The request usually arrives as a short email asking for evidence of consent for a sample of users, or for everyone in a date range. Teams then export whatever the consent platform makes easy, which is often a spreadsheet of timestamps and email addresses that proves far less than it appears to.
Auditors are not collecting files. They are testing whether your records can reconstruct what a specific person saw, chose, and later changed. Building exports around that question turns a stressful request into a routine one.
The fields that prove a story
Each record needs the identity it belongs to, the exact notice and policy version shown, the categories presented, the action taken, the timestamp with timezone, and the interface and banner version that collected it. Without the notice version, a timestamp proves a click, not consent to anything in particular.
Withdrawals and changes need the same completeness as the original grant. Auditors frequently trace one person through grant, change, and withdrawal. A break in that chain is the finding, even when the underlying behavior was correct.
Format for humans under deadline
Provide a readable summary per sampled person alongside the raw data: their current consent state, how it got there, and the evidence for each step. Auditors work faster with a narrative backed by data than with data alone, and speed matters when response windows are short.
Keep field definitions in the export package. Column names that make sense to your engineers, like flag values and internal codes, need a data dictionary or the auditor will spend the response window asking what things mean.
Consistency with the live experience
Expect the auditor to compare records against the banner as it exists now and as it existed then. Banner version history, including wording and choice changes with dates, is part of consent evidence, not design trivia.
This is where teams get caught: records are complete, but nobody can show what the banner said on the date in question. Versioning your notices and banners, and keeping retired versions, closes that gap permanently.
Rehearse before the request arrives
Run an internal export drill twice a year. Pick random users, produce the full evidence pack, and time how long it takes. If the drill takes heroics, the real request will too, and drills are when you fix the gaps calmly.
The drill also tests retention honestly. Records that were supposed to be kept but were purged by a generic data policy surface in rehearsal, not in front of a regulator.
Related reading
These earlier guides go deeper on connected questions: Consent at the Till: QR Codes, In-Store Wi-Fi, and Offline Data Collection Physical stores collect data through Wi-Fi, QR offers, and loyalty signups that bypass website consent habits. How offline collection should ask, record, and honor choices., Auditing Your Own Consent Banner for Dark Patterns Dark patterns in consent banners are often accidents of design systems and deadlines, not intent. An audit method for finding them in your own banner before a regulator or a journalist does., and Consent Receipts: What to Store, How Long to Keep Them, and Why When a regulator or a plaintiff asks you to prove consent, 'the banner was live' is not evidence. A consent receipt is the record that answers: who, when, what version of the notice, and which choices. Retention is the hard part..
Frequently asked questions
What is the single most important field in a consent record?
The version of the notice the person consented to. Without it, you cannot show what was agreed, only that something was clicked. Timestamps, identity, action, and interface complete the picture around it.
How long should consent records be kept?
Generally for as long as you rely on the consent, plus the period during which it could be challenged under local law. Many organizations keep them for the life of the relationship and a defined margin after. Get local legal advice for exact periods.
Should withdrawals be exported too?
Yes, always. A consent history without withdrawals and changes looks curated and fails the basic test of reconstructing a person's story. Complete history, including the awkward parts, is what credibility looks like.
What format do auditors prefer?
Structured data such as CSV with a data dictionary, plus a readable per person summary for sampled individuals. The exact format matters less than completeness, definitions, and the ability to trace one person end to end.