Cookie Consent - November 13, 2026 - 202611.1.0 (Fall Release)

General Availability

Global Opt-Out Flow | Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

Website Scan Observability

Access the new scanner Job queue to review scan statuses and start times for each of your scanned domains. This feature provides a higher degree of insight into each of your scans, enabling you to more easily monitor scan progress and diagnose failures.

For more information, see Scanning a Website and Resolving Scan Check Issues. This feature is related to the following ideas: PDGI-I-595, OT-I-12712, OT-I-4946, OT-I-514, PDGI-I-641.

Telemetry.js for Real-World Tracker Detection | Available with Solution Packaging Only

Integrate Telemetry.js with the OneTrust CMP to enable continuous runtime monitoring to help identify tracking technologies that execute during real user sessions. Telemetry.js enhances web scanning by observing tracking technologies as they run on your site. This helps provide a more complete view of technologies that may not appear during a scheduled scan, such as technologies triggered after page load, during navigation, or after a user interaction.

For more information, see Cookie Consent Integration with Telemetery.js. This feature is related to the following ideas: OT-I-115, OT-I-3340, OT-I-5581, OT-I-7652, OT-I-15110.

Country-Level Re-Consent Controls

Select individual countries within a geolocation rule when enabling re-consent during publishing. This enhancement enables you to prompt only visitors from the selected countries to provide consent again, without creating separate geolocation rules. Countries that are not selected retain their existing re-consent state, and selecting the entire geolocation rule continues to apply re-consent to all countries in the rule.

For more information, see Publishing and Implementing Cookie Consent Scripts.

Enhancements to Cookie Consent APIs

Updated the Cookie Consent APIs with the following enhancements:

Added the useDistinctScriptSrc request parameter to the Publish Script to Website API to generate a dedicated otSDKStub.js file for the domain. When enabled, the test script source URL changes and the script implemented on the website must be updated.
Added the isNewlyRemoved response parameter to the Get List of Added or Removed Cookies API to indicate whether a cookie was removed compared with the previous scan.
Updated the type response parameter in the Get Template Details API to support IAB Canada (IABC) display group types for purposes, stacks, features, special purposes, special features, and data categories. The following enum values are now supported: IABC_PURPOSE, IABC_STACK, IABC_FEATURE, IABC_SPL_PURPOSE, IABC_SPL_FEATURE, IABC_DATA_CATEGORY.
Updated the API documentation for the id path parameter in the Scan Application API and Get Application Scan API and the scanId path parameter in the Get Application Scan API to provide clearer guidance for retrieving application and scan identifiers.

Fixed

Resolved an issue that prevented buttons from displaying with consistent sizing and alignment across different banner layouts, unless the buttons leverage Define Order of CMP Buttons feature or custom CSS.
Resolved an issue that caused the GPP stub file size to increase significantly, impacting page performance.
Resolved an issue that prevented GPC consent states from accurately populating in Google Tag Manager (GTM) upon initial page load.
Resolved an issue that caused the following APIs to return errors or incorrect statuses for failed application scans.
Resolved an issue that caused Compliance Assistant scans to inaccurately flag findings on some sites, including "Dropping non-essential cookies by default" and "Dropping non-essential cookies despite selecting 'Reject all'".
Resolved an issue that prevented the scanner from crawling URLs behind a login when they were added as target pages during scan configuration.
Resolved an issue that caused the Publish Script to Website API to deploy the latest script version when the script version parameter was omitted.
Resolved an issue that prevented SDKs imported via bulk import from being displayed on the Tracking technologies screen.
Resolved an issue that prevented localized cookie descriptions from populating in Excel exports generated from the Tracking technologies screen.
Resolved an issue that prevented the Records count field from displaying in the Export details section of the Bulk export screen when no records were present on an export.
Resolved an issue that prevented the webform integration status from correctly updating to Integrated in the History tab of the Scripts screen after publishing a script with the Embedded webform script integration setting enabled.
Resolved an issue that incorrectly encoded special characters in purpose descriptions as HTML entities if anchor links were present and HTML sanitization was enabled.
Resolved an issue that displayed the consent sync notification on sites even when the Enable syncing notification setting was disabled on the Consent group details screen.
Resolved an issue that caused the title and description of the Sale/Sharing and Targeted Advertising Cookies category in the preference center to revert to English for all languages when changes were made to the English version.

New Public Preview Features

CMP Revamp Phase 2: Overview, Scans, Experience, and Geolocation Rules

Leverage the redesigned Overview, Scans, Experience, and Geolocation rules screens to manage website setup, scans, consent experiences, and geolocation rules in a more cohesive workflow. This enhancement builds on Phase 1 of the New CMP Experience feature to reduce the steps required for core tasks such as scheduling scans, configuring templates, and publishing. The enhancement includes a redesigned Overview tab that highlights website status, recent changes, and next steps, and a Scans screen that makes scan status, history, and results easier to understand and act on. You can enable this feature directly in Global Settings

For more information, see Enabling the New CMP Experience. This feature is related to the following ideas: OT-I-7301,CSC-I-264,PDGI-I-1856, CSC-I-214, PDGI-I-1936.

Ownership and Accepted Risk for Compliance Assistant

Assign owners to Compliance Assistant findings and mark findings as accepted risk. This enhancement improves accountability and audit readiness by enabling you to reassign findings for remediation, filter findings by status, owner, and finding type, review the ownership and status history of each finding, and export findings with owner and status details. You can also enable or disable Compliance Assistant for each website individually.

For more information, see Leveraging CMP Compliance Assistant. This feature is related to the following ideas: CS-I-105, CS-I-107, CS-I-106, CS-I-59, OT-I-3774.

Expanded State Support for the Global Privacy Platform

Generate state-specific Global Privacy Platform (GPP) strings for the following additional U.S. states:

Indiana
Kentucky
Maryland
Minnesota
Rhode Island

When a geolocation rule targets one of these states and both GPP and state-specific strings are enabled, the Web SDK generates the applicable state section based on your existing purpose and category mappings. Your vendors can read the state section using the standard GPP CMP API.

For more information, see Configuring Global Privacy Protocol Settings.

Existing Public Preview Features

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

Note:

You can enable this preview feature using an in-app setting within Global Settings

For more information, see Enabling the New CMP Experience.

Email Completion Notifications for Compliance Assistant |Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.4 Templates

Enable the Global Privacy Platform setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

Focus now lands on the Email field of the Global opt-out modal during both forward and backward navigation (WCAG-AA 3.2.3: Consistent Navigation).
Keyboard focus now automatically moves to the Double Opt-In confirmation modal when the modal displays (WCAG‑A 2.1.1: Keyboard).
Resolved an issue that prevented the banner from being reachable via keyboard navigation when the Banner focus setting was disabled (WCAG‑A 2.1.1: Keyboard).
Resolved an issue that caused keyboard navigation to skip native page elements and move directly into the banner (WCAG‑A 2.1.1: Keyboard).
Screen reader ARIA labels for category filters on the preference center are now fully localized to the selected published language, including ordinal indicators such as "of".

Things to Know

Icon Performance on the CMP: The icons on the CMP have been split into functional and branding components to optimize performance and reduce page weight for sites using custom logos.
Always Send Advanced Analytics Settings on Geolocation Rules: The Advanced Analytics setting on geolocation rules now includes an Always send option, ensuring core consent proof is captured in all consent receipts regardless of category.
Consent Sources in Receipts: Consent sources are now always included in consent receipts regardless of Advanced Analytics settings.
User Agent Setting for Scans: TheScan website screen features a new User agent setting to allow users to leverage the latest version of the OneTrust user agent for enhanced scan performance.
Improved Tracking Technology Details: Tracking technology instances now include discovery metadata, including date first seen, and resource attribution information, including the resource URL that generated the discovery and the page URL where the technology was discovered.
Tracking Technologies Feature Management: The enhanced Tracking technologies interface is now managed through the Enable new experience setting in the Cookie Consent section of the Global Settings menu.
Enhanced Autoblocking Experience Feature Management: The Enhanced Autoblocking Experience is now is now managed through theEnable new experiencesetting in the Cookie Consent section of the Global Settings menu.
Source Field Localization: Selection menu options for the Source field on the Bulk import cookies modal now display localized when bulk importing cookies on the Tracking technologies screen.
IAB TCF 2.4 Standard Feature Explanation Text: The IAB TCF 2.4 standard feature explanation text is now available for all supported languages. This ensures that the mandatory standard explanation for features is displayed on the TCF 2.4 template as required by IAB policy.
About Known Defects: Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.

News & Release Notes