Consent Docs
Open console

Product changes in early October 2026

What changed in the console, the API and webhooks between 2 and 9 October 2026, newest first, with what you need to do about each change.

Release notes9 min readFor everyone

Newest first. Later changes are in Product changes.

9 October 2026#

Added#

  • Roles in a project. People and roles gives each person one of six roles: owner, privacy officer, grievance officer, content editor, developer or auditor. Every console route checks the role. Roles stay off until an owner turns them on, so nothing changes until then. See Access and roles.
  • Second-person approval. Erasing a person, exporting a property with its records, revealing a key, revealing the fingerprint key and downloading the audit log can each wait for someone else to approve. An approval lasts one day and is used once. A call that needs one answers 409 APPROVAL_REQUIRED.
  • A dashboard for each role. A person with no saved dashboard opens on the starter for their role. Starters for the owner, the grievance officer, the auditor and a Significant Data Fiduciary join the others. A chart whose figures the role cannot read says so.
  • Significant Data Fiduciary duties. Keep the yearly assessments and audits, and download the report for the Board. See Meet the duties of a Significant Data Fiduciary.
  • Legal holds keep evidence past its retention while a case runs. See Hold evidence for a case or an appeal.
  • Nominations and requests made for someone else. See Record or cancel a nomination and Handle a request made for someone else.
  • Consent Managers can send consent and withdrawals that are kept as sealed records. See Accept consent from a Consent Manager.
  • The DPDP rule set is versioned, and an operator can move a date without a release. See Change a DPDP date.
  • Privacy policy versions say whether a change alters what people agreed to. See Update the privacy policy.
  • Closing a project exports its data and schedules its deletion. See Close a project.
  • The audit log is sealed entry to entry and can be verified. See Verify the audit log.
  • New webhook events for a changed rule set, a published policy and a closing project. See Law and project events.
  • A platform key per operator. PLATFORM_API_KEYS holds one hashed key per person on the operator's team, and their approvals record their name. The shared PLATFORM_API_KEY still works. See Configuration.
  • Partners checked against data that must stay in India. For a Significant Data Fiduciary, the DPDP Act check names partners recorded outside India or with no country.

Changed#

  • Assigning a request has its own call, PUT /v1/api/subject-request/customer-user/assign. The update call ignores assigneeUserId and assigneeName. If you assign requests through the API, move to the new call.
  • An audit log reply waits for its entry. A reply whose entry could not be stored carries X-Audit-Log: not-stored.

Fixed#

  • Banner labels in every language. The heading over a site's own purposes, shown when partner choices are on, was in English in 36 languages. It is now in each language the runtime speaks.

4 October 2026#

Changed#

  • Records has one search box. Find lists a person's records in every property, live and test, by their identifier or a linked one. A consent ID or a proof hash finds that record instead. It replaces Subject lookup and matches every identifier type. See Find a person.
  • Records start on live records only. To see test records, choose Show test records or use More filters. The Overview list is unchanged.
  • Plainer filters and columns. Any status is now Any answer, and Any interaction is Any way of answering under More filters. Export CSV moved to the top and exports what is listed. The Proof column is gone.
  • A record reads top to bottom. A summary and the proof verdict come first. Proof chain is now What happened, and the hashes are under Technical proof. See Read a record.
  • Cookies is now Trackers, at the same address. It opens with what runs before people agree, then the trackers that need a decision. See Scan your site.
  • The DPDP Act check has its own page, opened from Trackers or the Overview. See Run the DPDP check.

3 October 2026#

Added#

  • A dashboard you can make your own. The Overview is now made of charts you can add, remove, move and resize with Customise. You can keep up to ten named dashboards in each project and start from Default, Privacy lead, Marketer or Developer. Every chart says how it is counted, can be read as a table and downloaded as CSV or PNG. Your dashboards are yours: other people in the project do not see them. See Customise your dashboard.
  • Charts beyond consent. Besides consent and banner figures, the catalogue charts rights requests and their deadlines, webhook deliveries, cookies set before consent and sealed events. See Dashboard measures.
  • Consent check. Your server can ask whether a person allows a purpose now, by the identifier your systems use, with POST /sdk/v1/consent/check. The answer says yes or no and why, gives the purpose's declared basis and names the records behind it. It never says yes for a purpose that is not based on consent. Grant the new scope Check whether a person allows a purpose to the key. A key may check 600 identifiers a minute unless you change Checks per minute. See Check consent before you process.
  • Import consent from a file. Records has Import CSV: map the columns, check every row without writing, then write the records. Each row can be marked as given before the DPDP Act and name the notice the person saw; that label is your statement, for your counsel to review. Your server can send the same fields with collectedAt. One consent.imported event reports each import. See Import consent from a file.
  • Notice campaigns for people already on your books. Send one published notice version to a list of people as single-use links that your own mailer or SMS gateway delivers. The page offers I have read this notice and Withdraw my consent; its wording awaits review by your counsel. The campaign records who was sent which version and who answered, under signed daily roots. New events: campaign.batch_issued, campaign.withdrawn, campaign.anchored. See Send a notice to existing customers and Send notice links from your own gateway.
  • How consent was taken, sealed with it. A write from your server can carry capture: the channel, how the person confirmed, a reference to your evidence and the SHA-256 of a scanned form. It is sealed with that write only. Records show it under How consent was taken, and webhooks and receipts carry it. A consent only your staff attest is marked Attested by staff. See Record consent taken in a branch, by phone or on paper.
  • Download the audit log, and a feed for your SIEM. Audit log has Download: whole UTC days as CSV or JSON lines. GET /sdk/v1/audit-log returns the log oldest first with a cursor, to a live secret key with the new audit:read scope. Each entry is also one JSON line on standard output. See Download the audit log and Send the audit log to your SIEM.
  • Processor tasks. Register the partners on your purposes as Data Processors or independent recipients, with days to stop and to erase. A withdrawal, a change that refuses a processor, an expiry or an erasure then writes a task for each Data Processor, listed in the webhook as processors. Record what each processor reported, in the console with an evidence file or through POST /sdk/v1/processor-tasks/acknowledge. Overdue tasks raise propagation.overdue once a day. Access responses list the instructions and what was reported. See Register your processors.
  • Replay failed webhooks from the console. Failed events in the Webhooks panel on Install sends failed events again with the same id, in their original order. See Replay failed webhooks.
  • Private networks per endpoint. An endpoint can reach an address on your own network when its Private network switch is on and the operator listed the network in PRIVATE_NETWORK_ALLOWLIST.

Changed#

  • Periods are whole UTC days. A period now covers whole days in UTC for every figure: 30 days is today and the 29 days before it. A figure can therefore differ from the one shown before. Records were counted to the minute. Banner views and answers per day reached back one day further, so they now read about a day lower for the same period. The Overview address uses period; old links still open.
  • What the audit log records. Saving or changing a personal dashboard is not written to the audit log, and neither are the chart queries the Overview sends.
  • Reads of personal data are recorded. Opening a record or a rights request, Subject lookup, exporting a receipt and downloading the audit log each write an entry. A lookup is recorded with the first 12 characters of the identifier's hash, never the identifier.
  • The audit log is append-only. The database refuses to change or delete entries.
  • Imports date and expire like the consent they bring in. A write with collectedAt seals each decision at that time, and the record's term counts from the day of import unless expiresAt is sent. Phone numbers in an import must be in E.164. collectedAt before 1990 is refused.
  • Events for an endpoint that is off are kept. They are stored as failed for 30 days and can be replayed once it is on again.
  • For operators. Ten migrations run at start. Two are for dashboards. Eight add the import, notice campaign, processor and erased-hash tables, columns on records, keys and webhooks, and the audit log trigger. On a large database, create the indexes beforehand as Upgrade and roll back shows. ALLOW_PRIVATE_WEBHOOK_URLS is no longer read, and the API refuses to start in production while it is true. Before upgrading, set PRIVATE_NETWORK_ALLOWLIST and turn on Private network on the endpoints that need it. New settings: DASHBOARD_STATEMENT_TIMEOUT_MS, DASHBOARD_MAX_STATEMENTS, SDK_CHECK_MAX_PER_MINUTE, CONSENT_IMPORT_MAX_ROWS, CONSENT_IMPORT_DAILY_ROWS, AUDIT_LOG_STDOUT, AUDIT_FEED_LAG_SECONDS, AUDIT_FEED_CALLS_PER_MINUTE and PRIVATE_NETWORK_ALLOWLIST. New metrics: dashboard_query_seconds, dashboard_query_timeouts_total, consent_checks_total, consent_import_rows_total, notice_links_issued_total, notice_responses_total, notice_anchors_total, notice_withdrawals_pending, processor_tasks_overdue and audit_log_write_failures_total. http_request_duration_seconds has two more buckets, 0.2 s and 0.3 s. Five new scopes: consent:check, campaigns:links, processors:read, processors:write and audit:read. GET /sdk/v1/audit-log takes live keys only.

Fixed#

  • An earlier answer no longer replaces a newer one or a withdrawal. A write with collectedAt for a person whose record is newer, withdrawn or erased since is refused with 409 and changes nothing. This holds under any identifier the write names or links. Before, it replaced the answer and cleared the withdrawal.
  • An erased person is no longer added back through an identifier that was linked to them.
  • Email double opt-in after erasure. Starting the opt-in again for an erased address created a link that could never be confirmed. It now starts a new record.
  • Subject lookup no longer puts the identifier in the request log. The console sends it in the request body. The API refuses subjectId in the address, and the request log masks it.

2 October 2026#

Changed#

  • Overview counts test records too. The Overview page has a list beside the period: Live and test, Live evidence or Sandbox (test keys). It starts on Live and test, so a project that has only test keys now shows its figures. Choose Live evidence to report on live records alone. Usage this month still counts live records only.

Older changes are in Product changes in September 2026.

↑↓ to move, Enter to open