🎉 OneTrust 202609.1.0 Released!

We are excited to announce the following enhancements in the OneTrust Developer Portal as part of OneTrust 202609.1.0.

AI Governance

General Availability

• New AI Governance Attribute Management APIs
  Added APIs to retrieve AI Governance schema definitions, schema attributes, and attribute option values. These APIs enable developers to programmatically discover schema structures, access attribute metadata, and retrieve available attribute options for AI Governance workflows.

  • Get List of Schemas API
  • Get Attribute by ID API
  • Get List of Schema Attributes API
  • Get List of Schema Attribute Options API

• Enhancements to the Create Task API
  Updated the Create Task API to support the ai-governance value for the moduleSource request parameter. This enhancement enables tasks to be created and associated with AI Governance workflows.

Cookie Consent

General Availability

• ​​Enhancements to the Publish Script to Website API
  Updated the Publish Script to Website API to include the ccpaOptOutEnabled request parameter. This parameter controls whether the CCPA/CPRA opt-out icon is displayed alongside the Do Not Sell or Share button when presented to site visitors.

Data Mapping Automation

Fixed

• The list of supported values for the inventoryType path parameter in the Get Inventory Links API has been updated to correctly reflect supported inventory types. The incorrectly documented data-elements value has been removed.

Data Subject Rights (DSR) Automation

New Public Preview Features

• New Get List of DROP Records API
  Added the Get List of DROP Records API to retrieve DROP records with support for filtering, pagination, and sorting. This API enables developers to programmatically query DROP records by criteria such as status, created date, and updated date, making it easier to monitor and manage DROP request processing workflows.

Existing Public Preview Features

• New DROP Management APIs
  Added the Create Data Subject Request for DROP Record API and the Update DROP Record API to create and update the status of Delete Request and Opt-out Platform (DROP) requests, respectively. These APIs support California-registered data brokers in managing DROP requests for deleting or opting out data subjects permanently.

Mobile App Consent

Fixed

• Resolved an issue where IAB TCF and GPP consent string values were not recomputed when an Age Gate was enabled after a user had already provided consent. Consent strings are now correctly recalculated when Age Gate or App Tracking Transparency (ATT) conditions change, ensuring generated consent signals accurately reflect the user's current consent eligibility and preferences.

• Resolved an issue that caused general vendor consent calculations linked to purposes to use consentToggleStatus instead of consentStatus. Vendor consent values are now calculated using the correct consent state.

• Resolved an issue that allowedAGEGATE_RANGE interactions to be created without a valid age range. CMP API responses now include ERROR_CODE_AGE_RANGE_REQUIRED for the code parameter and At least one age bound (lower or upper) must be provided for the message parameter. This change ensures age range interactions include at least one valid age bound.

New Public Preview Features

• Enhancements to Consent Management Platform (CMP) APIs
  The following enhancements have been made to the CMP APIs:

  • Added the closeButtonAriaLabel key to globalOptOutData, mapped from GlobalOptOutFormIntegration.GlobalOptOutCloseButtonAriaLabel. This provides accessibility support for the Global Opt-Out close button in the CMP APIs.

  • Applied caching optimizations for Global Vendor List (GVL) processing by caching constructed GVL instances and reusing them across requests. This enhancement reduces redundant vendor and purpose map generation and improves CMP API performance.

  • Added web device type support to the Get Banner Data API. When OT-Device-Type: web is specified, the API returns a full banner response including web-specific UI data, behavior flags, and consent configuration, bringing the Web SDK in line with Mobile and CTV SDK support.

  • Optimized vendor filtering logic by removing unnecessary object copying and improving in-place processing of vendor data, reducing processing overhead on Get IAB and Google Vendors API and Get Preference Center Data API requests.

  • Added per-request caching for purpose data retrieval to prevent redundant TC string decoding and purpose tree generation when identical purpose data is requested multiple times during a single Get IAB and Google Vendors API or Get Preference Center Data API request.

Existing Public Preview Features

• Consent Management Platform APIs
  The following APIs are available for retrieving the interface attributes needed to display the banner and preference center, retrieving active IAB and Google vendor information, logging consent interactions, and submitting global opt-out data subject access requests. These APIs enable developers to retrieve the data required for banner and preference center experiences, disclose vendor information to end users, capture consent preferences, and support Global Opt-Out workflows across devices and services.
  • Get Banner Data API
  • Get Preference Center Data API
  • Get IAB and Google Vendors API
  • Log Consent API
  • Get Universal Consent Purposes API
  • Submit Global Opt-Out Request API

Universal Consent & Preference Management

General Availability

• Enhancements to Bulk Export APIs
  Updated the Bulk Export APIs with the following enhancements:

  • Updated the Create Bulk Export API to support the ANONYMOUS_RECEIPTS export type, enabling bulk exports of anonymous consent interaction data. This enhancement introduces a dedicated export path for anonymous receipt records, separating anonymous traffic from identified receipt exports.

  • Updated the Create Bulk Export API and Get Bulk Export Status API to support the collection point type filter option within the params object of the request. This filter enables receipt exports to be filtered by collection point type, such as WEB_FORM, MOBILE_APPLICATION, API, COOKIE, TRUST_CENTER, and more.

  • Updated the Create Bulk Export API, Get Bulk Export Status API, and Get List of Bulk Exports API to return the organizationGroupId response parameter, identifying the organization associated with a bulk export job.

• Enhancements to the Create Consent Receipts API
  Updated the Create Consent Receipts API to include the ReactivationDate request parameter to specify when a withdrawn or opted-out consent purpose should be automatically reactivated. This parameter supports temporary consent withdrawal scenarios by allowing consent to be reactivated on a specified date and time.

Fixed

• Resolved an issue that prevented the Get Bulk Export Status API from returning the correct value for the recordCount parameter when filter criteria was applied using the params object.
• Resolved an issue that caused the Get List of Receipts V2 API to return isValid: true for the purposeNote object when a purpose note was not present.
• Resolved an issue that prevented a purpose's expiry date from clearing from the expiryDate object within the profiles object of the Get Data Subject Details V4 API after consent receipts were submitted with the ClearExpiration option enabled in the receiptOptions object.