TrustArc changelog

The Mobile App Consent SDK now reads each region's consent model from the server and, in opt in regions, applies the configured default category consent at app start without showing a banner, while regions with GDPR in scope, opt out regions and accounts with no default category are skipped. Three new iOS APIs (setAttOptOutLevel, setShowAttOptOutWindow, setAttOptOutLockCategories) control which categories are rejected and locked when a user declines Apple's App Tracking Transparency prompt, and a new getWebCookie() function returns consent cookie values on Android, iOS, Flutter and React Native.

Buyer relevance. This changes what the SDK decides on a user's behalf without any user action, so legal teams should confirm their per region consent models and default categories match their own legal position before the new behavior takes effect in their apps.

Individual Rights Manager release 2026.09.2 adds Due Date Countdown Rules that start the data subject request deadline clock from either the Request Received Date or the Request Verified Date, set per intake form, request type and brand, with the most specific rule applied and the global setting as fallback. The same release adds a Bulk Verify action that moves multiple Unverified requests to In Progress, excluding requests that require Evident or IDology identity checks.

Buyer relevance. Privacy counsel handling access and deletion requests under different laws can encode each statute's deadline trigger in the system instead of tracking exceptions by hand, which lowers the risk of missed statutory response dates.