--- title: "Release 147" description: "Privacy signal hardening (GPC, a minimum TCF policy version), tiered referral commissions, reorganized admin sidebar, API active filter, and a major legacy cleanup." type: "reference" audience: [network-manager, admin] keywords: [release 147, release notes, GPC, TCF, referral brackets, admin sidebar, active filter] --- Fetch the complete documentation index at: https://epom.com/ad-server/docs/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version. # Release 147 **Released:** May — June 2026. This release focuses on privacy compliance, a fairer referral program, a cleaner admin experience — and the largest legacy-code cleanup in the product's history. ## New features ### Filter the banners and campaigns API by active state `GET /rest-api/banners` and `GET /rest-api/campaigns` now accept an optional `?active=true|false` query parameter, so integrations that only care about live inventory no longer have to pull every non-deleted record and filter client-side. Omitting the parameter keeps the previous behavior, so existing callers don't have to change anything. See the [REST API reference](https://epom.com/ad-server/docs/api.md). ## Improvements ### Stronger privacy controls: GPC, minimum TCF policy version and CMP verification Three compliance gaps in the ad-serving consent gate are closed, each behind its own admin toggle: - **Global Privacy Control** — when a request carries the `Sec-GPC` header (or `gpc=1`), a request in GDPR scope is treated as no-consent whatever its consent string says, honoring the CPRA opt-out commitment. - **Minimum TCF policy version** — consent strings below a configurable TCF policy version are rejected. The default floor is 4, which is TCF v2.2, so v2.2 and v2.3 strings pass while older v2.0 and v2.1 strings do not. TCF v1.x strings are refused whether or not this is on. - **IAB CMP verification** — the consent string's CMP ID is checked against the IAB Global CMP List (refreshed daily and cached on disk so an IAB outage doesn't affect serving). Unknown or deleted CMPs are rejected. All four toggles ship **off by default** — nothing changes until your network administrator enables them in the admin GDPR preferences (see [GDPR and TCF consent](https://epom.com/ad-server/docs/guides/admin/gdpr-tcf-consent.md)). Turning on the policy-version check or CMP verification will start rejecting consent strings that previously passed, so expect an impact on GDPR-governed traffic when enabling. ### Referral program: tiered revenue-share brackets The global referral commission is no longer a single flat percentage — it is a schedule of marginal brackets, like income tax, so commission scales with the referred account's monthly net revenue (for example 1% under $100, up to 10% above $5K). Your [referral program](https://epom.com/ad-server/docs/guides/collaboration/referral-program.md) page shows the active brackets table; per-user percentage overrides keep working as before. Existing users stay on their previous flat percentage until the network administrator publishes a bracket schedule. ### Admin sidebar regrouped by what you actually do The admin sidebar is reorganized into thirteen functional groups — Users & Access, Ad Serving, Demand Partners (DSP), Audience & Analytics, Categories & Labels, Targeting Presets, Creatives & Tags, Notifications, Validation & Anti-Fraud, Billing & Fees, Self-Serve, Customization & Reference, and Audit & Diagnostics — replacing the historical catch-all "System Config / Maintenance / Monitoring" split. Several pages moved to where they semantically belong (Action Log into Audit & Diagnostics, and so on). The "REST APIs Reference" admin page was removed — its hand-maintained docs duplicated the interactive [API documentation](https://epom.com/ad-server/docs/api.md), and the REST API Keys form moved to a new tab on the [White Label](https://epom.com/ad-server/docs/guides/admin/white-label.md) page. Group titles are translated in all 15 UI languages. See [UI navigation](https://epom.com/ad-server/docs/reference/ui-navigation.md) for the current layout. ### More connected devices recognized "Vehicle Display" and "Conference Phone" device types are now classified as Connected Device (Smart TV family) instead of being unrecognized, improving device targeting and analytics accuracy for those traffic slices. ## Bug fixes - **DSP analytics recording is more resilient on large fleets.** Concurrent analytics writes from many ad-serving nodes could deadlock and lose part of a batch; writes are now chunked and ordered so a conflict retries only a small slice instead of failing the batch. - **CDN health monitoring no longer floods logs when an upstream CDN misbehaves** — provider-side errors are classified separately from network failures and repeated identical failures are suppressed, so real problems stand out. - **Upgrade safety for removed features** — permissions and data left behind by retired features are cleaned up during deployment so role and user records load correctly on the new version. - **Ad serving no longer stalls under heavy frequency-capping load** — a rare crash when many capping rules were evaluated at once has been fixed. - **Browser-Country targeting now filters traffic again** — rules using the Browser Country dimension were saved but silently ignored at serve time; they are honored now. See [Targeting dimensions](https://epom.com/ad-server/docs/reference/targeting-dimensions.md). - **Video ads keep their referer over server-to-server VAST**, so referer-based targeting and reporting work for S2S video traffic. - **Creative scanning accepts UK traffic correctly** — the country code is normalized to the standard ISO form before creatives are submitted to the scan provider. ## Post-release improvements - **A "Tracking Pixels" field is labelled clearly as an HTML snippet** (not a URL), and network administrators can now grant the **Traffic Risk Score** filter permissions from Admin Roles. - **Quieter logs** — expected client errors (4xx) and routine CDN-cache purges no longer show up as ERROR-level noise, so genuine problems are easier to spot. ## Retired features Long-inactive features were retired end-to-end, including Direct Deal, the legacy mobile/app ad-network banner types (superseded by OpenRTB DSP years ago), the external-networks reporting pull, the Real-Time Data admin page, mass-mail management (a simpler Email Unsubscribe List page remains — and unsubscribes are now actually enforced on the send path), RTB Competitors / DSP Simulator, the legacy security-scanner integrations (per-creative [DSP creative scanning](https://epom.com/ad-server/docs/use-cases/creative-policy-protection.md) from Release 146 is the current protection), and several unused admin utility pages. None of these were in active use. ## Under the hood Platform upgrades and performance work. ## Related - [What's new in Epom Ad Server](https://epom.com/ad-server/docs/releases.md) - [Release 148](https://epom.com/ad-server/docs/releases/release-148.md) - [Release 146](https://epom.com/ad-server/docs/releases/release-146.md)