.svg)
The U.S. still has no federal privacy law, but it does have a fast-growing patchwork of state ones. For anyone in digital advertising, that means different opt-out rules, different definitions of sensitive data, and different enforcement priorities from state to state. The Multi-State Privacy Agreement (MSPA) is the advertising industry’s attempt to tame that complexity with one shared contract.
We recently hosted a webinar with the Interactive Advertising Bureau (IAB) where Andrew Tobel, the organization's Assistant General Counsel, joined us in discussing why the MSPA exists, how it works, and what signing it involves. This article pulls together the key takeaways from our conversation, which you can watch in its entirety at the end.
What is the Multi-State Privacy Agreement (MSPA)?
The MSPA is a private, contract-based framework published by the IAB. Publishers, agencies, ad networks, supply-side platforms (SSPs), demand-side platforms (DSPs), and data providers can sign to join the agreement. Signatories make consistent legal commitments about how personal information moves through advertising transactions, instead of negotiating separate data processing agreements (DPAs) with every partner.
The patchwork of state regulations creates an increasingly complicated compliance landscape for the digital advertising industry.
- Michael Hahn, EVP, General Counsel, IAB and IAB Tech Lab (source: IAB, October 2022)
It grew out of the Limited Service Provider Agreement (LSPA), created in 2020 to support compliance with the California Consumer Privacy Act (CCPA). The MSPA widened that approach to cover additional state laws. It’s designed to work alongside the IAB Tech Lab’s Global Privacy Platform (GPP), which carries users’ privacy choices between parties as technical signals.
The current version, the Fifth Amended and Restated MSPA, drops the state-by-state approach in favor of a national one:
We’re going to treat every visitor to your website as if they existed in every state at the same time so that we are meeting that highest common denominator across all states.
- Andrew Tobel, Assistant General Counsel at IAB (source: Didomi x IAB MSPA webinar)
The MSPA is a voluntary agreement. It’s open to any company in digital advertising, whether or not they’re IAB members. It also isn’t a compliance guarantee, and it doesn’t replace your privacy notice or guarantee compliance with any specific state law.
How the MSPA works
At its core, the MSPA works in three layers: a contract, a set of signals, and an operational commitment to honor them.
- Companies sign one shared agreement: Instead of negotiating a separate DPA with every partner, participants sign the MSPA once. It supplies the contract terms that U.S. state privacy laws require, which reduces the need for separate DPAs among signatories. Signatories also identify which of their advertising transactions the agreement covers, so everyone knows where its terms apply.
- The agreement defines each party’s role: Under the current version, ad tech companies receiving personal data in covered transactions are generally treated as service providers to the advertiser, and each party’s obligations follow from that role.
- Privacy choices travel as signals: When a user opts out, that choice has to reach every partner in the chain. That’s the job of the GPP, which packages a user’s choices into a standardized signal passed along with the ad request. Partners read the signal and adjust how they handle the data accordingly.
The GPP communicates the signal, but it does not by itself establish those contractual obligations governing what recipients must do with the signal. It’s the MSPA that is signed by each party that does that.
- Andrew Tobel, Assistant General Counsel at IAB (source: Didomi x IAB MSPA webinar)
In order for all of this to matter, your consent management platform (CMP) must support GPP and MSPA. The CMP generates the signal that carries that choice downstream and must be configured properly after signing the contract. If the signal is wrong or missing, the contract’s promises aren’t being kept in practice.
Each party’s role depends on which of two modes the first-party choses for its covered transactions:
- In Service Provider Mode, downstream participants always act as service providers, so targeted advertising and third-party segment creation are not permitted.
- In Opt-Out Option Mode, downstream participants act as service providers only for consumers who opt out of sales, targeted advertising or sharing. For all other consumers, every activity listed in the diagram below is permitted.
Questions you may have about the MSPA
Here are answers to some of the most common questions about signing the MSPA.
Who should consider signing?
- Publishers monetizing through programmatic advertising and passing user data to partners.
- Advertisers who want direct, consistent terms with ad tech vendors rather than relying on indirect agency contracts.
- Ad tech and data companies that want to reduce contract negotiation with every counterparty.
How do I sign up?
- Go to the portal: Open the IAB Privacy website or log into the IAB Tech Lab Tool Portal.
- Review the agreement: Access the current version of the MSPA, its Appendix I (Definitions), and the Tech Vendor Data Processing Addendum. (Note: Signing is a legal decision. Talk to your legal counsel about whether the MSPA fits your data flows, which of your transactions it should cover, and how it interacts with your existing contracts.)
- Complete the submission: Fill out the required company and signatory details on the platform to formalize your status as an MSPA participant.
How do I configure the MSPA in the Didomi Console?
For detailed instructions on setting up MSPA within the Didomi console, check out our Multi-State Privacy Agreement documentation or watch the webinar recording below.
What does signing mean for legal risk? What if a vendor doesn’t honor the agreement?
The MSPA only covers data transactions between signatories (or in some cases, partners that offer equivalent protections through IAB’s Certified Partner Program). Each signatory must comply with the requirements that apply to them. Checking whether a partner, vendor or third party is a signatory or a certified partner is part of your due diligence. The IAB’s own materials flag that a company may face liability for its vendors’ actions where due diligence was insufficient. Some U.S. state laws also include diligence requirements that apply to advertisers’ disclosures of personal information.
For more information on the legal ramifications and actions, please consult with the IAB.
Getting started with the MSPA
The MSPA gives the advertising ecosystem one set of contract terms and one signal to carry users’ opt-out choices. As a publisher, advertiser or anyone else in the advertising space, using the GPP signal and becoming an MSPA signatory can simplify your privacy transactions and help carry users’ choices across the ecosystem. It isn’t a compliance guarantee, but it clears the way for the bigger question Andrew Tobel raised near the end of the webinar:
How do we work together faster, and how do we work together in a consumer-transparent way?
- Andrew Tobel, Assistant General Counsel at IAB (source: Didomi x IAB MSPA webinar)
To learn more, watch the recording of our MSPA webinar with the IAB:
