US Privacy (CCPA) String Decoder
Decode a 4-character US Privacy (CCPA) string in your browser and read the notice, opt-out-of-sale, and LSPA flags in plain language.
The US Privacy (CCPA) String Decoder runs entirely in your browser. The us_privacy value you paste or build is processed on your device, is never uploaded to ArrayKit, and no ad endpoint or USPAPI callback is contacted.
Open the GPP String Decoder
About US Privacy String Decoder
The US Privacy (CCPA) String Decoder unpacks the 4-character us_privacy signal that ad-ops teams see in OpenRTB requests, USPAPI callbacks, and the usprivacy cookie. Paste a value like 1YNN and it reads each character for you: the spec version, whether explicit notice and an opportunity to opt out were given, whether the user opted out of the sale of their data, and whether the publisher is a signatory to the IAB Limited Service Provider Agreement. Each flag — Y, N, or a dash for not-applicable — is expanded into a plain-language meaning so you can confirm a compliance signal in seconds. A Build mode lets you assemble a correct string from dropdowns for a test bid or a QA fixture. Everything is parsed on your device, so real user signals never leave the browser.
Features
- Decodes the 4-character IAB US Privacy (CCPA) string into version, notice, opt-out, and LSPA fields
- Explains every Y / N / - flag in plain language instead of raw characters
- Flags an opted-out-of-sale signal at a glance so you can honor it downstream
- Validates length, a numeric version character, and each flag position
- Clear, position-specific errors when a character is not Y, N, or a dash
- Build mode assembles a correct us_privacy string from simple dropdowns
- One click sends a built string back into Decode to verify it round-trips
- Runs entirely in your browser — no us_privacy value is ever uploaded
How to use the US Privacy String Decoder
- Copy the us_privacy value from an OpenRTB regs.ext.us_privacy field, a __uspapi callback, or the usprivacy cookie
- Paste it into Decode, or click Sample to load 1YNN
- Read the version and the plain-language meaning of the notice, opt-out-of-sale, and LSPA flags
- Switch to Build to assemble a test string from dropdowns and copy it
Example
Input
1YNN
Output
version: 1
Notice/opt-out opportunity: Y (provided)
Opt-Out of Sale: N (has not opted out)
LSPA: N (not under the agreement)
1YNN: notice was given, the user did not opt out, and the publisher is not under the LSPA.
Common errors & troubleshooting
- The decoder says the string is not 4 characters. — A us_privacy value is always exactly four characters: version + Notice + Opt-Out of Sale + LSPA. Paste only the raw value with no quotes, URL-encoding, or surrounding JSON.
- You entered lowercase y or n and it was rejected. — The flags are uppercase Y or N, or a dash (-) for not applicable. Re-enter the character in uppercase; the specification does not use lowercase flags.
- You are unsure what a dash in a position means. — A dash means the signal is not applicable — for example the user is outside California or CCPA does not apply — so no notice or opt-out value was set for that field.
- You expected 1--- to mean the user opted out. — 1--- means every flag is not-applicable, so there is no opt-out. An explicit opt-out of sale is the value Y in the third position, e.g. 1YYN.
Frequently asked questions
- What does a US Privacy string like 1YNN mean?
- Each character is a field. 1 is the spec version, Y means explicit notice and an opportunity to opt out were provided, the first N means the user has not opted out of the sale of their data, and the second N means the publisher is not operating under the IAB Limited Service Provider Agreement.
- What is the difference between N and a dash in the string?
- N is an explicit 'no' — for example, the user did not opt out. A dash (-) means the field is not applicable and no signal was set, such as when the request is outside CCPA's scope. 1--- therefore carries no notice or opt-out determination at all.
- Where do I find the us_privacy value to paste?
- It appears in an OpenRTB bid request as regs.ext.us_privacy, is returned by the USPAPI __uspapi('getUSPData', ...) call, and is stored in the usprivacy cookie. Copy any of those 4-character values and paste it into the decoder.
- What is the LSPA flag in the fourth position?
- It records whether the publisher has signed the IAB Limited Service Provider Agreement, which governs how downstream partners may process data. Y means they are a signatory, N means they are not, and a dash means the signal was not set.
- Can this tool build a us_privacy string as well as decode one?
- Yes. Build mode lets you pick Yes, No, or Not-applicable for the notice, opt-out-of-sale, and LSPA fields and assembles a version-1 string you can copy into a test bid request or QA fixture, then decode again to confirm it.
- Is the US Privacy string the same as the newer GPP string?
- No. The US Privacy string is the older CCPA-era signal; the IAB Global Privacy Platform (GPP) is the successor that carries US state sections and TCF data in one string. If you have a GPP string, use the GPP decoder instead.
Related tools
All ArrayKit tools