Six U.S. States added to global privacy platform amid evolving regulations

On August 1, 2024, the IAB Tech Lab announced the expansion of its Global Privacy Platform (GPP) to include six additional U.S. states: Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and Tennessee. This development marks a significant step in the ongoing efforts to address the rapidly evolving landscape of privacy regulations across the United States. The announcement was made through a detailed Pull Request (PR) on the IAB Tech Lab's official repository, outlining the proposed changes and inviting stakeholder feedback.

The Global Privacy Platform, a crucial tool for digital advertising and media companies, aims to streamline compliance with various privacy regulations worldwide. This latest update reflects the IAB Tech Lab's proactive approach to keeping the GPP ahead of impending privacy laws, as several states approach effective dates for new regulations in late 2024 and the first half of 2025.

The expansion of the GPP is being spearheaded by the Global Privacy Working Group, a dedicated team within the IAB Tech Lab. Their work involves creating comprehensive technical specifications for each new state section, ensuring that implementers have the necessary tools to navigate the complex web of privacy requirements across different jurisdictions.

Delving into the technical aspects of the update, the PR (Pull Request) introduces dedicated folders and README files for each of the six new states. These additions are not merely placeholder content; they contain detailed technical specifications tailored to each state's unique regulatory landscape. This granular approach underscores the complexity of privacy regulations in the United States, where requirements can vary significantly from one state to another.

One of the most notable aspects of this update is the public comment period, which extends until September 5, 2024. This open invitation for feedback demonstrates the IAB Tech Lab's commitment to collaborative development and transparency. Stakeholders are encouraged to provide input either by directly commenting on the PR or by reaching out via email to support@iabtechlab.com. This inclusive approach ensures that the final implementation will benefit from diverse perspectives and expertise within the industry.

The PR itself is substantial, comprising 16 commits that detail the changes for each new state section. Each commit message offers insights into the specific modifications made, providing a clear audit trail for reviewers and future implementers. This level of detail is crucial for maintaining the integrity and traceability of the GPP's development process.

Beyond the addition of new state sections, the update also includes revisions to the Section Information document. This comprehensive overview now incorporates the six new states, ensuring that users have a complete picture of the GPP's coverage. Such thoroughness is essential for organizations operating across multiple states, as it allows them to quickly assess their compliance needs and implement appropriate measures.

It's important to note that while this update significantly expands the GPP's coverage, it does not yet represent a complete picture of U.S. privacy regulations. The Global Privacy Working Group is concurrently drafting updates to the US National section of the GPP. Currently, this section covers California, Colorado, Connecticut, Virginia, and Utah. However, it does not yet include coverage for Florida, Montana, Oregon, Texas, or the six states added in this latest update.

This temporary gap in coverage highlights the dynamic nature of privacy regulations and the challenges faced by organizations striving to maintain compliance. The IAB Tech Lab has explicitly warned that those relying on the US National section as part of their compliance strategy should be aware of this limitation. This transparency is crucial for preventing any misconceptions about the current scope of the GPP's coverage.

The context for this rapid expansion of the GPP lies in the accelerating pace of privacy legislation across the United States. In recent years, numerous states have enacted or proposed comprehensive privacy laws, often inspired by but distinct from the California Consumer Privacy Act (CCPA) and the European Union's General Data Protection Regulation (GDPR). This patchwork of regulations presents significant challenges for businesses operating across state lines, necessitating tools like the GPP to navigate the complex compliance landscape.

The addition of these six states to the GPP is particularly timely. Delaware, for instance, recently passed the Delaware Personal Data Privacy Act, set to take effect on January 1, 2025. Similarly, Iowa's privacy law comes into force on January 1, 2025, while Tennessee's Information Privacy Act becomes effective on July 1, 2025. By incorporating these states into the GPP now, the IAB Tech Lab is providing businesses with valuable lead time to prepare for these impending regulations.

The technical implementation of these new state sections within the GPP involves more than just adding new folders and files. Each state section must be carefully integrated into the existing framework, ensuring compatibility with the platform's overall structure and functionality. This process requires meticulous attention to detail and a deep understanding of both the technical aspects of the GPP and the nuances of each state's privacy laws.

As the public comment period progresses, it is likely that the proposed changes will undergo further refinement based on stakeholder feedback. This iterative process is crucial for ensuring that the final implementation meets the needs of the diverse array of organizations that rely on the GPP for privacy compliance.

In conclusion, the expansion of the Global Privacy Platform to include six additional U.S. states represents a significant milestone in the ongoing evolution of privacy compliance tools. It reflects the IAB Tech Lab's commitment to staying ahead of regulatory changes and providing the industry with robust, adaptable solutions. As privacy regulations continue to proliferate and evolve, tools like the GPP will play an increasingly vital role in helping organizations navigate this complex landscape.

Key facts

The GPP expansion was announced on August 1, 2024.

Six new states added: Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and Tennessee.

Public comment period runs until September 5, 2024.

The update includes 16 commits detailing changes for each new state section.

The US National section of the GPP is being updated separately and currently has limited coverage.

New state privacy laws are set to take effect in late 2024 and early 2025.

The GPP aims to streamline compliance with various privacy regulations across different jurisdictions.