Consent Records
Every consent decision is recorded. That ledger is what you produce when somebody asks whether you had permission.
Where to find it
Architect Panel → Security:
- Cookie Consent — categories, services, cookies, scans and records
What a record holds
A consent identifier, the visitor, the signed-in user where there is one, the action taken, which categories were chosen, the policy version in force, the jurisdiction and country, the address and browser, the page and referrer, the language, where the decision came from, when it was made and when it expires.
The sensitive parts are filled in server-side
Time, address, browser and jurisdiction are recorded by the endpoint rather than accepted from the page, and the submitted values are constrained.
That matters: a consent record a visitor’s browser could dictate would be worthless as evidence. Recording it server-side is what makes it a record rather than a claim.
The policy version is the important field
Consent is to a specific version of what you told people. When your privacy notice or cookie usage changes materially, the version changes and previous consent no longer covers the new position.
Without it, you cannot say what somebody actually agreed to — only that they agreed to something, once.
Consent expires
Each record carries an expiry, and re-asking periodically is expected practice. Consent given three years ago and never revisited is weak.
Twelve months is a common period; longer needs a reason.
It is the evidence, so keep it
The whole purpose of the ledger is to answer a question later. Retain records for as long as you might need to demonstrate the consent — which is longer than the consent itself is valid.
It is also personal data
Addresses, browsers and pages visited. Restrict who can read it, do not use it for anything other than demonstrating consent, and include it in your own retention thinking.
Withdrawals are records too
A withdrawal is recorded like any other action, which is what lets you show when somebody changed their mind and that you acted on it.
Check it works before you need it
Give consent as a visitor, withdraw it, and confirm both appear with the right categories and the right policy version. The moment you need this data is not the moment to discover it was not being written.
Worked example
An organisation records consent against a policy version it increments whenever its notice changes materially, with a twelve-month expiry. When a complaint arrived, it produced the specific record, its categories and the version of the notice in force that day.
Recommendations
- Increment the policy version on material changes.
- Expire consent and re-ask, around twelve months.
- Restrict the ledger — it is personal data.
- Test a consent and a withdrawal before launch.