The Consent Log Is the Product: What to Keep When a Choice Is Challenged
When a consent choice is challenged, nobody asks to see your banner. They ask for the record: who consented, when, to what version of which notice, with what settings, captured how. Sites that invested in banner design and treated the log as a database detail discover the imbalance at the worst moment, because the banner is the claim and the log is the evidence, and only one of them is ever examined.
Accountability is the principle doing the work here. Under the GDPR it is not enough to have obtained consent. The controller must be able to demonstrate it. Demonstration is a records problem, and records problems are solved in advance, in the schema, or not at all.
The fields that matter when it is questioned
Timestamp, in a consistent timezone, with the record immutable once written. The identifier the record attaches to, cookie ID, account ID, or both, with the link between them preserved when a visitor later logs in. The exact settings chosen, per purpose, not a single boolean that flattens a granular choice into accepted. The version of the notice and banner text shown, stored or reproducibly referenced, because the question is never just what they chose. It is what they were told at the time.
Add the mechanism: banner, settings page, or renewal flow, and the user agent or app version where relevant. None of this is exotic. It is the difference between a log that reads as a contemporaneous record and one that reads as a summary written later, and readers in disputes can tell the two apart at a glance.
Retention cuts both ways
Keep records too briefly and you cannot demonstrate consent for processing you are still doing. Keep everything forever and the log itself becomes a growing store of personal data with its own obligations. The working rule: retain consent records for as long as the processing they authorise continues, plus the limitation period that applies to claims in your markets, then delete or anonymise on a schedule you actually run.
Superseded records, the choices replaced by renewals or withdrawals, belong inside that retention, not in a trash folder. A withdrawal proves nothing without the record of what was withdrawn, and the pair together is the complete story a reviewer wants to see.
Withdrawal must write a record too
The most common log gap is at the end of the story. Consents are logged carefully, withdrawals land in a different system, a support ticket, an email preference centre, and the two never join up. Then the processing that should have stopped continues on the strength of a consent record that still reads as live, because nothing in the log says otherwise.
Test it end to end: make a choice, withdraw it through every channel you offer, and read the resulting record as a hostile reviewer would. If the withdrawal is not as visible, timestamped, and complete as the consent was, the log is a story with the last page missing, and that is the page the whole account turns on.
Related reading: Reject Button Parity: The Second Layer Is Where Consent Goes to Die, Consent Mode Signals: What Late Banner Firing Does to Your Data, How Long to Keep Consent Records, and What to Delete on Schedule.
Frequently asked questions
What should a consent log contain?
A timestamp, the identifier it attaches to, the settings chosen per purpose, the version of the notice shown, and the mechanism used to capture the choice. A single accepted boolean cannot demonstrate what was actually agreed.
How long should consent records be kept?
For as long as the processing they authorise continues, plus the applicable limitation period for claims, then deleted or anonymised on a real schedule. Indefinite retention creates its own data protection problem.
Why keep records of superseded choices?
Because a withdrawal or renewal only makes sense against what came before it. Together, the chain demonstrates what was in force at any moment. Deleting the earlier record breaks that proof.
What is the most common consent log failure?
Withdrawals recorded somewhere else, or nowhere, so the consent still reads as live and processing continues. Test withdrawal through every channel and confirm it writes a record as complete as the original consent.