November 2026 Release Notes

Enhancements

• November 10
  • Compliance Check
    • Scan results now include a new Not Assessed result for checks the scanner couldn't complete, such as when it couldn't find or interact with your consent banner. Not Assessed has its own label, icon, and count on the scan results page, and every Not Assessed result shows the reason. Error is now reserved for issues on Osano's side.
      • Score: Not Assessed checks don't count toward your scan score or your Fail count.
      • Dependent checks: when a check that other checks rely on can't be verified, those checks show Not Assessed instead of Error or Fail. For example, if no cookie banner is found, the banner check still fails, and Reject All and Choice Symmetry show Not Assessed.
      • Unsupported consent tools: if we find your banner but can't interact with it, Choice Symmetry is still graded from the screenshot and Reject All shows Not Assessed.
      • Consent tool named: when we detect your consent tool but its banner never appears, the reason names the tool.
      • Privacy policy page unavailable: if the scanner can't load your privacy policy page, that check shows an Error and the checks that depend on it show Not Assessed.
      • Every scan re-checks: Not Assessed results are evaluated fresh on each scan.
      • PDF report: Not Assessed results and their reasons appear in the PDF, matching the web app.
      • Reasons are available in English, Arabic, German, Spanish, and French.
• November 5
  • Compliance Check
    • The "Privacy policy must contain a subject rights intake method" check now shows a notice when your privacy policy lists email as the only way to submit a privacy request. California's SB 923 takes effect January 1, 2027, and requires online-only businesses to offer an online submission method, such as a webform, rather than only an email address.
    • A new setting in each site's settings lets you tell us whether the business is online-only. It changes the result for email-only privacy policies:
      • Not set (default): Warning.
      • Not an online-only business: Pass, with no notice.
      • Online-only business: Warning until January 1, 2027, then Fail.
    • These changes apply only to scans evaluated under the CPRA. A policy with no intake method still fails, and a policy with a webform or other online method still passes, whatever the setting.