BidRequest.regs
Regs
Which privacy regulations apply to this request, and the consent signals that go with them.
Fields
| Field | Type | Level | Description |
|---|---|---|---|
| gdpr | integer | optional | 1 if GDPR applies, 0 if not. Omitted means unknown. |
| coppa | integer | optional | 1 if the request is subject to COPPA. |
| gpp | string | optional | The Global Privacy Platform consent string. |
| gpp_sid | integer[] | optional | Which GPP sections apply to this request. |
| us_privacy | string | optional | The older US privacy signal string. |
Example
{
"gdpr": 1,
"gpp": "DBABMA~CPXxRfAPXxRfAAfKABENB…",
"gpp_sid": [2, 6]
}What matters in practice
The consent signal is split across two objects, which is the source of most implementation errors here: regs.gdpr says whether the regulation applies, while the actual TCF string lives in user.consent. Reading one without the other gives you half the picture. GPP is the successor framework, carrying multiple jurisdictions in one string with gpp_sid saying which sections are in play — it supersedes us_privacy, though both circulate during the transition. An omitted gdpr flag means unknown rather than no, and treating unknown as no is exactly the assumption regulators are least sympathetic to.
Related objects
Field names, types and requirement levels from the IAB Tech Lab OpenRTB 2.6 specification (2.6-202211), verified 30 July 2026. The practice notes are not spec text.