US Privacy was deprecated on 31 January 2024

Four characters

Four characters: a version digit, then explicit notice, opt-out of sale, and LSPA coverage. Each of the last three is Y, N, or a hyphen. 1YNN is the textbook yes-notice, no-opt-out, no-LSPA value. 1--- is the documented way to say no US privacy jurisdiction applies. 1Y, 1YNNN, 1YNNtrue, YES, and true are not strings. That is core.privacy.us_privacy_malformed.

The hyphens in the last three slots are the spec's not-applicable character, not an en dash and not a missing field. Do not send 1Y_N. Do not send 1Y/N/N. Do not URL-encode the hyphens into something else. Pass the four characters the CMP emitted.

https://example.com/px?id=1&us_privacy=YES
https://example.com/px?id=1&us_privacy=1YNN

Only version 1

Only version 1 was published. A leading 2 with an otherwise legal tail is the right shape and the wrong version. Pixellint warns on that separately as core.privacy.us_privacy_version. Do not migrate by bumping the digit. Migrate by sending gpp and gpp_sid.

A well-formed 1YNN is still deprecated. Shape check and deprecation warning can both fire. That is not a contradiction. The string is legal US Privacy and it is also a generation IAB Tech Lab asked the industry to leave. Fix malformed first. Plan the GPP cutover on a calendar, not by inventing version 2 of this four-character field.

https://example.com/px?id=1&us_privacy=2YNN

Deprecated is not malformed

IAB Tech Lab deprecated the US Privacy signal on 31 January 2024 in favor of the Global Privacy Platform. Pixellint still checks the shape, and it always warns that the parameter is deprecated under core.privacy.us_privacy_deprecated. A well-formed 1YNN on a live pixel is a migration finding, not a trafficking accident.

Sending us_privacy and GPP together during a cutover is fine. Different keys. Not a duplicate_signal. Dropping us_privacy before every partner reads GPP will look like you went silent in California. Keep the old string until the bid path and the pixel path both consume gpp_sid.

Not Limited Data Use

Meta's dpo=LDU is a product parameter, not the IAB US Privacy string. You may need both. They are not substitutes. A publisher who sets us_privacy and never sets dpo, dpoco, and dpost has not configured Meta. A brand who sets LDU and never sends GPP has not configured the open web.

us_privacy=1YNN does not set dpo. gpp does not set dpo. Meta does not read a Floodlight us_privacy field you never fired at facebook.com/tr. If California Limited Data Use is the product control you want, traffic LDU on the Meta pixel and CAPI. If IAB US state signaling is the control, traffic GPP. If both apply, send both.

https://www.facebook.com/tr?id=1234567890123456&ev=PageView&us_privacy=1YNN

Empty values and macros

Empty values and unexpanded ${US_PRIVACY} macros are exemptions, same as the other IAB fields. A template that holds the token is correct trafficking. A fired URL that still holds the token never sent the signal. Core privacy rules skip the format check on those slots. Macro rules then fail the fired state.

CMP vendors emit GPP now. If your ad server macro is still ${US_PRIVACY} and nothing else, the creative is living in 2023. Update the macro map when you update the CMP, and confirm on a fired URL, not on the template. pixellint validate url is the check for the live hop.

https://example.com/px?id=1&us_privacy=${US_PRIVACY}

Check the artifact

Paste the pixel URL or JSON body into the playground. Same engine as pixellint validate. Nothing leaves the tab.