Cookie Consent - April 2, 2026 - 202604.1.0

General Availability

Deploy the CMP at Scale via Public API

Added the following APIs to enable end‑to‑end provisioning, scanning, branding, publishing, and governance of applications and domains. These new APIs allow you to further automate consent configuration, enforce regional rules, manage branding at scale, and operationalize scans and publishing workflows through API‑driven integrations.

• Create Application API

• Scan Application API

• Get Branding Attributes for Application API

• Update Branding Attributes for Application API

• Get Branding Attributes for Domain API

• Update Branding Attributes for Domain API

• Get List of Geolocation Rule Groups API

• Get Geolocation Rule Group API

• Assign Geolocation Rule Group API

• Get Scan Result Summary API

• Publish Application SDK API

• Get Script for Application API

• Get Script for Domain API

• Get List of Templates API

• Get Template Details API

Clearer Opt-Out Signal Notification for CPRA

Provide an improved notification on the Persistent cookie settings hover button to confirm end users' Global Privacy Control (GPC) signal was detected when using California Consumer Privacy Act (as amended by CPRA) templates. This enhancement allows your end users to more easily view GPC notifications and confirm the signal was honored without opening the preference center.

For more information, see Leveraging the Global Privacy Control Signal.

Fixed

• Resolved an issue that prevented the Global Privacy Control (GPC) opt-out confirmation notification logo from displaying with correct alignment on the banner.

• Resolved an issue that prevented consent status labels from displaying on the preference center when the Show consent status labels setting was enabled on a preference center template with Tab layout.

• Resolved an issue that displayed inconsistent lists of domains in exports generated from the Websites screen.

• Resolved an issue that prevented banners configured in Chinese - Taiwan, Republic of China (ZH-TW) from displaying Traditional Chinese text.

• Resolved an issue that produced JavaScript errors when publishing locally hosted scripts with the Use distinct script src URL setting enabled.

• Resolved an issue that prevented some banner text from translating accurately on IAB TCF 2.2 templates configured in Hebrew (modern) [HE].

• Resolved an issue that prevented the the ACv2 string from refreshing consistently and required additional page refreshes or listeners. Handling for the Google Additional Consent (ACv2) string has been improved to align with Google’s updated consent model.

Existing Public Preview Features

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

• Delaware

• Iowa

• Nebraska

• New Hampshire

• New Jersey

• Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Bulk Export APIs

The following APIs are now available for use to create and cancel bulk exports and retrieve their status, progress, download details, and credit details. These APIs enable users to extract large volumes of cookie receipts at once with a limit of six bulk exports per month.

• Create Bulk Export API

• Get List of Bulk Exports API

• Get Bulk Export Status API

• Cancel Bulk Export API

• Get Bulk Export Download Details API

• Get Bulk Export Credit Details API

• Get List of Bulk Export Download Details API

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Vendor Identification, Categorization, and Consent

Vendor Identification, Categorization, and Consent enables you to categorize any vendor services on your website and provide detailed consent options to your visitors. This feature streamlines vendor disclosure and consent by detecting known services and linking them to tracking technologies. Leverage Vendor Service Identification, Categorization, and Consent to perform the following actions:

• Identify known vendor services when scanning your websites.

• Categorize the vendor services active on your websites.

• Link tracking technologies to identified vendor services.

• Allow end users to configure consent for vendor services on the Preference Center.

• Capture records of consent at the vendor service level.

• Configure IAB templates to capture and disclose vendor service information.

• View source URLs for tag initiators on the Initiators tab of the Scan Results screen.

For more information, see Vendor Identification, Categorization, and Consent Feature Guide.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

• The “Cookie List Filters” text remains fully visible when browsers are configured to display text with increased line height, letter spacing, or word spacing (WCAG-AA 1.4.12: Text Spacing).

Things to Know

TheActivitytab on theCookie detailsscreen now captures cookie deletion information, including timestamp and user details, when cookies are deleted individually or in bulk.

Configure theAllow compliance assistant to operatesetting inGlobal settingsto enable or disableCompliance assistant.

For more information, see Leveraging CMP Compliance Assistant.

TheIncludeoption withinTarget specific sectionsof theAdd websitescreen has been renamed toInclude onlyfor improved specificity.

About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.