Consent Receipts: What a Good One Should Contain
Setting up a connected car takes about as long as pairing a phone. In those few taps, the owner agrees to collection that can include precise location history, voice recordings, driving behaviour, and contacts synced from a phone. The car then collects the same data on anyone who drives or rides in it, none of whom were in the showroom for the agreement.
This gap between who consents and who is recorded is now the central question in vehicle privacy. This guide explains what connected cars collect, where consent does and does not reach, and the practical steps owners, borrowers, and fleet managers can take today.
Parent consent for a school app should name the data collected, the vendors receiving it, and how long it is kept. A single tap at enrolment rarely covers new features added later, so schools should refresh consent when an app changes what it collects.
A good consent receipt names who collected the consent, what data and purposes it covers, when it was given, and how to withdraw, in a copy the person can keep. An email saying thanks for signing up is not a receipt, because it records none of the terms the person actually agreed to.
Why receipts matter at all
Consent disputes usually turn on evidence. A regulator, a customer, or a court will ask what the person was told and what they accepted, and a log line in a database answers that badly years later. A receipt given to the person at the moment of agreement fixes the same facts in two places at once, theirs and yours.
Receipts also change behaviour inside a company. Once a team knows every consent change generates a document customers keep, vague purpose wording and pre ticked extras become much harder to ship. The receipt acts as a quiet review step on the signup flow itself, before lawyers or regulators ever get involved.
The fields a real receipt needs
At minimum: the organisation collecting the data, the specific purposes agreed to, the categories of data, any third parties receiving it, the date and version of the notice shown, and a working withdrawal route. Where consent covers a child, a vehicle, or health related data, the receipt should say so plainly rather than hiding it in general terms.
Format matters less than durability. A downloadable record inside the account, plus an emailed copy, beats a screen that vanishes on the next click. The receipt needs an identifier the support team can match to internal logs, so a customer quoting it can be answered in minutes, not investigated for weeks.
Issuing receipts without annoying everyone
Receipts do not need a separate ceremony. Generate one whenever consent is first given and whenever it materially changes, such as a new purpose, a new data category, or a new recipient. Routine logins and unchanged settings should not trigger fresh paperwork, or people will stop reading the ones that matter.
Keep a receipt history in the privacy settings next to the toggles themselves. When withdrawing is as visible as the original agreement was, trust rises and complaints fall. Teams often find the support cost of receipts is negative: questions that once needed an investigation become a lookup the customer can do alone.
Keep reading: Consent for School Apps: What Parents Agree to and What Schools Should Check, Consent and Workplace Monitoring: What Employee Notices Must Actually Say, and Consent in Connected Cars: Location Data, Passengers, and Shared Vehicles cover the nearby cases in this series.
Frequently asked questions
Is a consent receipt a legal requirement?
In most places the strict duty is to keep records of consent, not to hand over a formal receipt. Receipts are still the cleanest way to meet that duty, because they prove the notice version and choices at the same time as giving the customer their own copy.
How is a receipt different from a privacy notice?
A notice describes practices in general and changes over time. A receipt is personal and fixed: it records what this person agreed to, on this date, under that version of the notice. The two work together, and a receipt should link to the exact notice version it refers to.
Should receipts be reissued when terms change?
Yes, when the change is material, such as a new purpose or a new recipient of the data. Minor wording fixes do not need one. A changed purpose usually needs fresh consent anyway, and the new receipt documents that new agreement.
What should a customer do with a consent receipt?
Keep it with other account records. If data is later used in a way the receipt does not cover, it is the strongest starting point for a complaint to the company or a regulator, because it shows the agreement as it stood when it was made.