Proof of cookie consent: what Article 7 of the GDPR requires

A compliant banner is not enough: you must also be able to demonstrate, months later, that a given visitor did consent, on a given date, for given purposes. Article 7(1) of the GDPR is unambiguous: "the controller shall be able to demonstrate that the data subject has consented". The burden of proof lies with you, not with the visitor or with the CNIL (the French data protection authority).

What a consent record must contain

For a record to have evidential value, it must make it possible to reconstruct the exact context of the consent:

• When: a precise timestamp for each choice, including refusals and withdrawals;
• What: the detail of the choice, purpose by purpose: audience measurement accepted, advertising refused, and so on;
• How: the version of the banner displayed at that moment: texts, listed purposes, button layout. If your banner changes, you must be able to prove what the visitor saw, not what the site displays today;
• Who: an identifier that links the record to the device or account concerned, without over-identifying (see below).

Proving without over-collecting

The classic trap is to build, in order to prove consent, a file that itself violates the data minimization principle (Article 5(1)(c) of the GDPR). The record does not need the visitor's identity: a pseudonymous technical identifier is enough to establish proof. In particular, storing IP addresses in clear text in the consent log is bad practice; a hash or a truncated IP serves the same purpose without creating an additional file of personal data to protect.

How long to keep the proof

As long as the processing based on consent is active, and beyond that as long as a challenge is possible. In practice, publishers keep the log for anywhere from a few months to a few years depending on their exposure. This should be distinguished from the validity period of the choice itself: the CNIL recommends keeping the visitor's choice (consent or refusal) for about six months before possibly asking again.

Mistakes that strip the proof of its value

• No log. Consent is applied in real time but nothing is kept: it is impossible to demonstrate anything in an inspection.
• A log without the banner version. You prove that a click took place, not what was accepted or under what conditions.
• Refusals not logged. A refusal is a choice just like an acceptance; it must be kept so as not to ask the visitor again unduly.
• Unusable proof. A log buried in unstructured server logs does not allow you to answer a CNIL request within a reasonable time. You must be able to extract and transmit the records easily.

In practice with a CMP

This is typically a tooling job: a consent management platform (CMP) logs every choice automatically (timestamp, purposes, banner version, pseudonymous identifier) and lets you export everything in one click. At Consenteer, the consent log and its CSV export are included in all plans, the free one included, with retention from 90 days to 2 years depending on the plan; IP addresses are never stored in clear text.

This record complements the other requirements of a compliant banner, detailed in our guide Cookie banner: what the GDPR and the CNIL require.