GPP for US privacy signals

CookieBeam can expose a window.__gpp API and encode configured US privacy fields. The runtime installs an early stub, replaces it with the full API, and replays queued calls.

Select sections

The dashboard stores numeric section IDs and separate approach controls:

• State-specific uses Sections 8–23. For a US visitor, the runtime includes only the enabled section matching the visitor's state.
• National uses Section 7 only when the organization is marked as an MSPA signatory and Section 7 is present in enabledSections.
• Enable __uspapi adds legacy Section 6 for US visitors.
• Enable Canadian TCF adds Section 5 for Canadian visitors.

Missing geolocation produces no applicable section. Enabling a state section does not place every enabled state into every visitor's string.

There is a current National-mode exception. The dashboard's default enabledSections list contains Sections 8–23, and switching to National does not add Section 7. A configuration saved from that default state can therefore resolve no National section even when MSPA signatory is enabled. Verify applicableSections before relying on National mode.

Map US choices to GPP fields

The US opt-out panel stores sale or sharing, targeted-advertising, and sensitive-data choices independently. The GPP mapper does not read those durable per-purpose fields. It derives GPP fields from the accepted category list.

The dashboard starts GPP Purpose Mappings empty and does not require them. When sale, sharing, or targeted advertising has no mapping, the mapper falls back to marketing for all three. This couples fields that the visitor can choose independently.

For example, a visitor can allow targeted advertising while opting out of sale or sharing. The panel then removes marketing but keeps analytics. With empty mappings, GPP encodes both sale or sharing and targeted advertising as opted out because both read marketing.

Set each mapping for Sale of Personal Information, Sharing of Personal Information, and Targeted Advertising deliberately before enabling GPP where those distinctions matter. A mapping still follows the panel's category projection rather than the durable per-purpose record. In particular, a targeted-advertising opt-out removes both analytics and marketing, so it can still make a sale or sharing field appear opted out. Test every choice combination you offer.

GPC forces the three opt-out fields to opted out. With no accepted categories and no GPC signal, they encode as N/A.

CMP ID behavior

There is no per-banner CMP-ID field in the persisted GPP settings or update API. The runtime reports one deployment-level CMP ID. It reads that value from the deployment environment and falls back to the placeholder 1.

CookieBeam does not currently hold an IAB CMP registration. The dashboard shows a Beta warning for US Sections 7–12 and warns that vendors may reject or ignore signals using the placeholder. A customer cannot supply an organization-specific registered ID through the dashboard.

Configure and publish

1. Open the banner's Consent frameworks view and select Frameworks.
2. Enable IAB GPP Support.
3. Choose the US approach and state sections. Configure the separate legacy and Canada controls only when needed.
4. Fill GPP Purpose Mappings. Review the legal-assertion fields before changing them.
5. Click Save GPP Settings, then publish the banner.

Use a clean browser profile from the target geography. Exercise each US opt-out combination, then inspect the runtime:

window.__gpp('ping', (data, success) => console.log({ success, data }))

Check cmpStatus, signalStatus, cmpId, applicableSections, sectionList, and gppString. Use getSection or getField to verify the encoded purpose fields when testing mappings.

If applicableSections is [-1], check the visitor geography, selected US approach, enabled section IDs, and the National-mode preconditions. If the section is present but a purpose field is wrong, inspect its category mapping and the accepted category list rather than the stored per-purpose choices.

TCF is unavailable in production

IAB TCF support is built in the codebase but disabled for production banner generation. CookieBeam does not hold an IAB CMP registration for TCF, and TCF signaling is therefore not available to customers today.

Use CookieBeam's category and blocking controls for consent enforcement. Google Consent Mode can carry category state to Google tags, but it does not replace IAB TCF vendor signaling, which is not available in CookieBeam today.