IAB Tech Lab updates GPP privacy standard, finalizes DDRF 2.0 framework
IAB Tech Lab finalized version 2.0 of the Data Deletion Request Framework (DDRF) and opened a public comment period, running through September 11, 2026, on proposed changes to the Global Privacy Protocol (GPP). The GPP updates support the Fifth Amended and Restated Multi-State Privacy Agreement (MSPA): they remove the previous state-by-state coverage approach, eliminate Service Provider and Opt-Out Option Modes, drop secondary usage consents, and simplify notice and choice fields. DDRF 2.0, finalized after a comment period that opened in fall 2025, clarifies identity and deletion request JWT definitions, improves result feedback and troubleshooting, strengthens framework integrity, and adds support for implementation-specific extensions. Both efforts came out of IAB Tech Lab's Global Privacy Working Group and its Privacy Rearc Commit Group (PRCG).
Consent strings built on the current GPP fields stop validating once the new notice and choice structure rolls out, so any platform that reads or writes GPP signals in the bid stream, on-site consent management or measurement pipelines needs to update before the old format is retired. Deletion requests become easier to automate and audit under DDRF 2.0, which matters for any company storing viewer-level or user-level data and needing to show regulators and clients how it handles removal requests.