October 2026 Release Notes

Note: Any Consent Manager Platform (CMP) changes will be inherited by consent manager configurations after they are republished. Please be sure to test all changes.

Enhancements

• October 15 5:00 PM CDT
  • Cookie Consent
    • Customers with Cross-Device Consent enabled on their config will now see a new string that tells visitors, right on the banner, that their choices apply across the devices where they're signed in. If signing in replaces a choice a visitor just made, a short notice lets them know and links straight to their preferences. Rejecting cookies now carries across devices the same way accepting does, including on IAB TCF sites, and you can set how long the notice stays on screen from the Styles page.
• October 15 10:55 AM CDT
  • Web Application
    • The Osano web app has a cleaner layout. The top bar is gone and everything now lives in the left navigation, giving every page a taller workspace. No functionality was added or removed.
      • Account selection: now at the top of the left navigation, above Dashboard.
      • Settings: click your name and initials at the bottom of the left navigation to open the profile menu (Language, Account, Users, Organizations, API Keys, Webhooks, Billing, Sign Out).
      • Notifications and Help Center: the bell and question mark icons sit next to the profile button.
      • Privacy Resources: Privacy Templates, Regulatory Guidance, and GDPR Representative are now grouped in one expandable section.
      • Osano AI: the launcher now sits in the bottom right corner of every page.
    • Read more about the October 2026 UI Navigation Updates
• October 5 10:57 AM CDT
  • Cookie Consent: reporting dashboard consent percentages now show decimal places, so small opt-out rates are no longer rounded away.

Cookie Consent

• October 7 3:26 PM CDT
  • Toggle colors on the default palette now meet the 3:1 contrast minimum (WCAG 1.4.11). Existing configurations pick up the fix when republished.
• October 5 4:41 PM CDT
  • Vendor expansion panels in the IAB/TCF view now use the correct button role instead of a link role, so screen readers announce expand and collapse state.
• October 5 12:20 PM CDT
  • Fixed an unclassifiable iframe discovery named “https://” appearing in discoveries.
• October 1 11:54 AM CDT
  • Fixed a returning visitor’s saved consent not reaching Google Consent Mode when osano.js loaded before gtag. This could make Google Analytics 4 start a new session on every pageview after the first.

Cookie Consent REST API

• October 13 12:48 PM CDT
  • ruleType no longer returns null on Cookie Consent rules or in the Excel export.
• October 13 6:27 PM CDT
  • A PATCH to a configuration no longer overwrites the top-level domains. This came from the #ask-product thread Skye opened on Oct 13.

Subject Rights

• October 14 4:45 PM CDT
  • Amplitude Access action items now have an Edit button for the Amplitude User ID. The labels and docs now say clearly that a User ID is required.
• October 7 12:35 PM CDT
  • Fixed the Activity Log showing a literal %action placeholder instead of the action name.
• October 5 3:05 PM CDT
  • Verification method changes on the Request Types tab are now saved.
• October 1 8:39 AM CDT
  • Fixed DSAR forms failing to save when a request type had no description.

Compliance Check

• October 12 1:59 PM CDT
  • Fixed screenshots with white margins or cropped bottom cookie banners that made banner checks fail incorrectly.
• October 13 9:08 AM CDT
  • Deleted domain scans no longer appear in the Compliance Check domain summary and list.
• October 13 2:23 PM CDT
  • A failed scan retry no longer leaves the scan stuck as pending.