NEW YORK—-IAB Tech Lab, the global digital advertising technical standards-setting body, has announced two major developments in a work on privacy-focused standards by unveiling updates to the Global Privacy Protocol (GPP) and releasing Version 2 of the Data Deletion Request Framework (DDRF).
Both initiatives, developed with leadership from the Global Privacy Working Group, are now open for public comment through December 1, 2025.
Global Privacy Protocol (GPP) H2 2025 Update
The latest GPP updates introduce four new U.S. state sections — Maryland (effective October 1, 2025), Indiana, Kentucky, and Rhode Island (all effective January 1, 2026) — to reflect recently enacted consumer privacy laws.
Updates also include a rearchitecture initiative designed to future-proof U.S. sections and increase signal transparency in the core GPP specifications, the IAB Tech Lab explained.
"By expanding the Global Privacy Protocol to cover additional states and enhancing the core framework, we're helping the industry plan with confidence," said Anthony Katsur, CEO, IAB Tech Lab. "The bi-annual release cycle gives companies predictability while keeping transparency and user choice at the core."
Starting in 2026, regular bi-annual updates will give companies the predictability they need to align product roadmaps with shifting regulatory timelines.
"The bi-annual release cycle is especially valuable for companies like ours," said Andrea Wheeler, senior privacy manager, Quantcast. "It gives us the predictability to align development roadmaps with regulatory timelines, while the added transparency ensures we can continue to uphold user trust as privacy requirements evolve."
The update also introduces improved clarity around how supported and applicable sections are communicated within the GPP framework. In the CMP API, the PingReturn.supportedAPIs field provides information about which sections the CMP supports, as directed by the first party.
The IAB Tech Lab noted that until now, there has been no equivalent mechanism that downstream vendors could rely on server-side. Two implementation options have been proposed, and IAB Tech Lab is inviting industry feedback to identify the most effective path forward.
Data Deletion Request Framework (DDRF) Version 2
Building on broad industry adoption, DDRF V2 strengthens interoperability, consistency, and security for processing consumer deletion requests. The update introduces clearer object formats, standardized encoding methods, and enhanced safeguards to secure sensitive consumer data as it flows across the digital advertising supply chain, the Lab reported.
"We designed DDRF V2 to help reduce complexity and risk for the industry," said Rowena Lam, senior director, product, IAB Tech Lab. "By standardizing formats and processes, organizations can easily comply with regulatory requirements while protecting consumer data rights."
"With this release, we are not only improving interoperability and transparency but also strengthening the security of the framework," added Katsur. "These enhancements will help foster trust with consumers while reducing compliance risks across the ecosystem."
Recognized by regulators globally, such as the Information Commissioner's Office, and already a cornerstone for deletion request processing, DDRF V2 reduces complexity while providing organizations with more robust compliance mechanisms, the IAB Tech Lab reported.
Both the GPP and DDRF initiatives are part of IAB Tech Lab's ongoing global effort to develop privacy-centric, interoperable solutions that sustain trust in digital advertising. By introducing predictable release cycles, clearer frameworks, and stronger safeguards, IAB Tech Lab continues to help companies navigate evolving regulations with confidence.
To learn more about the Global Privacy Protocol 2nd Half 2025 updates, click here: https://iabtechlab.com/2h-2025-gpp-and-ddrf-updates/
To review the Data Deletion Request Framework Version 2 standards, click here: https://github.com/InteractiveAdvertisingBureau/Data-Subject-Rights/pull/9
Both are now open for public comment through December 1, 2025.
