Understanding MSPL

What is MSPL and why does it matter?

The United States has no single federal privacy law. Instead, individual states have passed their own – the California Privacy Rights Act (CPRA) in California, the Virginia Consumer Data Protection Act (VCDPA) in Virginia, the Colorado Privacy Act (CPA) in Colorado, and a growing number of others. Each carries its own scope, thresholds and consumer rights, and new state laws continue to take effect.

For most website owners, maintaining a separate domain group and geolocation rule for every state is time-consuming and difficult to keep up to date. The Multi-State Privacy Law (MSPL) template removes that work: it's an out-of-the-box legislation preset in Cookiebot that gives you a single, unified configuration covering all your US website traffic.

Behind the scenes, MSPL template aggregates the strictest applicable requirements from the currently active US state privacy laws into one cohesive configuration. When you select it, it applies automatically to all of your US-based website visitors – so you do not need to build and maintain a per-state matrix of geolocation rules. Usercentrics maintains the MSPL template centrally — as state laws take effect or change, we update the template so your configuration stays current without any action from you.

MSPL or a state-specific preset — which should you choose?

Both approaches are valid. Which one suits you depends on how much control you need over individual state configurations.

• Choose the MSPL preset if you want one configuration covering all US visitors, with minimal setup and ongoing maintenance.
• Choose the state-specific presets – CCPA (California Consumer Privacy Act), CPA (Colorado Privacy Act), CTDPA (Connecticut Data Privacy Act), UCPA (Utah Consumer Privacy Act), VCDPA (Virginia Consumer Data Protection Act) – if you need to tailor the banner and consent behaviour per state, for example where your legal team has specific requirements for a particular jurisdiction.

You can also combine approaches by creating multiple domain groups and using coexisting configurations to serve a different banner depending on the visitor's location.

Want to know more about US state privacy laws? Check out our overview: Regulations and frameworks

MSPL requirements for CMPs

US state privacy laws generally regulate the data collection, storage, processing and sharing practices of for-profit businesses doing business in, or targeting residents of, the relevant state. When it comes to a business' website, the MSPL template puts the following measures in place:

• A way to opt out of the sale and sharing of personal information. Visitors must be provided with a mechanism that allows them to opt out of the sharing and sale of personal information to third parties. The wording must specifically be: "Do not Sell or Share My Personal Information".
• Honoring the Global Privacy Control (GPC) signal. GPC signal lets a visitor set their privacy preference once in their browser, instead of opting out on every website individually. Cookiebot CMP monitors for the GPC signal and automatically triggers an opt-out when it's enabled in a visitor's browser.
• Double opt-in. Cookiebot CMP lets visitors opt in again manually after an initial opt-out — whether they opted out themselves or Cookiebot CMP honored the GPC signal on their behalf.

Configure your CMP for MSPL