Consent Receipts: What They Are and What They Actually Prove
When you agree to something important offline, you get a copy: a signed form, a contract duplicate, a receipt. Online consent usually gives you nothing. The company keeps the only record, and if a dispute starts, you are asking the other side to check its own homework.
Consent receipts were proposed to fix that imbalance: a standard record, issued to the person at the moment of agreement, that they can keep and produce later. The idea has been around for years and is only partly adopted. This guide explains what a receipt contains, what it can and cannot prove, and where to get something similar today.
What a proper consent receipt contains
A useful receipt names the collector, the purposes agreed to in plain language, the date and time, the version of the notice shown, and the method of agreement, such as a checkbox, a signature, or a recorded call. It also states how to withdraw and where the full record can be requested. What it should not contain is the data itself; a receipt about marketing consent does not need your browsing history attached. Formats range from a downloadable PDF to a structured record in an account dashboard. The test is simple: could a stranger, reading only the receipt, reconstruct what was agreed and when? If not, it is a confirmation email, not a receipt.
What a receipt proves, and what it does not
A receipt proves the terms presented and the act of agreement. That matters in disputes about scope: whether you agreed to marketing emails or to data sharing with partners, for example. It does not, by itself, prove the consent was valid. If the choice was forced, bundled, or presented deceptively, a receipt documenting the click does not cure the design. Regulators look at both the record and the reality. For individuals, that means a receipt is evidence worth keeping, not a guarantee you will win an argument. For organisations, issuing receipts does not replace getting the consent flow right in the first place.
Where receipts exist today, under other names
Few services use the term consent receipt, but equivalents are spreading. Account dashboards that show your current privacy choices with dates, downloadable data copies that include consent history, and confirmation screens after you change a setting all do part of the job. Financial and health services tend to be furthest ahead because their regulators demand audit trails the customer can see. When a service offers a privacy dashboard, download or screenshot your choices after any big change, with the date visible. That homemade receipt is better than nothing, and in a complaint it shows both what you set and when you set it.
How to ask for a record when none is offered
You can request your consent history as part of a data access request in many jurisdictions. Ask specifically for the records of consent: timestamps, purposes, and notice versions, rather than a general copy of your data, which may arrive as a pile of unrelated files. Keep the response with the account documents. If a company cannot produce any consent record for processing that depends on consent, that gap itself is significant, and regulators take it seriously. For your own organisation, the lesson runs the other way: if you could not issue a receipt tomorrow from your existing logs, your consent records are probably thinner than you think.
Related reading
These earlier guides cover connected questions in more depth: Consent and Voice Assistants in Shared Homes: Who Agreed to What, Consent Records Retention: How Long to Keep Proof of Consent, and Consent in Weather Apps: Location Sharing That Goes Far Beyond the Forecast.
Frequently asked questions
Is a consent receipt the same as a confirmation email?
Not quite. A confirmation email says an action happened. A consent receipt records the substance of the agreement: purposes, notice version, timestamp, and how to withdraw, in a form the individual can keep and produce later.
Do companies have to give me a consent receipt?
Few laws require the receipt by that name, but many require companies to demonstrate consent and to answer access requests, which together get you most of the same information if you ask for consent records specifically.
Can a consent receipt help in a complaint?
Yes. It pins down what was agreed and when, which is often the disputed point. It does not settle whether the consent was freely given, so keep any screenshots of how the choice was presented too.
What should I check on a receipt I receive?
Check the purposes listed against what you remember agreeing to, confirm the date and the collector's identity, and note the withdrawal method. Flag anything broader than you expected while the agreement is recent.