Consent Docs
Open console

Product changes

What changed in the console, the API and webhooks on each release date, newest first, with what you need to do about each change.

Release notes8 min readFor everyone

Newest first. Each entry says what changed and what to do, if anything. Changes to the runtime and the packages are in SDK versions.

7 November 2026#

Added#

  • Law updates, beside the DPDP Act check, lists every date and period of the DPDP Act and Rules the product follows. Each comes with its Gazette notification, and Coming into force shows what starts next. See DPDP rule set.
  • The periods of the Rules are in the rule set. They are the 90 days to answer a request (rule 14(3)) and the 72 hours for the Board report of a breach (rule 7(2)(b)). They also include the 48 hours' notice before inactivity erasure (rule 8(2)), the three years of inactivity (Third Schedule) and the year logs are kept (rule 8(3)). When the Government amends one, the operator records the new value with its notification and the day it takes effect. No release is needed. See Change a DPDP date or value.
  • Each request and breach keeps the rules version it was handled under. A request uses the response period in force on the day it is received. A breach uses the report window in force when you became aware. Open cases keep their deadlines when a value changes later.

Changed#

  • The rule set is version 2026.2. Each project sees The DPDP rule set changed once. No date or value you already had changed. Choose I have read this on Law updates or the check page.
  • ruleset.changed carries valueChanges and values, and its fingerprint covers the values. See Law and project events.
  • Evidence retention below the period of rule 8(3) is refused with 400 RETENTION_BELOW_LAW, which names the least number of days.
  • The DPDP Act check names its rules version at the foot of the page. The list of dates moved to Law updates.

31 October 2026#

Changed#

  • Larger, clearer text. Body text, tables and buttons are 15px, secondary text is 14px, and section titles are 20px. Charts keep their sizes.
  • One main button per page. In the form editor it is Publish. A second blue button on a page is now a plain button.
  • The form editor gives the preview more room. The live preview fills the right column, and Where this form is shown moved to the Settings tab. The form's key is under Actions. The steps a form needs show only while one is missing, and clicking a missing link goes to its field.
  • Set-up steps show only while set-up is unfinished, and only on Consent forms, Regions and Install. A live property shows Live on Properties.
  • Explanations are folded away. How a property is set up, How it works on Install and How a campaign works open when clicked.
  • Colour means one thing. Red is for what needs action now, green for live, and grey for normal states. Closed campaigns, audit entries and key scopes are grey. Zeros on the Overview are grey.
  • Requests show what each one is about. The first line of the note sits under each reference.
  • Regions hides rules that are off for laws the deployment does not offer.
  • A calmer top bar. Overview, Consent forms, Records and Requests are the only words in it, on the left. Install, Trackers, Properties, Audit and Settings are icons on the right that name themselves when you point at them. The project label and the forms count are gone, and the health mark shows words only when something needs you.
  • Settings has its own place. People and roles and Approvals sit beside it. Processors, Consent Managers and Set up a site stay beside Properties.
  • The DPDP Act check is in the top bar. It leads with the score: a bar of what is met, failing, to check and not yet checked. Findings sit under Fails and Check, each with a link to where you fix it. Scan your site is the page's one main button.
  • Overview opens the dashboard and nothing else.
  • The line under the top bar lists only the pages beside this one, such as Records and Notice campaigns. The project and property names are in the top bar.
  • Requests show when and how each one arrived. The Received column replaces the person's fingerprint, which stays on the request itself.
  • Field hints take one line and show in full while you use the field.
  • The form editor's preview is close to life size, and chart text is one size larger.

28 October 2026#

Changed#

  • A deployment covers the DPDP Act in India by default. Regions offers only the DPDP Act and the rule for everywhere else. Form settings hide the IAB frameworks and Global Privacy Control, and Settings hides the IAB registration, unless one is already in use. Rules and forms that use another law keep working. To offer every law again, set PRODUCT_SCOPE=global. See Configuration.
  • Rights requests follow the DPDP Act in India. A deployment for India takes access, correction, erasure, withdrawal, nomination and grievance. It refuses portability, objection and restriction with 400 SUBJECT_REQUEST_TYPE_NOT_OFFERED, and the hosted request form no longer offers them. Every deadline is capped at 90 days.
  • IAB TCF and GPP stay off in India. Turning either on for a form is refused with 400 FRAMEWORK_NOT_OFFERED. A form that already has one on can keep it or turn it off.
  • Every rule asks first in India. A rule that is not opt-in is refused with 400 DPDP_REQUIRES_OPT_IN, and the rule for everywhere else starts opt-in.
  • Rules for other laws are turned off in India. When the API starts, it turns off every rule made for another law, such as GDPR or CCPA. It makes any other rule that is not opt-in ask first, including the rule for everywhere else. Each change is in the audit log and sent as region.rule.changed. Visitors those rules served now get the rule for everywhere else. What to do: check Regions, and add an Everywhere else rule if a form has none.
  • A purpose rests on consent or a section 7 use. In India the purpose editor offers only these two. Strictly necessary from the purpose library now names section 7(a), so it passes the DPDP Act check's lawful basis item.
  • Pages that sit under another show beside it. The last part of the path at the top of a page switches between related pages. For example, Audit sits beside Significant Data Fiduciary and Legal holds. Properties sits beside People and roles, Approvals and Settings.
  • The console is in Hindi. Choose हिन्दी under Console language in Settings. A browser set to Hindi opens the console in Hindi.
  • Each form's tools are in one Actions menu on the Consent forms list.
  • A new notice campaign asks three things first: its name, the notice and what a withdrawal covers. The rest is under More options.
  • Plain names in the audit log and on Processors. The audit log names each area and action in words, such as Keys and Looked up, and Processors shows purpose names. A new notice takes its key from its title.
  • Less on each screen. A request says what to do next. The DPDP Act check shows the five most serious fixes first. Install puts the script tag first, with the rest under Other ways to install. The form editor's tools sit in one Actions menu, and Experiments appears once a site has two published forms.
  • The form editor has tabs: What you ask, Languages, Look and Settings, so it shows one task at a time.
  • Set up a site. A guided path under Properties takes a new site to a published DPDP banner, shown in India and everywhere else, and its script tag, in five steps.
  • A banner is checked when you publish it, not later. In a deployment for India, publishing a cookie banner or privacy notice that lacks what a DPDP notice needs is refused, and the publish dialog lists what to add. The form's set-up steps flag a missing complaint link, and a form no rule shows reads Not shown anywhere instead of live.
  • A new property is selected once it is created, and a new form takes the property's privacy link.
  • Install shows a snippet only with a key that works on the site. It no longer offers a project key that does not allow the property's addresses.
  • On a request, the action that does the work comes first. Erase and complete, Export and complete and Withdraw and complete are the main buttons. Mark completed closes the request only.
  • Plainer words for people who are not developers. Technical settings sit under For your developer, the evidence anchors read as fingerprints, and the form editor keeps brand, colours and custom code under Optional.
  • Open requests can be assigned from the list. The Handler column on Requests offers Assign to me, or the people whose role handles requests.
  • On a phone, the forms list and the evidence anchors show each row as a card, and long addresses in the DPDP Act check wrap.

Fixed#

  • An audit entry from a request without an id has no target. A call whose address held undefined instead of an id used to record the word as the entry's target. Such entries now have none, and the console shows a dash for the older ones. The sealed log itself is unchanged.
  • Dates and numbers that are missing or broken show a dash instead of NaN, undefined or a page that does not load.

Earlier October changes are in Product changes, early October 2026.

↑↓ to move, Enter to open