Consent You Have to Keep Current: Signals W45

9 min read

For most of the time I have worked with email platforms, tracking consent was something a recipient gave once, usually at sign-up, and that the platform then carried around as a flag. The interesting decisions happened inside the sending engine: whether to add the pixel, whether to wrap the links, whether to send at all. The Week 45 MarTech Watch records a shift that I think is more important than any single feature in it. Tracking consent is becoming something the recipient can revisit, from a page they control, and the platforms are starting to treat that page as the place where the answer lives.

TL;DR

Open-tracking consent moves to the channel. Adobe Journey Optimizer’s Honor open tracking consent, in the October release, removes the open pixel for recipients without consent at send time, with no journey edits, though some existing messages need republishing.
The preference centre becomes the control surface. Klaviyo’s tracking consent block lets recipients change open and click consent from a preference page at any time, so the speed at which that answer reaches the profile the sender reads decides whether the setting works.
Consent signals get finer. Tealium’s OneTrust integration supports vendor or service-level signals, Zeotap shows the applied consent rules where audiences are activated, and the CNIL addresses session replay to both providers and publishers.
Agent access follows roles and expiry times. Optimove’s AI Permissions keep AI within the user’s own role, off by default, and MoEngage lets API keys use short-lived OAuth 2.0 or AWS STS credentials.

The change that matters most to me this week comes from a platform I use in production. Adobe Journey Optimizer has moved its open-tracking consent option out of the Coming soon list and into the October release, under the name Honor open tracking consent. It is a setting in the email channel configuration, and it “removes the Journey Optimizer open-tracking pixel for recipients who have not consented”, while delivery, content and unsubscribe links stay as they are. Consent is stored in the Experience Platform profile and evaluated for each recipient at send time, and the option can be turned on “without editing your existing journeys and campaigns”.

The last point is the one I would underline for anyone running a large AJO instance. Consent options that require touching every journey tend to be switched on for new programmes only, which leaves the old ones, often the busiest, running on the previous rules. A channel-level setting avoids that, with one exception the release note is careful to state: some existing messages, transactional ones among them, have to be republished before the setting applies to them. That is worth a line in the rollout plan, because transactional templates are exactly the ones nobody opens unless something is broken.

Klaviyo, a platform on my wider watchlist that I do not use in production, added the other half of the picture. Its What’s New page describes a tracking consent block for preference pages, so brands can let recipients “change email tracking consent anytime”, with the block “covering opens, clicks, or both, shown only in regions you choose”.

Put these two next to each other and the model changes. When consent was collected once, the send-time check was mostly a formality, because the answer rarely moved. When a recipient can change it from a preference page at any moment, the send-time check becomes the point where a changing preference meets a fixed message, and the quality of the whole chain depends on how quickly the preference reaches the profile the platform reads. In my reading, that is the architectural question this week raises: not whether a platform can drop the pixel, which several now can, but where the current answer is stored and how many systems have to agree on it before the next send.

The preference centre as the control surface

For years the preference centre has been treated as a form attached to the unsubscribe link, often built and hosted outside the engagement platform, with its own small database and a nightly sync. That was acceptable when it only managed topics and frequency. It becomes a weak point once it also carries tracking consent, because a nightly sync means a recipient who withdraws consent in the morning can still be tracked by the afternoon campaign.

Bloomreach states the remaining gap clearly in its release 1.321 notes, recorded in the previous edition: consent is checked when the email is sent, so “a withdrawal after sending doesn’t stop opens and clicks on that email from being recorded”, and stopping this “is planned for a future release”. I read that as an honest description of where every send-time model ends today. The preference can change after the message has left, and the platform still has to decide what to do with the events that message produces.

For a project, this suggests treating the preference centre as part of the consent architecture. The questions I would ask are practical ones. Which system owns the tracking consent field? Does the preference page write to that system directly or through a batch? Do the reporting views know that open rates now describe only the consented part of the audience? None of these is answered by a platform setting, and all of them decide whether the setting does what the privacy team thinks it does.

Two other releases point in the same direction from the data side.

Tealium updated its OneTrust integration to support vendor or service-level consent signals, with the existing category-based enforcement unaffected. Moving from categories such as “marketing” or “analytics” to individual vendors is a meaningful step, because a recipient who accepts analytics in general may not accept a specific session-recording tool, and category flags cannot express that.

Zeotap’s Q3 2026 release notes, published this week with quarter-level dates, include a rebuilt channel consent rule builder that can express nested logic the previous one could not, and they make the applied consent rules visible inside the destination settings of audiences and journeys. That second detail is the one I find useful in practice: the person activating an audience can see which consent rules are in force at that point, without looking them up in another screen.

The common thread is granularity. Consent is moving from a few broad flags towards per-vendor and per-channel rules, and the systems that activate data are starting to show those rules where the activation happens. For an architect, that means the consent model in the CDP and the one in the engagement platform have to be designed together, because a per-vendor signal that arrives in the engagement platform as a single boolean has lost most of its meaning on the way.

Beyond email: session replay

The regulator item this week concerns websites and apps, and it belongs in the same discussion. The CNIL published a recommendation on session replay tools, the tools that record mouse movements, taps, clicks, scrolling and in some cases form entries, and reconstruct a visitor’s path as a video. The recommendation is addressed both to the providers who build these tools and to the publishers who deploy them, and it covers data minimisation, the information given to users and the way consent is collected.

I am not a lawyer, and I would not draw conclusions about any specific tool from a press page. What I take from it is the shape of the obligation: the provider is expected to make minimisation possible by design, and the publisher is expected to configure and justify it. That is the same split we see in email tracking, where the platform offers the option and the brand decides how to use it, and it is a reminder that the preference centre and the consent banner are increasingly two views of one set of decisions.

Access scoped by role and by time

The other theme in the record this week concerns access for agents and integrations, and I keep it short because it deserves its own essay once the features mature.

Optimove, on my wider watchlist, added AI Permissions per role, applying to both its MCP server and its in-app agent. The release note says “AI can never do more than the user’s own role allows”, the setting is off by default, and it is in open beta, with permissions to stop, delete and archive still listed as coming next. MoEngage, also on the watchlist, now lets each API key use OAuth 2.0 or AWS STS authentication, with access tokens settable from 5 to 60 minutes and STS credentials from 5 to 15 minutes, and adds keys scoped to specific API groups.

One release limits what an agent can do by the role of the person behind it, the other limits how long a machine credential stays valid and what it can reach. Both are small steps, but they move access for agents and integrations closer to the rules we already apply to people, which is the direction I discussed in the essay on whose name is on the agent.

Also in the record

Marketo Engage updated its November release notes ahead of the 6 November rollout, with the Plan Campaigns skill now marked released and Callable Agents still listed as coming soon. Adobe Journey Optimizer B2B published release 2026.10 with static and dynamic people lists. Salesforce signed an agreement to acquire Cresta, a voice-agent platform for customer service, which adds another conversation channel to a portfolio that already includes the pending Braze acquisition. All three are in the record with their dates and links.

For this week, the part I would act on is the least visible one. Before switching on any of the new consent options, map where the recipient’s current answer is stored and how long it takes to reach the system that sends.

Consent is no longer a flag you collect once, it is a preference you have to keep current, and the preference centre is where that work now starts.

Sources

Adobe Journey Optimizer and Marketo Engage

Journey Optimizer release notes. Source for Honor open tracking consent, its availability date, the channel-level switch and the republishing note.
Journey Optimizer B2B release notes. Source for release 2026.10.
Marketo Engage November 2026 release notes. Source for Plan Campaigns and Callable Agents status.

Klaviyo

What’s New. Source for the tracking consent block on preference pages, 3 November 2026.

Bloomreach

Release 1.321. Source for consent checked at send and the planned handling of withdrawal after sending.

Tealium

Release notes feed. Source for vendor or service-level consent signals in the OneTrust integration, 4 November 2026.

Zeotap

Q3 2026 release notes. Source for the rebuilt channel consent rules and their visibility in destination settings.

Optimove

October 2026 What’s New. Source for AI Permissions per role, default state and beta status.

MoEngage

October 2026 release notes. Source for OAuth 2.0, AWS STS and scoped API keys.

Salesforce

Salesforce signs definitive agreement to acquire Cresta. Source for the Cresta agreement.

Regulation

CNIL, recommendation on session replay tools. Source for the scope and addressees of the recommendation, 5 November 2026.

The record

MarTech Watch, Week 45. Every date and status referenced in this essay.
Part 26, Week 44. The previous essay, on running two platforms side by side during a migration.
Weekly AI Tools That Matter to Me: Part 15, Week 45. The same week on the agentic tools beat, where the admin console gained a baseline, a check in the request path and a calendar of dated defaults.

The digest behind each weekly article is produced through a structured AI-assisted scan of official release notes and product update sources. I review the output, verify the relevant signals and write the architectural interpretation.

This article draws from the Martech Weekly Digest scans run on November 5, 2026, covering 30 October to 5 November across several CEP platforms and vendors. The dated record behind it is in MarTech Watch, Week 45.

If you find errors or gaps in coverage, I want to know. The process improves when the output is challenged.