Consent is a claim, and claims need evidence. When a regulator or a customer asks how you obtained permission to track or to market, the banner they clicked is long gone. Your log is the only witness that remains.
Yet consent logging is often either absent or bloated, capturing everything a system can record, including data that creates its own privacy problem. A good log is deliberate: complete on the facts of consent, silent on everything else.
The fields that prove consent
The core record answers five questions. Who: an identifier such as an account ID or a pseudonymous record key. When: a timestamp from a reliable clock. What: the version of the notice and purposes shown. How: the interface and action, banner accept, settings save, checkout checkbox. Scope: the exact categories granted or refused.
Add change history. Consent is not a single event; people adjust toggles, withdraw, and return. A log that stores only the first click and overwrites the rest cannot describe the person's current state, which is the thing you are actually processing under.
What not to log
Full browsing histories attached to a consent record, precise location, and free text fields that invite accidental data collection all turn a compliance asset into a liability. The log exists to prove a permission, not to surveil the person who gave it.
Be equally careful with IP addresses. Some systems log them as identity evidence, but they are personal data with their own retention questions. If you keep them, document why, protect them, and set their expiry with the same care as the record itself.
Retention: as long as needed, then gone
A practical rule: keep consent records while the processing they authorise continues, and for a defined period afterwards that matches the limitation window for complaints and claims in your main markets. Indefinite retention just in case is not caution; regulators read it as its own violation.
Build the deletion into the system, not into someone's annual intentions. Automated expiry with a documented schedule survives staff changes. A folder someone meant to clean out does not, and auditors know the difference.
Making records retrievable
A log nobody can search is an archive, not evidence. You should be able to pull every record for a person, an identifier, or a date range in minutes, and export it in a form a regulator or the person themselves can read.
Test this in peacetime: find your own consent from a test visit, then find a withdrawal from three months ago. If either hunt takes a developer and a free afternoon, the retrieval process is the next fix on the list, ahead of any new banner design.
Related reading
These earlier guides go deeper on connected questions: Bottom Sheet Consent Banners on Mobile: What Works Mobile consent banners increasingly slide up as bottom sheets. When that pattern serves visitors well, when it blocks the site, and how to size and time it., Alternatives to Cookiebot Shopping for a consent platform beyond one well known name. The criteria that actually separate consent tools, and how to evaluate any alternative fairly., and Consent in Single Page Apps: Tracking That Starts Before the Banner Loads Single page apps load trackers with the bundle, often before any consent interface appears. Sequencing consent in an SPA takes deliberate architecture, not a script tag..
Frequently asked questions
Does a consent log need the exact text of the banner?
Store the version identifier and keep the corresponding notice text in a versioned archive. The log proves which version the person saw; the archive proves what that version said. Together they reconstruct the moment.
How do I log consent for anonymous visitors?
Use a pseudonymous identifier stored with the consent receipt itself, such as a consent cookie ID. You cannot name the person, but you can prove that the browser presenting that ID was shown a notice and chose as recorded.
Should withdrawals be logged the same way?
Yes, and they matter more. A withdrawal record with a timestamp is your evidence that processing stopped when it should. Log the withdrawal, propagate it to every system using the data, and log that propagation too.
Can consent records be exported for a subject access request?
They should be. The person is entitled to their data, and the consent record is part of it. If your team cannot produce one person's record without a developer and a weekend, the log is not finished yet.