Google adds privacy controls for Indiana, Kentucky, and Rhode Island

On November 17, 2025, Google announced that Indiana, Kentucky, and Rhode Island will join the growing list of states where publishers can activate Restricted Data Processing mode to comply with comprehensive privacy legislation. The three states will implement their respective privacy laws on January 1, 2026, according to the company's AdSense and Ad Manager help documentation.

Google's approach in these states mirrors the framework deployed across existing states with active comprehensive privacy laws. The Indiana Consumer Data Protection Law, Kentucky Consumer Data Protection Act, and Rhode Island Data Transparency will all take effect simultaneously at the start of 2026, creating compliance requirements for publishers operating advertising inventory in these jurisdictions.

Activating Restricted Data Processing mode disables ad personalization, which may help publishers honor opt-outs for targeted advertising and avoid activities that could be considered a "sale" or "sharing" of user data, according to Google's announcement. Publishers can send RDP signals via GPP National v2, which now supports these three new states alongside existing state frameworks.

The implementation builds upon Google's existing service provider terms, which supplement the company's General Data Protection Regulation data protection terms. For customers using online contracts and updated platform contracts, the service provider terms incorporate automatically through existing data protection terms without requiring additional action from publishers, according to the Ad Manager documentation.

Publishers receive multiple options for configuring Restricted Data Processing across Google's advertising platforms. Consent management platforms can communicate Global Privacy Platform consent signals to advertising partners based on consent types received from users. Publishers gained access to GPP National v2 support starting October 6, 2025, providing standardized mechanisms for transmitting privacy preferences across jurisdictions.

The IAB Tech Lab's Global Privacy Platform framework addresses compliance requirements across multiple state privacy laws through standardized signal transmission. When RDP signals activate, Ad Manager will not serve ads based on users' prior behavior and will send non-personalized ad requests to bidders, according to the help documentation. Publishers can also activate RDP for specific users via GPT and AdSense/Ad Exchange asynchronous ad tags on a per-request basis.

Google's support for the IAB Tech Lab US Privacy String continues despite the framework's deprecation in January 2024. The platform maintains backward compatibility to support publishers during the transition period, though Google recommends migration to GPP strings instead. Ad Manager will continue reading US Privacy Strings to provide backward support to partners, with potential deprecation in future releases, according to the company's documentation.

The Global Privacy Platform specifications that Ad Manager accepts include US National, California, Colorado, Connecticut, Florida, and Virginia strings. Google triggers restricted data processing when users opt out of sale of personal information, opt out of sharing personal information, or opt out of processing personal data for targeted advertising, according to the supporting documentation on GPP implementation.

Kentucky's legislation establishes consumer rights relating to personal data, including rights to confirm whether data is being processed, correct inaccuracies, delete personal data provided by consumers, obtain copies of previously provided personal data, and opt out of targeted advertising, data sales, or profiling. The Kentucky Consumer Data Protection Act grants the Attorney General exclusive authority to enforce consumer data privacy rights and creates a consumer privacy fund administered by the Office of the Attorney General, according to the legislative summary.

The Kentucky bill passed through multiple legislative stages during the 2024 Regular Session. The House introduced the legislation on February 2, 2024, and passed it 92-0 on February 20 after adopting Floor Amendment 1. The Senate passed the bill 35-0 on March 11 after adopting two floor amendments. The House concurred with Senate amendments on March 27 by a 94-0 vote. Governor Andy Beshear signed the bill into law on April 4, 2024, as Acts Chapter 72.

Publishers operating across multiple states face increasingly complex compliance requirements as state privacy legislation continues expanding. Google implemented privacy controls for eight additional states including Connecticut, Montana, Nebraska, New Hampshire, Texas, Minnesota, New Jersey, and Maryland in June 2025. The platform activated GPC signal processing for Delaware and Oregon on November 17, 2025.

Five states including Iowa, Delaware, New Jersey, Nebraska, and New Hampshire implemented privacy laws in January 2025, with account-level RDP settings automatically applying to traffic from these states starting November 15, 2024. Each state law contains distinct requirements for consent collection, data sale opt-outs, and targeted advertising restrictions, creating operational challenges for publishers and advertising technology vendors operating across state boundaries.

Google emphasized that publishers should work with legal teams to determine whether RDP represents the appropriate solution for their compliance needs. Publishers currently leveraging RDP should consult legal counsel to understand whether they should expand RDP usage to additional states as privacy laws take effect, according to the company's guidance.

The technical implementation of Restricted Data Processing removes user identifiers for audience targeting and limits data sharing with demand-side platforms and other advertising partners. Cookie-based tracking becomes significantly limited under RDP mode, with the system processing ad requests without utilizing persistent identifiers that enable cross-site tracking or detailed behavioral profiling.

The expansion reflects accelerating privacy regulation across the United States. Fourteen state privacy laws were enforceable at the start of 2025, with additional legislation expected throughout the year. The patchwork of state-specific requirements necessitates technical solutions like the Global Privacy Platform to enable advertisers, publishers, and technology vendors to adapt to regulatory demands across markets through standardized mechanisms.

Publishers maintaining account-level RDP configurations will see those settings apply automatically to traffic from Indiana, Kentucky, and Rhode Island starting January 1, 2026. This automated application follows the pattern established for previous state implementations, where Google applies account-level settings to new jurisdictions as their privacy laws take effect.

The company does not sell personal information and provides users with transparency and control over ad experiences via My Ad Center, My Account, and several other features. Google's Personalized advertising policy prohibits using sensitive information like health, race, religion, or sexual orientation to personalize ads. The company invests in initiatives including the Coalition for Better Ads, the Google News Initiative, and ads.txt to support a healthy advertising ecosystem.

Timeline

• February 2, 2024: Kentucky introduces House Bill 15 establishing consumer data privacy rights
• April 4, 2024: Kentucky Governor Andy Beshear signs Kentucky Consumer Data Protection Act into law
• August 1, 2024: IAB Tech Lab expands Global Privacy Platform to include six additional states
• October 6, 2025: Google AdSense adds support for Global Privacy Protocol National v2
• October 20, 2024: Google announces privacy law updates for five states effective January 2025
• June 30, 2025: Google expands privacy controls to eight additional US states including Connecticut, Montana, Nebraska, New Hampshire, Texas, Minnesota, New Jersey, and Maryland
• November 17, 2025: Google announces support for Indiana, Kentucky, and Rhode Island privacy laws
• November 17, 2025: Google activates privacy controls in Delaware and Oregon via GPC signals
• January 1, 2026: Indiana Consumer Data Protection Law, Kentucky Consumer Data Protection Act, and Rhode Island Data Transparency take effect

Summary

Who: Google AdSense and Ad Manager platforms implementing privacy compliance features affecting publishers with audiences in Indiana, Kentucky, and Rhode Island, along with users in these states who may exercise privacy rights under new legislation.

What: Implementation of Restricted Data Processing mode supporting compliance with three state privacy laws that grant consumers rights to opt out of targeted advertising, data sales, and profiling. Publishers can activate RDP through consent management platforms using Global Privacy Platform National v2, publisher ad tags, or account-level settings.

When: Announced November 17, 2025, with state privacy laws taking effect January 1, 2026. Account-level RDP settings will automatically apply to traffic from these three states starting at the effective date.

Where: Indiana, Kentucky, and Rhode Island join 14 other states with enforceable comprehensive privacy legislation as of early 2025. The expansion affects publishers operating advertising inventory reaching users in these jurisdictions.

Why: State privacy legislation mandates consumer rights including the ability to opt out of targeted advertising, data sales, and profiling activities. Google's Restricted Data Processing mode provides technical mechanisms for publishers to honor these opt-outs and avoid activities potentially classified as prohibited data sharing under state laws.