What a consent record actually has to prove

The burden of proof sits with you

Article 7(1) of the GDPR is one sentence long and it moves the entire burden onto you: where processing rests on consent, the controller must be able to demonstrate that the data subject consented. Not that a banner was displayed. Not that consent was probably given. Demonstrate, for that person, for that purpose. What follows is how we think about evidence rather than legal advice; your counsel decides what yours needs to contain.

In practice, demonstrate means an artifact you can produce months later, when nobody on the team remembers what the banner looked like in March. Regulators and claimants do not audit intentions. They audit records. If your log cannot answer this visitor, this purpose, this day, you do not have consent evidence. You have a screenshot of a design decision and a hopeful tone of voice.

The standard the record has to survive is prior opt-in. Under the GDPR and ePrivacy rules, nothing non-essential fires before the visitor opts in; reject must be as easy as accept, an equal-prominence expectation that comes from regulator guidance and EDPB opinion rather than the GDPR text itself; withdrawal must be as easy as giving. In the UK the pairing is UK GDPR and PECR, now diverging via the Data (Use and Access) Act 2025, which lifts PECR fines to UK GDPR levels.

An acceptance rate proves nothing

Most consent dashboards open with a single number. Say eighty-four percent accepted. It is a comfortable number, it moves in a direction you can report on, and it is worth almost nothing as evidence. An acceptance rate describes a population. Enforcement describes an individual: the complaint on someone's desk, from one person, about one afternoon in February.

The number is also self-reported by the system under suspicion. A rate cannot distinguish real consent from a banner that logged a dismissal as an accept, or from tags that fired before anyone clicked anything. A suspiciously healthy percentage is equally consistent with excellent design and a broken gate, and you cannot tell which from the percentage alone.

That is roughly the shape of the Todd Snyder penalty in 2025: $345,178, traced to a misconfigured banner rather than a policy anyone disagreed with. Aggregate metrics would have looked fine the entire time. Per-event records are what surface the visitor whose choice never registered, which is also the only view that lets you fix it before someone outside the building finds it.

The five fields a record needs

Who, what, when, which version, and where. Five answers and the record can stand on its own; four and it is an anecdote. Who does not mean a name. A pseudonymous identifier you can join back to a request when someone asks is usually the better choice, because a consent log should not quietly become a second pile of personal data.

What is the field most implementations flatten. Purposes need to be granular, and refusals stored as carefully as acceptances. For Google advertising and measurement features covering EEA and UK users, Consent Mode v2 has been required since March 2024 and carries four signals: ad_storage, analytics_storage, ad_user_data, and ad_personalization. A record that says accepted, without saying which of the four were set, cannot reconstruct what actually ran.

Which version and where are the fields teams discover only when they are missing. Banners get edited constantly: new copy, new categories, a moved button. Region matters because the rule being applied differs by it. Without both stamped on the event, you can prove someone clicked something, sometime, under a design you can no longer describe.

• Subject: pseudonymous ID, plus every purpose accepted and refused
• Moment: timestamp, the action taken, and the banner version that produced it
• Place: the region resolved at request time, and any GPC signal received

Records only count if they leave

A consent log you can view but not export is not evidence you control. Records need to leave the tool in a format a lawyer, an auditor, or a spreadsheet can open, which in 2026 still means CSV. UserGuard is designed so every consent event is tied to the site, the banner version, the region, and the timestamp, and exports as CSV. It is newly launched, and it is neither a Google-certified CMP nor IAB TCF validated; TCF sits on the roadmap.

What goes into the record matters as much as what comes out. UserGuard's scanner applies an evidence gate: something is recorded as a cookie only when there is a Set-Cookie header, an HTTP-only record, or a document.cookie value. Everything else is retained as labeled context. An inventory padded with guesses reads well right up until someone asks you to prove what fires before consent.

The same records answer American questions. CCPA and CPRA are an opt-out regime, not a consent-banner law: notice at collection, a Do Not Sell or Share My Personal Information mechanism, and mandatory honoring of Global Privacy Control. As of 2026, nineteen or more comprehensive state laws are in force, twelve requiring universal opt-out signals, with Indiana, Kentucky and Rhode Island among the recent additions. Which reach you is a question for counsel. Sephora's $1.2 million in 2022 and Healthline's $1.55 million in 2025 both turned on what happened after the signal arrived.

Consent logs make good design data

The useful accident of per-event logging is that it also produces product data. Reject rate by banner version. Reject rate by region, by landing page, by device. Withdrawal rate in the weeks after a change. Time between page load and decision. These are ordinary conversion metrics that happen to be legally load-bearing, which is a rare and pleasant combination.

Read them carefully, though. If a new banner version lifts acceptance twelve points and nobody can explain the mechanism, the mechanism is often that rejecting got harder to find, which is precisely the behavior the equal-prominence expectation exists to catch. Version-stamped records let you see the lift and its cause in the same query, before an outside party sees only the second half.

One more crossover. A banner a keyboard user cannot dismiss is hard to call freely given consent, and it fails WCAG 2.1 AA, the working benchmark and the one EN 301 549 leans on for the European Accessibility Act, which has applied since June 2025. No widget makes a site ADA compliant; the FTC's 2025 overlay-vendor order is the cautionary tale. UserGuard includes an accessibility widget with every site at $10 a month, volume discounts applied automatically, and never puts GPC or geo-targeting behind a tier.

Go deeper: consent analytics and CSV export