Whoever claims consent has to prove it
The GDPR reverses the burden of proof: the person concerned does not have to show they never agreed. The controller has to show that they did – years later and for the individual case.
Article 7(1) GDPR is a short sentence with large consequences: where processing rests on consent, the controller must be able to demonstrate that consent was given. Without that demonstration the processing stands without a basis – as though the consent had never existed.
What a defensible record contains
- Point in timeDate and time of the decision, in a traceable time zone.
- Content of the decisionWhich purposes were accepted and which refused – individually, not as an overall result.
- AttributionAn identifier by which the decision can be found again later – without a plaintext IP.
- The version that was shownTexts, list of purposes and design as they were then – or a version number behind which an unchanged state is kept.
Why the browser is not enough as a storage place
Many implementations store the decision solely on the device of the person concerned. For showing the banner that is enough – for the record it is not, for three reasons.
The entry lies outside the controller's reach: it cannot be produced in response to a complaint. It can be altered at any time, including by accident, and carries no protection against alteration. And it disappears when browser data is cleared, while the processing built on it continues.
How long to keep it
The Regulation names no fixed period. The standard follows from the purpose: the record is needed as long as the processing runs, and beyond that for as long as claims can be brought over it.
In practice that amounts to the duration of the consent plus the limitation period. If consent is withdrawn the processing ends – but the record of the earlier consent remains necessary, because it demonstrates that the past processing was lawful.
Two records before the same authority
The record has to establish the individual case. A statement about how the system was configured is a statement about the system, not about this one consent.