Cookie Consent - September 25, 2026 - 202609.2.0

General Availability

TCF 2.4 Template

Configure your CMP with the IAB TCF 2.4 template. This updated template features revised IAB requirements, updated disclosures, consent-scope messaging, framework-driven purpose content, and support for multi-device and cross-domain consent scenarios across web, mobile, and CTV implementations. These updates are designed to improve your compliance with the latest version of IAB TCF requirements.

For more information, see Implementing TCF on your Website.

Fixed

  • Resolved an issue that caused the full Global IAB Vendor List to display instead of the filtered vendor list after changing the banner language.

  • Resolved an issue that prevented Google Tag Manager (GTM) consent states from reflecting users' Global Privacy Control (GPC) status upon the initial page load.

  • Resolved an issue that prevented templates from being saved correctly after modifying App Tracking Transparency (ATT) Purpose or bundle group configurations.

  • Resolved an issue that prevented some cookies from displaying with the correct custom description on the preference center.

  • Resolved an issue that produced 401 Unauthorized errors when users forwarded authenticated, known-user consent receipts.

  • Resolved an issue that prevented purposes from displaying in Norwegian Bokmål (NB) on the Purposes screen.

  • Resolved an issue that caused past dates to display as the next scheduled scan date on the Websites screen and in website exports.

  • Resolved an issue that caused a persistent overlay to block user interaction on websites with a Content Security Policy (CSP).

    addendum: This release note was added on October 2, 2026.

  • Resolved an issue that incorrectly recorded the transaction type as "Not Given" when a user provided consent on the banner after closing the preference center.

    addendum: This release note was added on October 16, 2026.

Existing Public Preview Features

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

Note:

You can enable this preview feature using an in-app setting within Global Settings

For more information, see Enabling the New CMP Experience.

Global Opt-Out Flow

|Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

  • Delaware

  • Iowa

  • Nebraska

  • New Hampshire

  • New Jersey

  • Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.4 Templates

Enable the Global Privacy Platform setting on TCF 2.4 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

  • Screen readers now correctly announce search result quantities in the published banner language when searching the vendor list (WCAG‑A 1.3.1: Info and Relationships).

Things to Know

Section 6 of the Global Privacy Platform (GPP) is now populated in the US privacy string for web-based CMPs.

TheIAB Tech Lab - Global Privacy Protocol (GPP)andGenerate state specific stringsettings are now available to enhance GPP compliance when configuring geolocation rules for the following US states:

  • Indiana

  • Kentucky

  • Maryland

  • Minnesota

  • Rhode Island

ThePublishpane on theScriptsscreen now includes theShow CCPA out-out iconsetting, which allows you to display a CCPA-specific opt-out icon when deploying scripts with the following templates in addition to CCPA and CPRA templates:

  • Colorado Privacy Act (CPA)

  • Connecticut Privacy Act (CTDPA)

  • Maryland Online Data Privacy Act (MODPA)

  • Oregon Consumer Privacy Act (OCPA)

  • US Multi-State - 2.0

  • US National

  • Utah Consumer Privacy Act (UCPA)

  • Virginia Consumer Data Protection Act (CDPA)

Cookie hosts now display on theCookieselection menu of theBlock source URLmodal to improve clarity when linking cookies to source URLs during Auto-Blocking configuration.

Tracking technology exports now display the website name in the export's file name when a single domain filter is applied before exporting.

addendum: This release note was added on October 2, 2026.
About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.