IAB ANNOUNCES MOST SIGNIFICANT UPDATE IN YEARS TO MULTI-STATE PRIVACY AGREEMENT

Updated Framework Strengthens Advertiser Protections, Streamlines Compliance, and Addresses Enforcement Priorities Under State Privacy Laws

NEW YORK, March 4, 2026 /PRNewswire/ -- Interactive Advertising Bureau (IAB), the leading trade association for the digital advertising industry, today announced significant updates to its Multi-State Privacy Agreement (MSPA), representing the most substantive amendments to the framework since 2023. The updates are designed to aid advertisers' compliance and business objectives by simplifying privacy law compliance, reducing partner contracting friction, closing contractual gaps, and strengthening protections under U.S. state privacy laws. Doing so advances privacy and speed to market.

As privacy enforcement accelerates across the U.S., advertisers face increasing business risk as personal data flows through agencies, ad tech vendors, measurement providers, and other downstream partners. Recent state enforcement actions have reinforced that advertisers remain responsible for protecting consumer data, even when the data is shared with or otherwise activated by third parties.

"This update makes the MSPA an even more powerful tool for the digital advertising ecosystem," said David Cohen, CEO, IAB. "In a time of increasing enforcement and complexity, we're giving advertisers and their partners a clear, trusted framework that simplifies compliance, accelerates collaboration, and protects them in a meaningful way. As adoption grows, the value multiplies—creating a shared standard that helps the entire industry move faster, with greater confidence, while reinforcing consumer trust and supporting the ad-supported internet people rely on every day."

The revised MSPA introduces advertiser-specific updates that simplify compliance and speed adoption across the ecosystem, including a streamlined structure that increases accessibility for major brands and clarifies how ad tech partners may process personal data—creating a consistent compliance baseline across covered transactions without the need for custom contract amendments or repeated negotiations. The result is unlocked business opportunities and a quicker go-to-market approach with partners that are MSPA signatories.

State regulators are making clear that strong contractual controls over personal data are no longer optional. Recent California enforcement actions involving Healthline Media and American Honda Motor Co. highlight, amongst other things, breakdowns tied to not having required privacy terms in contracts. In the Healthline enforcement action, California regulators highlighted that Healthline could, in part, return to CCPA compliance by complying with the MSPA.

Key benefits for advertisers include:

• Reduced Contracting Friction and Faster Speed to Market: A uniform set of industry privacy terms replaces duplicative contract changes and individual negotiations, lowering compliance overhead and enabling advertisers to move campaigns to market more efficiently as partners sign on to the MSPA.
• Clear Roles for Advertisers and Ad Tech Partners: By default, ad tech partners and other downstream participants are treated as service providers to advertisers under applicable state privacy laws (with one exception for the California Consumer Privacy Act) when receiving personal data—aligning with common industry practices and reducing uncertainty around vendor roles.
• Operational Simplicity When Consumers Opt-Out: The MSPA's provisions for advertisers do not require advertisers to build or deploy any technical signals; it allows advertisers' partners to engage in essential digital advertising functions, most often in a service provider relationship. This revision meets advertisers where they are by allowing them to continue with a suppression approach for those that opt-out rather than requiring a more complex technical signal implementation.
• Targeted Advertising Flexibility Where Required by Law: The MSPA preserves flexibility for targeted advertising use cases that require third-party treatment under the CCPA, while maintaining the contractual safeguards and purpose limitations required for compliance.

Adoption of the MSPA continues to grow year over year as more industry participants see its value across the digital advertising ecosystem. Each additional ad tech signatory extends a shared set of privacy-protective terms across covered transactions, reducing legal uncertainty and allowing advertisers, agencies, publishers, and technology partners to operate from a common compliance foundation.

The MSPA is available to any company participating in digital advertising, regardless of IAB membership. The updates also align with IAB's broader efforts to simplify compliance across a growing patchwork of state privacy laws, including through the IAB Diligence Platform, which supports privacy diligence across digital advertising partners.

To review the updated MSPA, click here.

About IAB
Interactive Advertising Bureau (IAB) empowers the media and marketing industries to thrive in the digital economy. Its membership comprises more than 700 leading media companies, brands, agencies, and the technology firms responsible for selling, delivering, and optimizing digital ad marketing campaigns. The trade group fields critical research on interactive advertising, while also educating brands, agencies, and the wider business community on the importance of digital marketing. In affiliation with the IAB Tech Lab, IAB develops technical standards and solutions. IAB is committed to professional development and elevating the knowledge, skills, expertise, and collaboration of the workforce across the industry. Through the work of its public policy office in Washington, D.C., the trade association advocates for its members and promotes the value of the interactive advertising industry to legislators and policymakers. Founded in 1996, IAB is headquartered in New York City.

SOURCE Interactive Advertising Bureau (IAB)