On March 4, 2026, the Interactive Advertising Bureau released the Fifth Amended and Restated Multi-State Privacy Agreement, the most significant rewrite of the MSPA since 2023. It took effect on June 2, 2026. Ad tech trade press treated it as good news, and in many ways it is. The new version is simpler, friendlier to brands, and better matched to what California regulators have been saying in enforcement actions.

The IAB MSPA Is a Good Contract. It Is Not a Compliance Program.

Our view at Captain Compliance is that the MultiState Privacy Agreement (MSPA) is one of the most useful tools the industry has built for U.S. state privacy law. We also think it is being oversold. A contract can tell your partners what they may do with personal data. It cannot make your website do what your contract promises.

What the MSPA Actually Does

The MSPA is not a model contract you negotiate line by line. It is a single set of privacy terms that binds every company that signs it, whenever they pass personal data to one another for digital advertising. Any company in the ecosystem can sign, whether or not it belongs to the IAB.

The 2026 update made several practical changes:

• Automatic privity. Signatories that receive personal data are bound to each other on privacy terms, so you may not need a separate data processing agreement with every vendor in the chain.
• Service provider by default. Ad tech partners are treated as service providers or processors under state privacy laws, with an exception for targeted advertising under the CCPA, which California treats as a third-party disclosure.
• Enumerated purposes. The agreement lists the specific advertising activities partners may use data for, aimed at the CCPA requirement that purposes be “limited and specified.”
• Suppression-based opt-outs. Advertisers can honor opt-outs by suppressing audiences rather than building and deploying technical signals. Measurement, fraud prevention and frequency capping can continue under service provider terms.
• GPP optional for advertisers. The MSPA works alongside the IAB Tech Lab’s Global Privacy Platform, but the advertiser provisions do not require GPP signals.

Why the Update Was Needed

California made the vendor contract an enforcement target. In the Healthline Media case, the California Attorney General’s $1.55 million settlement faulted the publisher for not putting purpose limits on what its ad tech partners did downstream. The Attorney General then pointed to the MSPA as one way back into compliance. The California Privacy Protection Agency reviewed American Honda’s ad tech contracts and found them lacking. Tractor Supply’s $1.35 million penalty partly reflected generic data protection terms where CCPA-specific language was required. And in the Todd Snyder matter, the CPPA cited vendor contracts that were not specific enough, alongside a consent tool that malfunctioned for 40 days.

The message was clear. Vague clauses like “for purposes contemplated under the agreement” no longer hold up. Regulators want to see exactly what each partner is allowed to do with consumer data, and California’s rules now make your diligence on those partners a material factor in whether you are liable for their conduct. The MSPA answers that demand at industry scale, which is why its adoption matters.

Before You Sign the MSPA, Test Your Cookie Banner

Wrongful collection claims and faulty cookie banners are huge privacy litigation topics. At the IAB privacy saloon Captain Compliance was a hot topic as the company that goes above and beyond to help ensure that their clients banners are functioning in the manner that the clients expect them to be. Professional plaintiffs have moved on from just is there a CMP running on the website to is the CMP even working correctly or at all? The answer is usually no and thats why just signing the MSPA is just one part. So remember the new MSPA fixes your contracts but who’s fixing your pixels?

Where We Push Back

The risk is that brands sign the MSPA and believe their state privacy exposure is handled. It is not. Look again at Todd Snyder: the contracts were one problem, but the cookie banner that failed to stop tracking for more than a month was the other. No agreement fixes a consent tool that does not work.

Three gaps concern us most.

Suppression is only as good as the data behind it. Letting advertisers rely on audience suppression instead of real-time signals lowers the technical bar, which is helpful. But suppression depends on accurately capturing and keeping every opt-out, including Global Privacy Control signals that California and a growing list of states require you to honor. If your site misses a GPC signal, nothing downstream will suppress that user.

Contracts govern partners, not pixels. Many enforcement actions and CIPA lawsuits start with a tag that fires where it should not: on a health page, before consent, or after an opt-out. The MSPA can limit what a signatory does with data it receives. It cannot stop a misconfigured script from sending that data in the first place.

Not every vendor is a signatory. The MSPA only binds companies that sign it. Your marketing stack almost certainly includes analytics tools, chat widgets, session replay and other scripts from vendors outside the agreement. Those still need their own contracts and their own monitoring.

What Brands Should Do Now

• Decide whether signing the MSPA makes sense for your advertising relationships, and confirm which of your partners have signed.
• Map every vendor and script on your sites, and note which are covered by the MSPA and which need separate terms.
• Test that your consent banner and opt-out flows actually block tracking, across browsers and pages, on a regular schedule.
• Make sure GPC signals are detected and honored, and that opt-outs reach your suppression lists.
• Consider adopting GPP even though it is optional. Passing clear signals downstream is still the strongest evidence that you honored consumer choices.
• Keep records. Regulators now expect proof of diligence, not just a signed agreement.

IAB MSPA Patchwork

The IAB deserves credit. The fifth MSPA turns a patchwork of state laws and California enforcement findings into one usable set of terms, and it will help many companies fix the vendor contract problems that have drawn penalties. But the MSPA governs paper. Regulators are increasingly checking what actually happens on your website.

That is where Captain Compliance comes in. As an IAB TCF validator and Google-certified CMP, our consent management platform supports GPP and GPC signals, and our Patrol monitoring tool continuously scans your sites for trackers that fire when they should not. Sign the contract, then make sure your website keeps its promises. Talk to Captain Compliance to see where you stand.