# Consent Records: What a Regulator Asks for After the Complaint

Source: https://bannerbulwark.com/blog/2026-11-14-consent-records-what-regulator-asks.html

November 14, 2026

*A regulator asks for proof that a user consented. The team opens the consent platform, searches for the user, and finds a timestamp and a yes. The regulator asks which version of the banner the user saw, what purposes the yes covered, and whether the user later withdrew. The team has no answers, because the record was never designed to be questioned.*

## What a regulator asks for after the complaint

GDPR Article 7(1) is short and absolute: the controller shall be able to demonstrate that the data subject has consented to the processing of their personal data. Demonstrate is the operative word. A yes in a database is not a demonstration. A demonstration is a record that answers four questions: who consented, when, to what, and under which version of the banner and the policy. The EDPB guidelines on consent add the standard the record has to meet: freely given, specific, informed, and unambiguous. Each of those words is a question the record has to answer, and a timestamp alone answers none of them.

The complaint is usually not about the banner. It is about the record. The banner is the user interface. The record is the evidence, and the evidence is what the regulator reads. A [consent banner audit](2026-11-12-consent-banner-audit-7-checks-opt-in-rate.md) that checks the banner and never checks the record is auditing the wrong half of the system.

## What a defensible record contains

A timestamp, to the second, in UTC, so the record can be matched against the banner version that was live at that moment. The purposes consented to, each one named, not a blanket yes. The version of the banner and the privacy policy the user saw, because consent to version 4 is not consent to version 7. The consent string, for IAB TCF implementations, or the equivalent signal the platform stored. And the withdrawal record: when the user withdrew, through which mechanism, and whether the withdrawal was applied to every purpose and every tag. A record with all five is a demonstration. A record with one or two is a claim.

The versioning is the part most teams miss. The banner changes, the policy changes, the purposes change, and the record keeps saying yes without saying which yes. When the purposes change, the old consents do not automatically carry over. The user has to be asked again, and the record has to show the new consent, not the old one. A platform that cannot version its records cannot demonstrate consent for any user who consented before the last change.

## Where the records fall apart

Three places. First, the third-party tool that holds the records and cannot export them, or exports them in a format nobody can read. If producing a user's record means emailing a vendor and waiting a week, the record is not under your control. Second, the withdrawal that was never logged. The user withdrew through the preference center, the tags stopped firing, and nothing was written down, so the regulator sees a consent with no end date and asks why the data is still being processed. Third, the [modeling thresholds](2026-11-13-consent-modeling-thresholds.md) problem in reverse: a record that exists but cannot be tied to a specific user, because the identifier was a cookie that has since expired. The record is there. The person is not.

## The test: produce one record

Pick a random user, or a test account, and produce their full consent history in an hour: every consent, every withdrawal, every version they saw. If you can, the record works. If you cannot, the record is a claim, and the claim will be tested by someone who is not on your side. Run the test before the complaint arrives. After it arrives, the hour is gone.

## Frequently asked questions

### What does a consent record have to contain?

The timestamp, the purposes consented to, the version of the banner and the policy the user saw, and the consent string or signal that was stored. A record that says the user consented, without saying when, to what, and under which version, is a claim, not a record.

### Do I need to record consent withdrawal too?

Yes, and it has to be as complete as the record of giving consent. If a user withdraws, the record should show when, through which mechanism, and whether the withdrawal was applied to every purpose and every tag. A withdrawal with no record is a withdrawal that did not happen, as far as the regulator is concerned.

### What does the law actually require me to prove?

GDPR Article 7(1) requires the controller to be able to demonstrate that the data subject consented to the processing. The EDPB guidelines on consent add that the record should allow the controller to show the consent was freely given, specific, informed, and unambiguous. The record is the evidence.

### How fast should I be able to produce a consent record?

Within an hour, for a single user, from your own systems. If producing one user's consent history means emailing three vendors and waiting a week, the record is not under your control, and the regulator will treat it as not existing.