NEW YORK—In a move that will streamline compliance with state privacy rules, Interactive Advertising Bureau (IAB) has announced significant updates to its Multi-State Privacy Agreement (MSPA) that the groups described as the most substantive amendments to the framework since 2023.
The updates are designed to aid advertisers’ compliance and business objectives by simplifying privacy law compliance, reducing partner contracting friction, closing contractual gaps, and strengthening protections under U.S. state privacy laws.
The IAB noted that as privacy enforcement accelerates across the U.S., advertisers face increasing business risk relating to the personal data flowing through agencies, ad tech vendors, measurement providers, and other downstream partners. Recent state enforcement actions have highlighted the fact that advertisers remain responsible for protecting consumer data, even when the data is shared with or otherwise activated by third parties.
“This update makes the MSPA an even more powerful tool for the digital advertising ecosystem,” said David Cohen, CEO, IAB. “In a time of increasing enforcement and complexity, we’re giving advertisers and their partners a clear, trusted framework that simplifies compliance, accelerates collaboration, and protects them in a meaningful way. As adoption grows, the value multiplies—creating a shared standard that helps the entire industry move faster, with greater confidence, while reinforcing consumer trust and supporting the ad-supported internet people rely on every day.”
The revised MSPA introduces advertiser-specific updates that simplify compliance and speed adoption across the ecosystem, including a streamlined structure that increases accessibility for major brands and clarifies how ad tech partners may process personal data—creating a consistent compliance baseline across covered transactions without the need for custom contract amendments or repeated negotiations. The result is unlocked business opportunities and a quicker go-to-market approach with partners that are MSPA signatories, the IAB explained.
The group also stressed that state regulators are making clear that strong contractual controls over personal data are no longer optional.
Recent California enforcement actions involving Healthline Media and American Honda Motor Co. highlight, amongst other things, breakdowns tied to not having required privacy terms in contracts. In the Healthline enforcement action, California regulators highlighted that Healthline could, in part, return to CCPA compliance by complying with the MSPA.
More information is available here.
