Privacy Regulations & Signals
This page shows how the main privacy regimes relate to the signals the Surfside SDK reads. It's a technical map, not legal advice. Your legal team decides which regimes apply to your business and what your consent experience has to do. The SDK's job is to honour the decisions your CMP and your shoppers make.
At a glance
| Regime | Model | Signal the SDK reads | Effect in the SDK |
|---|---|---|---|
| EU GDPR / ePrivacy, UK GDPR / PECR | Opt-in: consent before non-essential storage or profiling | IAB TCF v2 | Purpose 1 refused denies tracking and identity; Purpose 3 refused denies identity |
| US state privacy laws (California, Virginia, Colorado, Connecticut, Texas and others) | Opt-out: shoppers can opt out of sale, sharing and targeted advertising | IAB GPP US sections | Any opt-out denies identity |
| Universal opt-out signals | A browser-level opt-out that some US states require businesses to honour | Global Privacy Control | Denies identity |
| Your own policies, or regimes without an IAB signal | Whatever your banner collects | setConsent | Whatever you pass |
Europe and the UK: opt-in
Under GDPR and the ePrivacy rules (PECR in the UK), storing or reading non-essential data on a device and building advertising profiles generally need the user's consent first. IAB Europe's Transparency & Consent Framework (TCF) v2 is the industry standard for passing that consent between a CMP and ad-tech vendors.
The SDK reads two TCF purposes: Purpose 1 (store and/or access information on a device) and Purpose 3 (create profiles for personalised advertising). See IAB TCF v2 for the full mapping.
Because the SDK's default is granted, opt-in sites should set an explicit denial until the shopper decides. See Opt-in sites.
United States: opt-out
There is no comprehensive federal privacy law in the United States. Earlier federal proposals, such as the American Data Privacy and Protection Act (ADPPA), were not enacted. Privacy rights come from a growing number of state laws, led by California's CCPA (as amended by the CPRA).
These laws mostly follow an opt-out model. Businesses may collect and use personal data for their own purposes, but shoppers have the right to opt out of:
- the sale of their personal data
- the sharing of personal data for cross-context behavioural advertising (California)
- targeted advertising
These rights are about who the shopper is and where their data goes, not about first-party measurement. So the SDK maps every US opt-out to the identity purpose: identity is removed and resolution stops, while anonymous measurement continues.
IAB GPP
IAB Tech Lab's Global Privacy Platform (GPP) carries US opt-outs from a CMP in a standard format, with a US National section and a section for each state. The SDK reads every US section that the CMP marks as applying to the shopper and records them as jurisdictions on each event. See IAB GPP for supported sections and fields.
GPP sections can also carry fields from IAB's Multi-State Privacy Agreement (MSPA). When a section reports that the publisher is operating in MSPA Service Provider Mode, the SDK denies identity, because personal data may not be sold or shared in that mode.
Global Privacy Control
Global Privacy Control (GPC) is a browser setting that tells every site the shopper wants to opt out of the sale and sharing of their data. California, Colorado and a growing number of other states require businesses to treat it as a valid opt-out request. The SDK honours GPC by default, on every site, whether or not a CMP is installed.
Sensitive data
Several state laws need opt-in consent before processing sensitive data, and some categories of purchase data may count as sensitive. The SDK doesn't currently interpret GPP's sensitive-data fields. If your CMP collects sensitive-data consent and your legal team needs it to restrict identity, pass the outcome to the SDK with setConsent.
Other regions
For regimes without a signal the SDK reads automatically, use setConsent to pass your banner's decision. The enforcement and recording work the same whichever source the decision comes from.