Consent Proof: The Record That Makes Your Banner Worth Something

When a regulator asks for proof of consent, a screenshot of the banner is not proof. Proof is a record: who consented, to what, when, and in what version of the banner. If your CMP cannot export that record, you cannot prove consent, and the consent is worthless in an investigation.

A screenshot is not proof

GDPR Article 7(1) puts the burden of proof on the controller. You have to be able to demonstrate that the data subject consented, and a screenshot of the banner is not a demonstration. It shows what the banner looked like, not who consented, to what, or when. Proof is a record, and the record has to contain the user identifier, the purposes and vendors consented to, the timestamp, the banner version, and the consent string that was in force at the time.

The banner version matters more than most teams think. Banners change: a purpose is added, a vendor is removed, the wording is updated. A consent given under one version is not necessarily valid under another, and a record that does not say which version was in force cannot prove what the user agreed to. The record has to be versioned, and the version has to be stored with the consent, not in a separate document that nobody can find.

The consent mode post explained how the consent state is modelled when a user refuses. The proof record is the other side of the same coin: the state has to be stored, and it has to be stored in a way that survives an investigation.

Changes have to be recorded too

When a user changes their mind, the CMP has to record the new choice and the old one, with timestamps for both. A record that only shows the latest choice cannot prove what the consent was at the time the data was processed, and that is the question a regulator asks. If the data was processed in March under a consent given in January and withdrawn in April, the record has to show all three events, in order.

The practical test is to export the record for a single user and read it. Can you see every consent event, with a timestamp and a banner version, in order? Can you see what the consent string was at each point? If the export is a single row with a current status, it is not a proof record, it is a status page, and it will not survive an investigation.

The TCF vendor list post showed how a list of a thousand vendors can hide a single wrong entry. A consent proof record is the same kind of problem: the record has to be complete, because the one event that is missing is the one the regulator will ask about.

Export it, store it, check it

Export the consent proof from your CMP, store it in a system you control, and check that the export is complete. A CMP that stores the record but cannot export it is a single point of failure: if you change CMP, the proof goes with it, and the consents you collected under the old CMP become unprovable. The export should be a regular job, not a one-off, and it should be tested by restoring a record for a single user and reading it end to end.

How long to keep the records is a judgement, not a rule. The GDPR sets no single retention period, but the practical rule is to keep the consent record for the life of the processing it authorises, plus the limitation period for enforcement in your jurisdiction. A consent record deleted while the data it authorised is still held is a record that cannot be proved, and a consent that cannot be proved is a consent that does not exist when it matters.

Frequently asked questions

Why do I need to keep a record of consent?

GDPR Article 7(1) puts the burden of proof on the controller: you have to be able to demonstrate that the data subject consented. A banner that collects consent but keeps no record of it fails that requirement, because there is nothing to show a regulator when they ask.

What should a consent record contain?

The user identifier, the purposes and vendors consented to, the timestamp, the banner version, and the consent string that was in force at the time. The banner version matters because the banner changes, and a consent given under one version is not necessarily valid under another.

Do I need to keep a history when a user changes their consent?

Yes. When a user changes their mind, the CMP has to record the new choice and the old one, with timestamps for both. A record that only shows the latest choice cannot prove what the consent was at the time the data was processed, and that is the question a regulator asks.

How long should I keep consent records?

As long as the data processed under that consent is kept, and longer if the regulator requires it. There is no single retention period in the GDPR, but the practical rule is to keep the consent record for the life of the processing it authorises, plus the limitation period for enforcement in your jurisdiction.

How do I export a consent proof record?

Export it from your CMP, store it in a system you control, and check that the export is complete. A CMP that stores the record but cannot export it is a single point of failure: if you change CMP, the proof goes with it.