Keeping a consent log is only half the job. The log itself contains personal data, timestamps, identifiers, and choices, so it needs its own retention rule. Keep it too briefly and you cannot prove past compliance. Keep it forever and the proof becomes its own privacy problem.
A consent log proves what a visitor was shown and what they chose. Sites need a retention rule that keeps proof long enough to matter without hoarding personal data forever. This guide walks through the practical details, the common mistakes, and the checks that help you get it right the first time.
Where consent setups break in real life
Most consent failures are not banner design problems. They are loading order problems: tools that fire before a choice, tags added later without consent checks, and embeds or features that were never connected to the consent record at all. The banner works, and everything behind it ignores it.
A reliable setup inventories every tool that sets cookies or collects identifiers, assigns each one a category and a lawful basis, and blocks collection until the required choice exists. That inventory drifts constantly, which is why consent is an operating practice, not a one time installation.
What visitors should experience
The visitor experience should be short and honest: a clear choice presented once, no preselected toggles for non essential tools, an equally easy way to decline, and a permanent settings page where the choice can be changed without hunting. Friction that only applies to declining is a dark pattern, whatever the banner looks like.
After the choice, the site should behave as promised. Accepting enables the agreed tools once. Declining leaves the site fully usable with essential functions only. Anything else teaches visitors that their choice was decorative, which is both a legal and a trust problem.
Keeping the record and the practice aligned
Keep a consent record that shows what was presented, what was chosen, and when, and keep the tools on the site aligned with that record through regular audits. After any change to the tag manager, the marketing stack, or the site itself, repeat the clean browser test: load, decline, accept, and verify behavior each time.
Assign an owner. Consent setups decay when nobody is responsible for them, because every other team adds tools for its own reasons. One named owner with a checklist for new tools is the difference between a setup that stays true and one that quietly stops meaning anything.
Related reading
These earlier guides go deeper on connected questions: Moving a WordPress Site Without Losing Your Consent Settings Site migrations and host moves routinely drop consent configuration: banner settings stored in one plugin's database tables, custom blocking rules, and region settings that never make the trip. A migration checklist for consent continuity., WordPress Advertising Pixels and Consent: Retargeting Tags That Fire Too Early Advertising pixels from social and search platforms are usually pasted into headers or added by marketing plugins, where they fire for every visitor before consent. Connecting pixels to consent state on a WordPress site, step by practical step., and WordPress WooCommerce Stores and Cookie Consent: What Fires Before the Checkout Even Starts A WooCommerce store is a plugin stack with a shop attached. Payment, shipping, reviews, and marketing plugins each bring cookies and third party calls, and several fire on the first page view, long before checkout consent is considered..
Frequently asked questions
What happens if a visitor declines all cookies?
The site should still work. Essential functions such as security, load balancing, and remembering the consent choice itself can continue, but analytics, advertising, and personalization tools should stay off until the visitor chooses otherwise.
How often should a consent setup be audited?
After every change to the site's tools, tag manager, or banner, and on a scheduled basis besides, typically quarterly for active sites. Setups drift as teams add tools, so a pass from last year describes a site that may no longer exist.
Is a cookie banner the same as consent management?
No. The banner is the visible surface. Consent management includes the tool inventory, blocking behavior, the stored record, the settings page, and the audits that keep them aligned. A pretty banner over unmanaged tags is not consent management.
Where should visitors be able to change their choice?
A clearly labeled link, usually in the footer and the privacy page, leading to the same choices the banner offered. If changing a choice is harder than making it was, the setup is steering visitors, intentionally or not.