The consent log, receipts, and export

Every banner decision becomes a record you can inspect and export. Here is what each record contains, why those fields were chosen, and how long they stick around.

Why the log exists

Under GDPR Article 7(1), the burden of demonstrating consent sits with you, not the visitor. If someone asks whether a visitor consented, when, and to what, "our banner was live that month" is not an answer. A record of the specific decision is.

UserGuard writes that record automatically. Every decision a visitor makes in the banner (on any site, in any region) lands in the consent log. You do not configure logging or turn it on. If the banner ran, the record exists.

What each record contains

A consent record is only useful if it can stand on its own later. Each one carries:

The site the decision belongs to.
The exact banner version that was on screen.
The region the configuration resolved and the language actually rendered.
Whether a Global Privacy Control signal was present.
The per-category choice the visitor made.
A salted visitor hash — linkable across that visitor's own decisions, not re-identifiable as a person.
A truncated-then-hashed IP.
The page URL and a UTC timestamp.

The visitor hash deserves a note. It lets you show a coherent history. This visitor accepted in March, withdrew in June, without storing anything that identifies who the visitor is. The IP is truncated before it is hashed for the same reason: enough to support the record, not enough to rebuild the person.

A record that says "accepted" proves little if you cannot show what the visitor accepted. Published banner configurations in UserGuard are immutable: once a version is live, it never changes. Each consent record points at the exact version that was on screen, so the pairing proves what was shown (the wording, the categories, the choices offered) at the moment of the decision. Edit the banner later and old records still point at the old version. That is deliberate.

What counts as a decision

Not every recorded action is a click on Accept all. The log records each of these distinctly:

Accept all
Reject optional
Save preferences
Withdraw
GPC honored
Notice dismissed
Do-not-sell opt-outs

The distinctions matter because the events mean different things. A withdrawal is not a rejection. It ends consent that previously existed. A GPC signal is honored without any click at all, and the record says so. Collapsing these into one "opted out" bucket would hide exactly the detail a regulator would ask about.

The site's Consent tab shows two views of the same data, both scoped by one filter row at the top. Narrow the slice by range (7, 30, or 90 days, all time, or a custom date range), by choice, and by region — the aggregates and the receipts read the same filters, so they can never disagree about what is in the slice. The aggregates come first: accept and reject rates, daily volume, and breakdowns by choice and by region. Below them: Receipts, the whole filtered record as a paginated ledger, 25 to a page, newest first — the page number lives in the URL like every other part of the slice, so a filtered page is a linkable place. Open a row and you see the full record of that decision: banner version, region, language, signal, per-category choice, visitor hash, page, and time.

Exporting the log

The CSV export carries the slice as it stands on screen — the same range, choice, and region filters that scope the page scope the file, so leave the filters alone and you export the full window, narrow them and the file narrows with you. Each row carries a language column and a region column. Both are there because both change the meaning of a record: consent gathered from a banner rendered in Spanish under a GDPR-region configuration is a different fact than the same click in California. The export preserves that context per row, so the file stands alone when you hand it to counsel or a client.

Retention

Records are not kept forever, on purpose. Retention is configurable per account: 400 days by default, with choices of roughly 13, 24, or 36 months, and records older than the window are pruned nightly. Keeping consent records indefinitely is its own compliance problem: the log is there to demonstrate consent, not to become a permanent archive of visitor behavior. Pick the window that matches your obligations, export before it closes if you need a longer paper trail, and let the pruning do its job.