tarteaucitron.js 1.33.0 was released on May 27, 2026. It includes two changes: a new service customization option and a security fix related to cookie removal.
The changes are documented in the GitHub release.
Adding a description below a service name
This version makes it possible to add a description below the name of a service in the tarteaucitron.js interface.
The feature was contributed by @Cruiser13. It provides an additional way to explain the purpose of a third-party service to visitors.
A service name alone does not always make its purpose clear. An additional description can help explain how a service is used, particularly when several similar services appear in the consent panel.
The information should remain accurate and consistent with the actual processing performed by the service. Adding a description does not replace the information required in a privacy policy.
Security fix involving data-cookie
The second change concerns the data-cookie attribute, which is used in certain cookie management mechanisms.
An issue allowed this attribute to be used to delete arbitrary cookies. The fix prevents that behavior.
The change was contributed by @Rudloff and is available in commit 24b5464.
Cookie removal operations should be limited to the expected targets. A value supplied through an HTML attribute should not allow arbitrary cookies to be selected without appropriate validation.
This is a fix to the internal security of tarteaucitron.js. It does not change the underlying consent management mechanism.
Updating is recommended
Version 1.33.0 is available on GitHub.
I recommend updating open source installations to benefit from the security fix, even when the new service description feature is not used.
Thanks to Cruiser13 and Rudloff for their contributions to this release.
