
| MspaOptOutOptionMode | Int(2) | -Publisher or Advertiser, as applicable, has enabled "Opt-Out Option Mode" for the "Covered Transaction," as such terms are defined in the MSPA.
|
+Publisher or Advertiser, as applicable, has enabled "Opt-Out Option Mode" for the "Covered Transaction," as such terms are defined in the MSPA.
|
| MspaServiceProviderMode | Int(2) | -Publisher or Advertiser, as applicable, has enabled "Service Provider Mode" for the "Covered Transaction," as such terms are defined in the MSPA.
|
+Publisher or Advertiser, as applicable, has enabled "Service Provider Mode" for the "Covered Transaction," as such terms are defined in the MSPA.
|
GPC is signaled in user agent headers(Sec-GPC) and a simple javascript API (globalPrivacyControl). Entities creating GPP strings should check for whether GPC is set and pass along the value they find (from the headers or javascript API) in this sub-section.
| SubsectionType | +Int(2) | +
|
+
| Gpc | Boolean |
|
In the mobile or CTV context, the key names to be used in GPP are listed below.
-| GPP Key Name | -Value(s) | -
|---|---|
| IABGPP_8_String | -String: Full encoded USPCA string | -
This section's specifications included in this directory are in public comment until October 27, 2022. Comments may be submitted to support@iabtechlab.com.
+ Contained in this directory are technical specifications for California privacy strings to support CPRA compliance. diff --git "a/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" "b/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" index 9950836..d17d75c 100644 --- "a/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" +++ "b/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" @@ -1,8 +1,28 @@The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
+ +| Date | +Version | +Comments | +
| November 2022 | +1.0 | +Version 1.0 released | +
The Colorado Privacy Section consists of the following components. Users should employ the Colorado Privacy Section only if they have determined the CPA applies to their processing of a consumer's personal data.
+The Colorado Privacy Section consists of the components described below. Users should employ the Colorado Privacy Section only if they have determined the CPA applies to their processing of a consumer's personal data.
| Client side API prefix | -uspco | -The Colorado Privacy Section is registered with client side API prefix "uspco" in the GPP Client Side API. | +usco | +The Colorado Privacy Section is registered with client side API prefix "usco" in the GPP Client Side API. |
0Not Applicable. The Business does not share Personal Data with Third Parties.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not share Personal Data with Third Parties.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. The Business does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable.The Business does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable.The Controller does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. The Business does not Process the specific category of Sensitive Data.
1 Consent
0No Consent
(1) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing a Mental or Physical Health Condition or Diagnosis.
(4) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Sex Life or Sexual Orientation.
(5) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Citizenship Status.
(6) Consent to Process the Consumer's Sensitive Data Consisting of Genetic Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
(7) Consent to Process the Consumer's Sensitive Data Consisting of Biometric Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
0 Not Applicable. The Controller does not Process the specific category of Sensitive Data.
1 Consent
0No Consent
(1) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing a Mental or Physical Health Condition or Diagnosis.
(4) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Sex Life or Sexual Orientation.
(5) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Citizenship Status.
(6) Consent to Process the Consumer's Sensitive Data Consisting of Genetic Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
(7) Consent to Process the Consumer's Sensitive Data Consisting of Biometric Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
0Not Applicable. The Business does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
0 Not Applicable. The Controller does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
0Not Applicable
1 Yes
2 No
1 Yes
2 No
0Not Applicable
1 Yes
2 No
0 Not Applicable
1 Yes
2 No
0Not Applicable
1 Yes
2 No
0 Not Applicable
1 Yes
2 No
In the mobile or CTV context, the key names to be used in GPP are listed below.
+ +GPC is signaled in user agent headers(Sec-GPC) and a simple javascript API (globalPrivacyControl). Entities creating GPP strings should check for whether GPC is set and pass along the value they find (from the headers or javascript API) in this sub-section.
| GPP Key Name | -Value(s) | +Field Name | +GPP Field Type | +Description |
|---|---|---|---|---|
| IABGPP_10_String | -String: Full encoded USPCO string | +SubsectionType | +Int(2) | +
|
+
| Gpc | +Boolean | +
|
This section's specifications included in this directory are in public comment until October 27, 2022. Comments may be submitted to support@iabtechlab.com.
+ Contained in this directory are technical specifications for Colorado privacy strings to support CPA compliance. diff --git "a/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" "b/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" index 84dddc6..fabc30c 100644 --- "a/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" +++ "b/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" @@ -1,8 +1,28 @@The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
+ +| Date | +Version | +Comments | +
| November 2022 | +1.0 | +Version 1.0 released | +
The Connecticut Privacy Section consists of the following components. Users should employ the Connecticut Privacy Section only if they have determined the CAPDP applies to their processing of a consumer's personal data.
+The Connecticut Privacy Section consists of the components described below. Users should employ the Connecticut Privacy Section only if they have determined the CAPDP applies to their processing of a consumer's personal data.
| Client side API prefix | -uspct | -The Connecticut Privacy Section is registered with client side API prefix "uspct" in the GPP Client Side API. | +usct | +The Connecticut Privacy Section is registered with client side API prefix "usct" in the GPP Client Side API. |
0Not Applicable. The Controller does not share Personal Data with Third Parties.
1 Yes
2 No
0 Not Applicable. The Controller does not share Personal Data with Third Parties.
1 Yes
2 No
0Not Applicable. The Controller does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable.The Controller does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable.The Controller does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. The Controller does not Process the specific category of Sensitive Data.
1 Consent
0No Consent
(1) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing a Mental or Physical Health Condition or Diagnosis.
(4) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Sex Life or Sexual Orientation.
(5) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Immigration Status.
(6) Consent to Process the Consumer's Sensitive Data Consisting of Genetic Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
(7) Consent to Process the Consumer's Sensitive Data Consisting of Biometric Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
(8) Consent to Process the Consumer's Sensitive Data Consisting of Precise Geolocation Data.
0 Not Applicable. The Controller does not Process the specific category of Sensitive Data.
1 Consent
0No Consent
(1) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing a Mental or Physical Health Condition or Diagnosis.
(4) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Sex Life or Sexual Orientation.
(5) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Immigration Status.
(6) Consent to Process the Consumer's Sensitive Data Consisting of Genetic Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
(7) Consent to Process the Consumer's Sensitive Data Consisting of Biometric Data that May Be Processed for the Purpose of Uniquely Identifying an Individual.
(8) Consent to Process the Consumer's Sensitive Data Consisting of Precise Geolocation Data.
0Not Applicable. The Controller does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
(1) Consent to Process Sensitive Data from a Known Child.
(2) Consent to Sell the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age.
(3) Consent to Process the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age for Purposes of Targeted Advertising.
0 Not Applicable. The Controller does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
(1) Consent to Process Sensitive Data from a Known Child.
(2) Consent to Sell the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age.
(3) Consent to Process the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age for Purposes of Targeted Advertising.
0Not Applicable
1 Yes
2 No
1 Yes
2 No
0Not Applicable
1 Yes
2 No
0 Not Applicable
1 Yes
2 No
0Not Applicable
1 Yes
2 No
0 Not Applicable
1 Yes
2 No
GPC is signaled in user agent headers(Sec-GPC) and a simple javascript API (globalPrivacyControl). Entities creating GPP strings should check for whether GPC is set and pass along the value they find (from the headers or javascript API) in this sub-section.
| Field Name | GPP Field Type | Description | -
|---|---|---|
| Gpc | -Boolean | -
|
-
In the mobile or CTV context, the key names to be used in GPP are listed below.
-| GPP Key Name | -Value(s) | |||
|---|---|---|---|---|
| IABGPP_12_String | -String: Full encoded USPCT string | +SubsectionType | +Int(2) | +
|
+
| Gpc | +Boolean | +
|
This section's specifications included in this directory are in public comment until October 27, 2022. Comments may be submitted to support@iabtechlab.com.
+ Contained in this directory are technical specifications for Connecticut privacy string to support CAPDP compliance. diff --git a/Sections/US-States/README.md b/Sections/US-States/README.md index a00298f..21f2634 100644 --- a/Sections/US-States/README.md +++ b/Sections/US-States/README.md @@ -1,9 +1,11 @@The section specifications included in this directory are in public comment until October 27, 2022. Comments may be submitted to support@iabtechlab.com.
-The global standard GPP defines a way for local standards to “plug-in” into the existing mechanics defined by GPP and the GPP client side API . The IAB Privacy’s Multi-State Privacy technical specifications were developed by the IAB Tech Lab’s Global Privacy Working Group with the IAB’s Legal Affairs Council providing the policy requirements.
+ + +The global standard GPP defines a way for local standards to “plug-in” into the existing mechanics defined by GPP and the GPP client side API . The IAB Privacy’s Multi-State Privacy technical specifications were developed by the IAB Tech Lab’s Global Privacy Working Group with the IAB’s Legal Affairs Council providing the string requirements.
+The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
+ +| Date | +Version | +Comments | +
| November 2022 | +1.0 | +Version 1.0 released | +
The Utah Privacy Section consists of the following components. Users should employ the Utah Privacy Section only if they have determined the UCPA applies to their processing of a consumer's personal data.
+The Utah Privacy Section consists of the components described below. Users should employ the Utah Privacy Section only if they have determined the UCPA applies to their processing of a consumer's personal data.
| Client side API prefix | -usput | -The Utah Privacy Section is registered with client side API prefix "usput" in the GPP Client Side API. | +usut | +The Utah Privacy Section is registered with client side API prefix "usut" in the GPP Client Side API. |
0Not Applicable. The Controller does not share Personal Data with Third Parties.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not share Personal Data with Third Parties.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. The Controller does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable.The Controller does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable.The Controller does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. The Controller does not Process Sensitive Data.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not Process Sensitive Data.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. The Controller does not Process the specific category of Sensitive Data.
1 Did Not Opt Out
0Opted Out
(1) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Sexual Orientation.
(4) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Immigration Status.
(5) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Medical History, Mental or Physical Health Condition, or Medical Treatment or Diagnosis by a Health Care Professional.
(6) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Genetic Data for the Purpose of Identifying a Specific Individual.
(7) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Biometric Data for the Purpose of Identifying a Specific Individual.
(8) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Specific Geolocation Data.
0 Not Applicable. The Controller does not Process the specific category of Sensitive Data.
1 Opted Out
2 Did Not Opt Out
(1) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Sexual Orientation.
(4) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Immigration Status.
(5) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Personal Data Revealing Medical History, Mental or Physical Health Condition, or Medical Treatment or Diagnosis by a Health Care Professional.
(6) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Genetic Data for the Purpose of Identifying a Specific Individual.
(7) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Biometric Data for the Purpose of Identifying a Specific Individual.
(8) Opt-Out of the Processing of the Consumer's Sensitive Data Consisting of Specific Geolocation Data.
0Not Applicable. The Controller does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
0 Not Applicable. The Controller does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
0Not Applicable
1 Yes
2 No
1 Yes
2 No
0Not Applicable
1 Yes
2 No
0 Not Applicable
1 Yes
2 No
0Not Applicable
1 Yes
2 No
In the mobile or CTV context, the key names to be used in GPP are listed below.
-| GPP Key Name | -Value(s) | -|
|---|---|---|
| IABGPP_11_String | -String: Full encoded USPUT string | +Publisher or Advertiser, as applicable, has enabled "Service Provider Mode" for the "Covered Transaction," as such terms are defined in the MSPA.
|
This section's specifications included in this directory are in public comment until October 27, 2022. Comments may be submitted to support@iabtechlab.com.
- Contained in this directory are technical specifications for Utah privacy strings to support UCPA compliance. diff --git "a/Sections/US-States/VA/GPP Extension: IAB Privacy\342\200\231s Virginia Privacy Technical Specification.md" "b/Sections/US-States/VA/GPP Extension: IAB Privacy\342\200\231s Virginia Privacy Technical Specification.md" index 676ce00..5de11db 100644 --- "a/Sections/US-States/VA/GPP Extension: IAB Privacy\342\200\231s Virginia Privacy Technical Specification.md" +++ "b/Sections/US-States/VA/GPP Extension: IAB Privacy\342\200\231s Virginia Privacy Technical Specification.md" @@ -1,8 +1,29 @@The global standard GPP defines a way for local standards to "plug-in" into the existing mechanics defined by GPP and the GPP client side API. This document outlines the technical specification for using the GPP specifications with the IAB Privacy Multi-State Privacy Agreement legal requirements.
+ +| Date | +Version | +Comments | +
| November 2022 | +1.0 | +Version 1.0 released | +
The Virginia Privacy Section consists of the following components. Users should employ the Virginia Privacy Section only if they have determined the VCDPA applies to their processing of a consumer's personal data.
+The Virginia Privacy Section consists of the components described below. Users should employ the Virginia Privacy Section only if they have determined the VCDPA applies to their processing of a consumer's personal data.
| Client side API prefix | -uspva | -The Virginia Privacy Section is registered with client side API prefix "uspva" in the GPP Client Side API. | +usva | +The Virginia Privacy Section is registered with client side API prefix "usva" in the GPP Client Side API. |
0Not Applicable. The Controller does not share Personal Data with Third Parties.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not share Personal Data with Third Parties.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. The Controller does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable. The Controller does not Sell Personal Data.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable.The Controller does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0 Not Applicable.The Controller does not Process Personal Data for Targeted Advertising.
1 Yes, notice was provided
2 No, notice was not provided
0Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. SaleOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0 Not Applicable. TargetedAdvertisingOptOutNotice value was not applicable or no notice was provided
1 Opted Out
2 Did Not Opt Out
0Not Applicable. The Controller does not Process the specific category of Sensitive Data.
1 Consent
2 No Consent
(1) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing a Mental or Physical Health Diagnosis.
(4) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Sexual Orientation.
(5) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Immigration Status.
(6) Consent to Process the Consumer's Sensitive Data Consisting of Genetic Data for the Purpose of Uniquely Identifying a Natural Person.
(7) Consent to Process the Consumer's Sensitive Data Consisting of Biometric Data for the Purpose of Uniquely Identifying a Natural Person.
(8) Consent to Process the Consumer's Sensitive Data Consisting of Precise Geolocation Data.
0 Not Applicable. The Controller does not Process the specific category of Sensitive Data.
1 Consent
2 No Consent
(1) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Racial or Ethnic Origin.
(2) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Religious Beliefs.
(3) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing a Mental or Physical Health Diagnosis.
(4) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Sexual Orientation.
(5) Consent to Process the Consumer's Sensitive Data Consisting of Personal Data Revealing Citizenship or Immigration Status.
(6) Consent to Process the Consumer's Sensitive Data Consisting of Genetic Data for the Purpose of Uniquely Identifying a Natural Person.
(7) Consent to Process the Consumer's Sensitive Data Consisting of Biometric Data for the Purpose of Uniquely Identifying a Natural Person.
(8) Consent to Process the Consumer's Sensitive Data Consisting of Precise Geolocation Data.
0Not Applicable. The Controller does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
0 Not Applicable. The Controller does not Process Sensitive Data of a known Child.
1 Consent
2 No Consent
0Not Applicable
1 Yes
2 No
1 Yes
2 No
0Not Applicable
1 Yes
2 No
0 Not Applicable
1 Yes
2 No
0Not Applicable
1 Yes
2 No
In the mobile or CTV context, the key names to be used in GPP are listed below.
-| GPP Key Name | -Value(s) | -|
|---|---|---|
| IABGPP_9_String | -String: Full encoded USPVA string | +Publisher or Advertiser, as applicable, has enabled "Service Provider Mode" for the "Covered Transaction," as such terms are defined in the MSPA.
|
The section specifications included in this directory are in public comment until October 27, 2022. Comments may be submitted to support@iabtechlab.com.
- -Contained in this directory are technical specifications for Connecticut privacy strings to support VCDPA compliance. +Contained in this directory are technical specifications for Virginia privacy strings to support VCDPA compliance.