The Consent Record Is the Product: What a Regulator Actually Asks For
A company gets a letter from a regulator about consent. The first thing the team reaches for is a screenshot of the banner. The banner is the least useful thing in the file. What the regulator asks for is the record behind it: the exact choice the visitor made, the timestamp, the version of the banner they saw, and what the site did with their data afterward. A banner proves you asked. A record proves you listened.
The fines make the point in dollars. California settled with Disney for $2.75 million over how opt-out choices were presented and carried through, not over whether a tool existed. Honda paid $632,500 and Sling TV $530,000 in CPPA actions for the same class of failure: the choice was collected and then not honored downstream. In every one of those cases the company had a consent tool. The tool recorded the choice. The systems behind it did not respect it, and the record is what showed that.
What a complete record contains
Five fields, and a record missing any one of them is a gap a regulator can drive through. The visitor identifier as the site knew it at the time, which for most sites is a pseudonymous cookie ID rather than a name. The exact choice, per purpose, not a single accept or reject. The timestamp, precise to the second, because the question is always what happened before and after that moment. The banner and policy version the visitor saw, because a choice made against last year's wording is not consent to this year's tracking. And the downstream effect: which vendors received the signal and when they stopped, or did not.
Most consent platforms store the first four fields and stop. The fifth is where the exposure lives. A consent management platform that logs a rejection and never checks whether the analytics tag kept firing has built a receipt for a violation. The record has to cover enforcement, not just collection, and enforcement is a systems question: the tag manager, the server-side tags, the CRM sync, the ad platform audiences built from the data.
Retention is a decision, not a default
Records also need an end date. GDPR accountability means keeping proof for as long as it is needed to demonstrate compliance, and no longer. A consent log kept forever becomes its own liability, a database of identifiers with no retention policy. The defensible position is a stated window tied to the limitation period for the claims the record defends against, with deletion after it. The same logic applies to the raw logs behind the record: the network logs, the tag firing history, the vendor receipts. Keep them long enough to answer a letter, not long enough to become a breach notification.
The practical test is a drill. Pick a real visitor, a real rejection from last month, and reconstruct the hour after it: which requests fired, which vendors got data, which audience lists the person landed on. If the team cannot reconstruct it in an afternoon, the record is decoration. Regulators do not ask for the banner. They ask for the hour after the banner, and they read the answer in the logs.
Keep reading: Consent on the Checkout Page: The Tracking That Starts Before the Order Exists, The Chat Widget That Fingerprints Before Hello: Consent for Support Tools, and Consent on the Login Page: The Tracking That Starts Before the Visitor Is a Customer cover the nearby cases in this series.
Frequently asked questions
What exactly should a consent record contain?
The visitor identifier, the choice per purpose, the timestamp, the banner and policy version shown, and proof the choice was enforced downstream. A record missing the enforcement piece only proves you asked, not that you listened.
How long should we keep consent records?
Long enough to demonstrate compliance if a regulator asks, and no longer. Tie the window to the limitation period for the claims the record defends against, then delete. A log kept forever becomes its own liability.
Does a rejection need to reach our vendors, or just our own site?
It has to reach every system that acts on the data: the tag manager, server-side tags, the CRM, and the ad platforms. A rejection that stops at the banner is the failure pattern behind the recent CPPA fines.
We use a consent platform. Is that enough?
No. The platform collects and stores the choice. Enforcement is your tag manager, your server-side setup, and your vendor contracts. Test the hour after a real rejection and check what actually fired.