MSPA US National¶

MSPA US National consent signal is a specific part of the Global Privacy Platform (GPP) that tells vendors:

• whether the user was shown a notice (e.g. "we sell/share your data for X"), and

• whether the user opted out or consented to that.

In Usercentrics CMP,  if you are using a US legislation framework, you can activate MSPA US National framework. This template includes consent signaling to third-party vendors. You can declare being a signatory to the Multi-State Privacy Agreement and choose the applicable serving mode.

The following sections explain how to activate MSPA US National in Usercentrics CMP.

Prerequisites¶

The MSPA US National setup is available for configurations that use:

• a legal framework in the US (CCPA, CPRA, CPA, CTDPA, UCPA, VCDPA, MSPL, etc.), and

• V3 script tag.

Configuring MSPA US National¶

To enable MSPA US National for a specific configuration, follow these steps:

1. In the Admin Interface, select the configuration where you want to apply GPP MSPA US National.

2. Navigate to the Configuration page.

3. On the Legal Specifications tab, activate the toggle under Enable GPP MSPA US National.

4. If you want to declare your company at IAB as an organization using MSPA (i.e. if you want to be a signatory of MSPA), select the checkbox next to Declare your organization as a signatory to the Multi-State Privacy Agreement (MSPA).

   Benefits of declaring your company as a signatory of MSPA

   If you mark your company as an MSPA signatory:

   • Your CMP will include that info in the GPP consent signal so vendors can see it.

   • Vendors that also signed the MSPA can follow the same standardized rules and your GPP signals, meaning less custom legal work and fewer mismatches. You can choose how you work with vendors under the MSPA rules:

     • Opt-Out Option Mode: vendors act as independent parties that must honor user opt-outs.
     • Service Provider Mode: vendors act as your service providers with tighter use limits.

   • If a vendor is not an MSPA signatory, you can still work with them, but not under the MSPA's standardized terms.

   Learn more or become a signatory at iabprivacy.com.

In the MSPA serving mode drop-down, select one of the following options:

1. Opt Out Option Mode
   This mode records opt-outs through the MSPA consent signal.
   Usually, this mode is required by vendors in the digital ads ecosystem.

2. Service Provider Mode
   If you are using this setting, you are declaring within the requirements of MSPA that you are not engaging in any processing that requires you to provide the user with an opt-out notice, and therefore an opt-out signal is not transmitted.
   Opt-outs are recorded by the CMP, but they are not recorded through the MSPA consent signal when the user interacts with “Do not sell my data”.
   The consent signal will declare that no notice was provided for selling or sharing of data, and similarly, no opt-out or consent can be collected for the MSPA US National consent signal.

Implementing MSPA US National¶

Once you enable GPP MSPA US National, the script tag is available on the Implementation page of the Admin Interface. It includes the gpp stub, which must be present before the CMP script to utilize GPP. We recommend that you simply copy the script from the Admin Interface.

FAQ¶

Can I use a V2 script tag with GPP?¶

No. GPP is only supported in Usercentrics V3 and will not be available in V2.

Why use GPP MSPA US National?¶

MSPA US National allows you to share consent signaling to your vendors, that enable digital advertising and data use cases. By using the US National approach, you are adopting a method that can be used across all the US states, instead of having to do a state-by-state configuration. It effectively “stacks” all relevant state requirements on top of each other and applies them uniformly to the consumer. This reduces setup complexity significantly, and allows you to scale with users and privacy requirements in various US states.

Who should use MSPA US National?¶

For publishers or websites engaging with selling of data or advertising, you should consider adopting the MSPA US National framework.

How about Florida?¶

The IAB and the MSPA do not allow the US National Approach (usnat) to be applied to Florida residents. For Florida users, the CMP will instead provide a Florida-specific state section (usfl) of the GPP string to ensure valid consent signaling.

What is the Multi-State Privacy Agreement?¶

The Multi-State Privacy Agreement (MSPA) is a standardized contract framework developed in the United States to streamline data privacy compliance for vendors (like ad tech vendors, publishers, and software providers). It was created by the IAB (Interactive Advertising Bureau) Tech Lab in collaboration with state regulators and industry participants.

The MSPA can be signed from iabprivacy.com. Once this is done, you can configure your signatory status accordingly in the Usercentrics UI, to reflect this in the consent signal.

What is a Covered Transaction?¶

In the Multi-State Privacy Agreement (MSPA), a Covered Transaction is one where all parties are signatories to the MSPA.

• If you are a signatory and enable GPP signaling, vendors in the ecosystem are contractually obligated to honor those signals.

• If you are not a signatory, vendors may choose not to process requests, since the transaction would not be covered by the MSPA framework.

You can review and sign the MSPA on the IAB website.

What happens when activating MSPA US National?¶

When enabling the MSPA US National, you will start to send consent signals to your third party vendors that are able to read them to understand if the user for example opted out of selling or sharing of data. This can be important to meet your privacy obligations under US state privacy laws.

What happens if the user is not in the US?¶

If the user is not in the US, MSPA US National will not be used, and no section will appear under “parsedSections” in the API response.

How can the user opt out?¶

If the user selects “do not sell my data” or utilizes a similar opt out function, this will be reflected in the consent signal, where the opt out signals will be configured accordingly.

What if the user is utilizing Global Privacy Control (GPC)?¶

When a browser or extension transmits GPC, the Usercentrics CMP reads the signal and encodes it into the GPP US National section. This will not impact the opt out signals, but vendors are then expected to recognize the GPC signal as the more limited Processing of Personal Information, and apply this when there can be conflicting signals.

How can I provide notice to customers?¶

For MSPA signaling to be valid, consumers must first be given appropriate notices for Sale of personal information, Sharing of personal information and Processing for targeted advertising.

The CMP is configured to always register that notice was shown. It is your responsibility to ensure that your notices are compliant with state law, and if applicable, the Multi-state Privacy Agreement.

Are there any consent signals that are not supported by Usercentrics?¶

Usercentrics CMP does not support collection of consent for the following fields: SensitiveDataProcessing, PersonalDataConsents (Secondary Use) and KnownChildSensitiveDataConsents. These, as well as the associated Notice fields, are always set to “Not Applicable” in the consent signal.

Properties¶

The following table shows how the signal is created, which properties are controlled by manual input, and which are inferred from interaction with the CMP. Some properties are not supported by Usercentrics CMP, which is also described below.