What is the single most important field in a consent record?

The notice version is the one most often missing and most often decisive. Without it, you can show a choice was recorded but not what wording, purposes, or vendors the choice referred to, which weakens the record badly in a dispute.

How long should consent records be retained?

Tie the period to the relationship length plus the applicable limitation period for claims in your markets, write it into a retention schedule, and apply deletion across every copy, including warehouse exports and backups, when the period ends.

Does a consent banner log prove tags behaved?

No. The log proves the choice as recorded. Proving behaviour needs a production check that tags fired or stayed silent according to that state. Keep evidence of both, and repeat the behaviour check after tag manager changes.

Should rejected consent be stored with the same care as accepted?

Yes. A recorded refusal, with timestamp and version, is what stops a team from re prompting aggressively or accidentally enabling a purpose later. It also demonstrates that refusal was honoured, which regulators treat as part of valid consent design.

Dismissed Is Not Answered: The Consent State Banners Forget

November 1, 2026

Shoppers close banners with an X, scroll past them, or let them time out. What state the banner records for each of those, and why treating dismissal as a decision breaks records.

Most banner data has three buckets that get reported as two. There are shoppers who accepted, shoppers who refused, and a large third group who did neither: they hit the close icon, pressed escape, navigated away, or ignored the banner until it gave up. What the consent platform records for that third group decides whether your records mean anything.

Dismissed is a user interface event. It is not a choice. A platform that logs dismissal as refusal is inventing refusals; one that logs it as acceptance is inventing consent, which is worse, and both exist in the wild, usually as a default setting nobody inspected after installation.

What the third state should be

Undecided, and treated accordingly: non-essential cookies stay off, because no consent exists, and the banner may ask again on a later visit, because no refusal exists either. That combination is the legally safe and logically honest position, and it annoys everyone a little, which is how you can tell it is right. Marketing loses the tracking it wanted. The shopper gets asked again eventually. The record, though, says exactly what happened: nothing was decided.

Check the actual settings rather than assuming them. Look at what your platform writes when the close control is used, when the banner times out if yours has a timeout, and when a shopper interacts with the page behind the banner, because some designs treat continued browsing as a signal. Implied consent by scrolling is not a position most privacy frameworks accept any longer, so if your banner is configured that way, it is carrying an old assumption into a new audit.

The close button question

Whether to offer a close icon at all is a design argument with a compliance edge. A banner that can only be answered, accept or refuse with equal prominence, produces cleaner records and fewer undecided shoppers. A banner with a close icon respects the shopper who is mid-task and will decide later, at the cost of a permanent undecided population. Either can be defended. What cannot be defended is a close icon that quietly records a refusal the shopper never made, or, the sharp end, an acceptance.

Also check parity. If the close icon is large and the refuse button is a grey text link in a second layer, the banner's design is steering while its records claim neutrality. Auditors read the interface as well as the database now, and dark pattern findings are made on exactly that comparison.

Report three numbers, not two

Consent rate reporting that shows accept and refuse summing to a hundred percent is hiding the undecided group inside one of them. Report all three, by month. The undecided share is diagnostic: a spike after a redesign usually means the banner became easier to dismiss than to answer, and a slow climb can mean banner fatigue on repeat visits, which is a prompt to reduce how often you ask, within the bounds of staying undecided rather than presuming an answer. Records that describe reality are the entire product of a consent program. Everything else is decoration.

Frequently asked questions

What consent state should closing a banner record?

Undecided. No consent exists, so non-essential cookies stay off, and no refusal exists, so the banner can ask again on a later visit. Recording dismissal as either acceptance or refusal invents a decision.

Is continued browsing after seeing a banner a form of consent?

Under most current privacy frameworks, no. Scrolling or using the site is not treated as a clear affirmative action. Banners configured to presume consent from browsing carry an outdated assumption.

Should a consent banner have a close button?

Either design can be defended if the records stay honest. A close option creates a permanent undecided group; removing it produces cleaner decisions. What matters is that dismissal is never recorded as a choice.

Why report the undecided share?

Because it exposes design problems the accept rate hides: banners easier to dismiss than answer, and fatigue among repeat visitors. Accept, refuse, and undecided should be three separate numbers.