Do you need to keep a record of cookie consent? What to store, and what not to

“Can you prove this visitor agreed to cookies?” It is an uncomfortable question if you have no record at all. GDPR says the controller must be able to demonstrate that consent was given. At the same time, it asks you to collect as little personal data as possible. A consent record has to satisfy both. This is general information, not legal advice, so check your own situation with a qualified professional.

What proof of consent can look like

You do not need to know who the visitor is. You need to be able to show that a valid choice was made, and what it was. A minimal record has:

• When the choice was made (a timestamp)
• What was chosen (accept all, deny all or a list of categories)
• A random token that tells the same browser’s later changes apart, with no link to a person

It is also helpful to keep the version of your banner text and privacy policy that was shown, so you can show what the visitor was told.

What not to store

• IP addresses. They are personal data, so storing them creates a new thing to protect, explain and delete.
• User agents, device fingerprints or exact locations unless you have a clear reason.
• Names or emails for anonymous visitors. If someone is logged in, think carefully before linking the record to their account.

Rules of thumb

1. Make logging optional. Turn it on only if you decide you need it.
2. Set a retention period and delete older entries automatically. Write the period in your privacy policy.
3. Protect the log. Only administrators should see it, and exports should be deliberate.
4. Do not let the log become tracking. If it can follow a person across pages or visits, it is doing more than proving consent.
5. Test it. Make a choice in a private window and confirm that exactly one clean record appears, with nothing identifying inside.

With Consentaro

Consentaro has an optional Consent Log that is off by default. It keeps an anonymised record (time, the categories chosen and a random token, with no IP address or personal identifier), with a configurable retention period and CSV export. Rows already collected stay visible even after you switch logging off, and add-ons such as Consentaro Pro can read them through a documented filter. To keep the banner itself fair, see Do you need a cookie banner? A plain-English guide.