# Records of Consent: The Fields You Will Be Asked to Produce

Source: https://cookieaegis.com/blog/2026-11-04-cookie-consent-records-proof.html

[Home](../index.md) / [Blog](index.md) / Consent and Live Chat Widgets: The Tracker Hiding in Your Support Tool


Published 2026-11-04

A defensible consent record holds who consented, when, to which purposes, under which banner version and notice text, and how the choice was captured. If any one of those fields is missing, you hold a claim about consent rather than evidence of it, and the difference only becomes visible on the day someone asks.

## The five fields that make a receipt

Start with identity: a pseudonymous consent ID tied to the browser or account, not a name, but stable enough to retrieve one person's record. Then the timestamp, the purposes as separate values rather than one lumped yes, the version of the banner and the privacy notice shown, and the capture method, whether that was a button click, a settings save, or a Global Privacy Control signal honoured by the site.

Version is the field most records lack. Banners change copy, vendors change purposes, and a consent given under last year's text gets quoted against this year's processing. Without the version, you cannot show what the person actually saw, and the demonstration duty in GDPR Article 7 turns on exactly that showing.

## Retention cuts both ways

Keep consent records too briefly and you cannot evidence consent for processing that is still running. Keep them forever and the record itself becomes an over retained dataset with its own exposure. The working pattern is to retain the receipt for as long as the consent is relied on, plus the limitation period your counsel sets for the claims it might answer, and to delete on a schedule that someone can point to and prove ran.

Withdrawal needs a record too. The withdrawal timestamp, and evidence that downstream systems acted on it, is half the file. A consent platform that logs grants in detail and withdrawals as a vanished row has the asymmetry backwards, because the withdrawal is the event most likely to be tested. [Testing Consent Mode in the Denied State, Not Just the Granted One](https://cookieaegis.com/blog/2026-11-03-consent-mode-denied-state-testing.md) covers how renewal events should write fresh records rather than overwriting old ones.

## Testing the record before anyone asks

Run the export test quarterly. Pick a consent ID from a test device, request its full record through the same route a data subject request would take, and time how long production takes. If the answer needs a vendor support ticket and three days, the record keeping has failed in practice whatever the schema says on paper.

Check the joins as well. The consent ID has to connect to the analytics and advertising systems that acted on the consent, or the record proves a choice that nothing obeyed. That join, tested with a denied consent and a network recording, is the cheapest audit your programme will ever run and the one that finds the expensive problems.

Keep reading: [Testing Consent Mode in the Denied State, Not Just the Granted One](https://cookieaegis.com/blog/2026-11-03-consent-mode-denied-state-testing.md) [Your Redesign Changed Your Cookies. Rescan Before You Announce It.](https://cookieaegis.com/blog/2026-11-03-cookie-scan-after-redesign.md) [Cookiebot Alternatives for 2026](https://cookieaegis.com/blog/2026-11-02-cookiebot-alternatives-2026.md).

## Frequently asked questions

### What fields should a consent record contain?

A consent ID, the timestamp, the purposes consented to as separate values, the banner and notice version shown, and the capture method. Add the withdrawal timestamp and propagation evidence when consent is withdrawn. Missing version data is the most common gap in records we see.

### How long should consent records be kept?

For as long as the consent is relied on for processing, plus the period your counsel sets for answering claims about it. Indefinite retention creates its own exposure. The schedule should be written, and deletions should be logged so the schedule itself can be evidenced.

### Is a dashboard consent rate enough proof?

No. A rate shows aggregate behaviour. Proof means producing one person's record: what they were shown, what they chose, and when. If your platform cannot export a single record on request, it is a reporting tool, not a consent record system.

### How should a Global Privacy Control signal be recorded?

Log the signal, the time it was received, and the action it triggered, the same as a banner choice. GPC is a withdrawal or opt out signal under laws like the CCPA as amended, and honouring it without recording it leaves the same evidence gap as an unlogged banner click.