Secure Privacy Changelog

Android v0.4.12 is now available, with reliable consent expiry handling, smarter recollection when your consent template changes, and clearer Accept/Save behaviour in the Advanced Banner.

Consent expiry

• Expired consent is now detected correctly — Expiry detection works as expected, including when Do Not Store Consent is enabled. Expired decisions are cleared on initialisation and are no longer applied, so users are re-prompted when they should be rather than running on a stale choice.

Consent recollection

• Existing choices survive template changes — When your consent template changes, users' existing choices are preserved instead of being discarded. New or expired consent picks up the correct regional defaults, so recollection only asks for what actually needs re-collecting.

Advanced Banner

• Accept means all, Save means what you picked — Accept grants all categories until the user changes a selection. Once they do, the button becomes Save and records exactly the categories they chose, removing the ambiguity between accepting everything and saving a partial selection.

Where to get it: Android — v0.4.12. Setup and configuration in the Android SDK documentation.

Two updates to the Tizen TV SDK: Preference Center links can now open in the TV's system browser, and remote-control navigation across the Consent Banner and Preference Center has been sharpened throughout.

External link handling (v0.1.93)

• Preference Center links open in the system browser — External links surfaced in the Preference Center — privacy policy, cookie policy, support pages — now hand off to the TV's system browser instead of dead-ending inside the app. Users can read the linked content and return without losing their place in the consent flow.
• application.launch privilege support — The SDK now supports the Tizen application.launch privilege, which is what allows the app to open external URLs. Add it to your app's privilege list if you want external links enabled.

Navigation & interaction improvements (v0.1.92)

• Improved D-pad navigation — Focus movement across the Consent Banner and Preference Center is more predictable, so every control is reachable with the directional pad without unexpected jumps or dead ends.
• Left/Right toggling in the Preference Center — Consent toggles can now be switched with the Left and Right remote buttons, matching how Samsung TV users expect on/off controls to behave.
• Clearer focus visibility — The currently selected item is more visually distinct, making it easier to track position while navigating from across the room.
• Improved DSAR keyboard interaction — Entering details into the DSAR form using the on-screen TV keyboard is smoother and more reliable.
• Faster interaction response — General performance improvements to input handling for a more responsive feel on TV hardware.

Where to get it: Tizen TV SDK v0.1.93 is live now. For setup and configuration, see the Tizen TV SDK documentation.

We've added a new Consent Details section to the Preference Center, giving end users visibility into the exact consent record captured for them.

What's changed:

• Consent ID now visible to users — After a user grants consent, the Preference Center displays a unique Consent ID — the database identifier of their consent record. This ID can be used by account admins to look up the corresponding entry in the Consent Hub on the CMP Dashboard.
• Consent Date shown alongside the ID — The date and time the consent was provided is displayed together with the Consent ID, giving users a clear record of when they agreed.
• Section hidden until consent is given — The Consent Details section only appears once consent has been captured; it stays hidden for users who have not yet interacted with the banner.
• Configurable in Design settings — Display of the Consent ID can be disabled per Design if you prefer not to surface it to end users.
• Withdraw button in the Preference Center — Users can now withdraw their consent directly from the Preference Center without needing to interact with the banner again.

Support article was added here - Cookie Banner Buttons Explained: Accept All, Decline, Save and Withdraw Consent

Preventing Permanent Startup Crashes on Restored Devices

We've fixed a rare but serious issue where the Android SDK could fail to start entirely on devices that had gone through a backup-and-restore cycle or otherwise lost access to
previously stored local security credentials.

What's changed:

• Startup crash resolved — Apps affected by this issue would crash on every single launch once triggered, with no way to recover. The SDK now detects unreadable legacy local data
  and safely continues initialization instead of crashing.
• Improved reliability on backup/restore — Devices restored from a backup, or that have otherwise lost access to previously stored security credentials, are no longer blocked
  from starting the app.

Here's the latest version -> Mobile SDK v0.4.10

We're opening a public preview of native consent management support for Samsung Smart TV apps running on Tizen — the most-used smart TV operating system in the US, active on hundreds of millions of Samsung TVs worldwide.

Features:

• D-pad-native consent banner — A consent banner and preference centre designed from the ground up for remote-control navigation. Every control — accept, reject, manage preferences — is fully reachable and operable using a TV remote's directional pad, with no mouse or touch support required.
• Lightweight two-script setup — Add a Tizen wrapper script before your existing Secure Privacy script tag in <head>. The wrapper prepares consent state in localStorage before the core SDK reads it, preventing the inconsistent first-launch consent state that direct SDK ports to TV environments typically produce.
• Safe initialization pattern — The SDK fires an sp:sdk-ready event when ready. A built-in fast-path guard handles the case where the event fires before your listener is registered, so there's no race condition to manage.
• Account-level audit trail — Consent collected on Tizen rolls into the same account-wide record as your web, iOS, and Android integrations — one unified audit trail for GDPR, CCPA, and regulatory reporting across every platform you operate.

For further configuration and installation details, refer to the Tizen TV SDK documentation.

Seat-Based Pricing — Add Users Without Changing Plans

We've introduced seat-based pricing for paid plans, giving teams flexible, on-demand control over how many users can access their account.

What's changed:

• Extra seats, on demand — Paid plans include a base number of user seats. Now you can purchase additional seats directly from your CMP dashboard at €5/month (or €50/year) per seat in EUR, and $6/month (or $60/year) in USD — no plan upgrade or support contact required.
• Immediate proration — Extra seats are added as a separate line item on your existing subscription and billed immediately with proration, so you only pay from the day you add them.
• Safe seat reduction — To reduce seats, remove the relevant users from your account first. The platform validates the change before applying it.
• Existing accounts unaffected — If your account predates this update and currently has more users than your plan's included limit, nothing changes. The cap applies only when you next add a user or switch plans. Enterprise and Advanced plans with unlimited users are unaffected.

Dedicated Sign-In for Google Tag Users

Users arriving from Google Tag or Google Tag Manager now have a sign-in experience built specifically for them.

What's changed:

• Google-first entry point — The new page surfaces Continue with Google as the primary — and only required — action. No email/password field to navigate past, no "Forgot password" detour.
• Deep-linkable URL — Available at a stable URL ready to bookmark
• Works on all devices — Responsive on desktop and mobile, with clear error messaging and a retry path for OAuth failures or cancellations.

DSAR Overhaul — Account-Level Data Subject Access Requests

We've completed a major redesign of how Data Subject Access Requests (DSARs) are created, configured, and managed.

What's changed:

• Account-level DSAR entity — DSARs are now fully decoupled from domain policies. A single DSAR can be assigned to multiple domains, and a designated responsible person (DPO or equivalent) can be linked at the account level rather than per policy.
• Flexible request routing — The DPO configuration has been redesigned as a routing step. Choose to route submissions via email (to an internal user or an external contact) or connect directly to your governance platform for advanced handling.
• Embedded DSAR forms, no domain attachment required — DSAR forms can now be embedded on any page without needing to be tied to a domain banner. All submissions are recorded and manageable (mark as Processed / Pending / Unprocessed) directly in the platform.
• Public APIs for DSAR submissions — New public APIs allow external integrations to record and manage DSAR submissions programmatically.
• Visitor geolocation on submissions — The DSAR form now infers and displays the visitor's country via IP (read-only), supporting regulation mapping and governance workflows.
• Governance platform integration — DSAR submissions in CMP now include a link to manage advanced cases in the governance platform, with DPOs loadable from governance.
• Streamlined setup defaults — The DSAR label now pre-populates with your company name. All fields are optional except Request Type. New accounts receive a pre-built DSAR with full translations.
• Refreshed "DSAR on a Page" experience — Updated UI/UX based on the new Privacy Portal design: revised icons, custom logo support, default language assignments, and cleaner notification styles.
• Product-aware visibility — Mobile App and TV App DSAR settings are now hidden from accounts that don't have those products activated, reducing clutter.

CAPTCHA on DSAR Forms

• CAPTCHA protection — External DSAR submission forms now support CAPTCHA. Customers can enable it with a on▎ DSAR Reimagined: Account-Level Forms, CAPTCHA Protection & Mobile Self-Servee-click setupby entering their API keys in the CMP settings.
• Rate limiting with user-facing validation — A limit of 1 DSAR submission per domain per 24 hours is enforced, with a clear message shown to visitors when the limit is reached.

Mobile SDK — Plans, Billing & Self-Serve Enablement

• Mobile plans and billing UI — A consolidated plans and billing experience for Mobile SDK is now available in the CMP, enabling clearer tier management and self-serve upgrades.
• Sticky banner for missing package assignments — Mobile app configurations with no packages assigned now surface a persistent in-app notification, prompting users to complete setup before going live.

CCPA Default Updated to Explicit Consent (Opt-In)

New Secure Privacy accounts now have CCPA configured with explicit (opt-in) consent and default cookie blocking enabled out of the box — no manual setup required.

This reflects current best practice in California, where enforcement around cookies dropped without prior user consent has increased significantly.  If you're an existing customer, we recommend reviewing your CCPA settings and switching to opt-in consent to stay aligned with this standard.

You can find the setting under your the CCPA template under your CMP Dashboard.

You now have a fastest way to connect Secure Privacy as your consent management platform — directly inside the Google Ads or Google Tag Manager interface, using Google's built-in consent mode setup wizard. No manual gtag('consent', ...) code. No extra scripts to maintain.

Secure Privacy is listed as a fully integrated platform in Google's CMP picker, which means Google handles the consent signal wiring automatically. We have created a setup guide which walks through every step of that wizard — from opening the Admin tab on your Google tag, to selecting Secure Privacy under Fully integrated platforms (free tier available), to publishing your consent banner and verifying that ad_storage, analytics_storage, ad_user_data, and ad_personalization signals are passing correctly.

The article covers:

• Where to find the wizard — navigating to the Google tag Admin tab in Google Ads (via Data manager) or Google Tag Manager
• Step-by-step wizard walkthrough — all six screens, from "Set up consent mode" through to the confirmation screen
• Selecting Secure Privacy as your CMP — finding the free-tier option under Fully integrated platforms and completing the connection
• Publishing the consent banner — choosing between GTM container publishing and manual installation
• Testing consent signals — using Google's built-in signal tester to confirm the integration is live and correct
• Troubleshooting — what to check if the banner isn't detected or consent signals aren't registering

This is the simplest path to Google Consent Mode v2 compliance for sites using Google Ads or Analytics — no developer needed, no manual tag configuration, and the free tier means you can get started immediately.

Read the full setup guide →

If your site sits behind a firewall, WAF, or other access controls, our compliance website scanner must be able to reach your pages. Without the correct allowlist, scans can be blocked and results may be incomplete or inaccurate.

Current scanner IP addresses (add these to your allowlist):

What to do

1. Add the IPs above to your firewall, WAF, or hosting provider allowlist.
2. Allow traffic both inbound and outbound for these addresses.
3. If you use a CDN or DDoS layer (e.g. Cloudflare, Akamai, AWS WAF), add the same IPs there if they enforce separate rules.

Important: Scanner IPs may change as we scale or maintain infrastructure. Check the allowlisting documentation regularly or subscribe to updates so your allowlist stays current.

Still blocked after whitelisting? Contact support@secureprivacy.ai.

We’re excited to announce that Secure Privacy now has React Native SDK. The Secure Privacy React Native SDK provides a unified way to collect, manage, and signal user consent for Android and iOS from a single codebase.

Features

• Unified consent — Collect, manage, and signal consent across both platforms with one integration.
• Simple JavaScript API — Consent handling from your React Native app via a straightforward API; no need to bridge native code yourself.
• Compliance — Built to help you meet GDPR, CCPA, and other privacy regulations.
• Consent Recollection — Consent stays in sync with your CMP and expiry rules; re-collection is supported when configuration or consent expires.
• DSAR (Data Subject Access Request) — Request types aligned with backend and native implementations for consistent handling.
• Preference center & banner — Same consent and preference flows you get with our native iOS and Android SDKs.

Where to get it:

• Install from the npm registry: @secureprivacy/react-native-mobile-consent.
• Source and full README: github.com/secureprivacy/react-native-mobile-consent.
• Setup and configuration: docs.secureprivacy.ai — React Native SDK.

Native SDK support for the React Native layer

• Our iOS SDK v0.3.4 and Android SDK v0.4.5 support the React Native layer. Use these versions (or later) when building with the React Native SDK.

iOS v0.3.4 and Android v0.4.5 are now available, with DSAR form alignment to the Preference Center API, backend-driven validation, and standardised error handling.

DSAR form & Preference Center (iOS v0.3.4)

• Dynamic required fields — Required-field indicators on the DSAR form are now driven by your Preference Center API configuration.
• Backend validation — Validation happens on the backend at submission; the SDK displays returned error messages in the UI.
• Standardised DSAR types — DSAR type values match backend enum definitions across platforms.

Error handling (Android v0.4.5)

• Error codes — New and standardised error codes with the ACP prefix for clearer diagnostics.
• DSAR type fix — Request type selection now correctly submits the user’s chosen DSAR type.

Where to get it: iOS — v0.3.4 on CocoaPods / Swift Package Manager. Android — v0.4.5.