Cookie Consent - September 4, 2026 - 202609.1.0

General Availability

Enhancements to the Publish Script to Website API

Updated the Publish Script to Website API to include the ccpaOptOutEnabled request parameter. This parameter controls whether the CCPA/CPRA opt-out icon is displayed alongside the Do Not Sell or Share button when presented to site visitors.

Fixed

  • Resolved an issue that prevented the search functionality within the preference center from returning results when users searched for first-party cookies using the host name.

  • Resolved an issue that caused the the focus indicator to display with inconsistent appearance when navigating the preference center with assistive technologies.

  • Resolved an issue that caused the vendor count to display as 0 on IAB-configured preference centers if the Use audience logic setting was enabled in the geolocation rule.

  • Resolved an issue that displayed text on the IAB TCF 2.3 template with an incorrect translation when configured in Finnish.

  • Resolved an issue that prevented the Cookie banner screen reader value (dialog) field from retaining entered values when configuring templates.

  • Resolved an issue that caused an incorrect "Cookie purpose name must be unique" error when reverting purpose names in the Amharic language.

  • Resolved an issue that caused buttons on the preference center to display with excessive white space.

    addendum: This release note was added on September 11, 2026.
  • addendum: The release note pertaining to saving template configurations with App Tracking Transparency (ATT) purpose links or bundle groups was removed on September 11, 2026.

Existing Public Preview Features

Global Opt-Out Flow

|Available with Solution Packaging Only

Enable end users to opt out of a purpose across all of their linked devices, services, and accounts at once using the Global opt-out settings in your preference center template. This feature enables your end users to opt out of a purpose associated with their account and automatically submits a DSR request to process their opt-out from the specified purpose or purpose group. This enhancement is designed to improve your compliance with California privacy law.

For more information, see Customizing the Preference Center Template. This feature is related to the following ideas: OT-I-9627.

New CMP Experience

Enable the New CMP Experience setting to leverage the redesigned Cookie Consent interface. This new interface streamlines multiple interfaces within Cookie Consent to create a unified experience that improves navigation and makes it easier to deploy and manage your CMP.

For more information, see Enabling the New CMP Experience.

Email Completion Notifications for Compliance Assistant

|Available with Solution Packaging Only

Receive email notifications for completed Compliance Assistant scans. This enhancement notifies compliance assistant scan owners via email that the scan has completed.

For more information, see Leveraging CMP Compliance Assistant.

Enhanced Auto-Blocking Interface

Leverage an improved Auto-Blocking experience, featuring a redesigned safe list, block list, and match list. The enhanced Auto-Block tab is designed for a quicker and easier user experience when reviewing and blocking URLs.

For more information, see OneTrust Cookie Auto-Blocking (Enhanced Interface).

Banner SEO Configuration

Deploy your banner script with header (<h>) tags replaced as paragraph (<p>) tags for improved search engine optimization.

For more information, see Publishing and Implementing Cookie Consent Scripts, or contact OneTrust Support or your account representative.

Support for Multi-Language Privacy Policy Links

Configure privacy policy links in multiple languages on the Dynamic Links section of the Website Details screen. This feature enables you to offer privacy policy links and information in each language relevant to your business needs.

For more information, see Configuring Domain Branding.

Enhanced State Support for the Global Privacy Platform

The Global Privacy Platform (GPP) settings now support consent strings for the following US states:

  • Delaware

  • Iowa

  • Nebraska

  • New Hampshire

  • New Jersey

  • Tennessee

For more information, see Configuring Global Privacy Platform Settings.

Authenticated Consent for New and Existing Users

Transfer consent from local storage to new and existing data subject IDs (DSIDs) for user profiles when leveraging Cross-Device Consent. This enhancement allows you to apply previously captured consent to user profiles to streamline consent collection.

Always Inactive Consent State

Leverage the new Always Inactive consent state to allow users to display tracking technologies that are present but not enabled on their websites. This consent state enables you to notify your end users that a tracking technology is deployed but not active.

For more information, see Cookie Consent Models and Configuring Geolocation Rules.

Enable Global Privacy Platform on TCF 2.2 Templates

Enable the Global Privacy Platform setting on TCF 2.2 templates. This setting allows you to enable the IAB Tech Lab - Global Privacy Platform (GPP) and populate the IAB TCF EU section of the GPP string.

For more information, see Configuring the Global Privacy Platform Settings.

Legitimate Interest Configuration for Reject All on IAB Templates

Implement a Reject All button on your Preference Center and Cookie Banner that prevents objection to legitimate interest. This enhancement improves compatibility with Google Limited Ads.

For more information, see Customizing the Preference Center Template.

Server-Side Rendering

Server-side rendering is now available for Cookie Banner HTML and CSS.

For more information, see Server-Side Rendering: Performance and Availability.

Accessibility Conformance

  • Focus now correctly returns to the correct triggering element after closing the preference center or vendor list using the Esc key (WCAG‑A 2.4.3: Focus Order).

  • Screen readers now correctly announce banner descriptions when the banner displays (WCAG‑A 1.3.1: Info and Relationships).

Things to Know

TheServicestab has been removed from theTracking technologiesscreen and can now be accessed directly from theVendor servicestab on theCookie Consentmenu.

The following locale codes are now available when configuring custom translations for the CMP:

  • SR-RS (Serbian – Serbia)

  • KK-KZ (Kazakh – Kazakhstan)

  • RU-KZ (Russian – Kazakhstan)

Consent synchronization for logged-out and authenticated users has been improved to ensure consent statuses are reported accurately and prevent the banner from reappearing unexpectedly after login.

addendum: This release note was added on September 11, 2026.
About Known Defects

Issues that may impact our customers are documented in our Known Defects Database located here with approved workarounds and targeted releases for resolving the issue.