The IAB Tech Lab has announced two major developments aimed at strengthening privacy and transparency across the digital advertising ecosystem: a new update to the Global Privacy Protocol (GPP) and the release of Version 2 of the Data Deletion Request Framework (DDRF). Both updates are now open for public comment through December 1.
GPP update adds new states, improves future readiness
The latest GPP update reflects the expanding patchwork of U.S. privacy laws by incorporating new sections for Maryland (which went into effect at the start of October), Indiana, Kentucky and Rhode Island (all effective January 1). These additions follow a broader rearchitecture of the framework aimed at increasing signal transparency and future-proofing the protocol for further state-level developments.
Dig deeper: U.S. state data privacy laws: What you need to know
Beginning in 2026, IAB Tech Lab will adopt a bi-annual release cycle for GPP updates, providing companies with a more predictable roadmap to align development with evolving privacy regulations.
“The bi-annual release cycle gives companies predictability while keeping transparency and user choice at the core,” Anthony Katsur, CEO of IAB Tech Lab, said in a statement. “We’re helping the industry plan with confidence.”
The update also tackles a longstanding challenge for downstream vendors by proposing two implementation options to improve clarity around supported and applicable sections in server-side applications. Industry feedback is being solicited to determine the best approach.
DDRF V2 strengthens deletion request handling
Version 2 of the Data Deletion Request Framework builds on growing industry adoption, introducing standardized object formats, encoding methods and security enhancements designed to improve interoperability and reduce compliance risk.
“We designed DDRF V2 to help reduce complexity and risk for the industry, Rowena Lam, senior director of product at IAB Tech Lab, said in a statement. “Organizations can more easily comply with regulatory requirements while protecting consumer data rights.”
Already in use and recognized by regulators, DDRF helps companies process consumer deletion requests consistently across the supply chain. The second version reinforces its role as a privacy infrastructure standard.
Part of Project Rearc
Both updates are part of IAB Tech Lab’s broader Project Rearc initiative, which aims to develop privacy-centric standards that support addressability and accountability in digital advertising. By introducing consistent release schedules and refining core frameworks, the organization hopes to equip the industry with tools to meet regulatory demands while maintaining consumer trust.
To learn more or submit feedback:
Public comments are open through December 1.
The post IAB Tech Lab pushes privacy standards forward with GPP and DDRF updates appeared first on MarTech.