What a Useful Consent Record Contains, and What It Omits
A consent record earns its keep on one bad day: the complaint, the audit, the customer review, the moment someone with authority asks you to show, not say, that a specific person agreed to a specific thing. Most records fail that day not because they are missing, but because they are vague in the exact places the question is precise. A timestamp with no banner version. A yes with no categories. A user ID that no longer joins to anything since the analytics platform rotated it. Building the record is a design job: deciding, in advance, what the bad day's questions will be, and storing the answers while they are still cheap to capture.
Under the GDPR the controller must be able to demonstrate consent, and the standard elements follow from that duty: who consented, when, what they were told, what they agreed to, and how they agreed. Everything below is those five, translated into fields.
The five fields that carry the record
Identity: an identifier that survives, a consent ID stored with the record itself plus whatever pseudonymous key links it to the visitor, kept under your own retention rules rather than a vendor's. Time: the timestamp of the decision and of every later change, because consent is a history, not a state, and the withdrawal record matters as much as the grant. Disclosure: the version of the banner and policy text shown, stored as a reference you can still resolve in three years, which means archiving the texts themselves, not a version number pointing at a page that has since been edited. Scope: the categories and purposes agreed to, individually, in the vocabulary the visitor saw. Mechanism: how the agreement was given, button, toggle state, settings save, so a claimed misclick or a pre-ticked box can be checked against the flow as it actually ran.
Omit nothing from that list because it looks redundant today. The disclosure field is the one most often skipped, and it is the one that turns a record from an assertion into evidence.
What to leave out
A consent record is not a behavioural log, and stuffing it with browsing history, full user agent archaeology, and location detail creates a privacy problem inside the privacy evidence. Store the minimum that proves the decision, protect it like the personal data it is, and set its retention from the legal need: consent records generally live as long as the processing they authorise, plus the period in which a claim could be brought, and then they should be deleted on a schedule, not discovered in a migration five platforms from now.
Access deserves the same care. A record everyone in the company can browse is a record that will eventually be browsed for the wrong reason. Restrict it to the people who answer audits, log access if the tooling allows, and keep exports deliberate, because an exported spreadsheet of consent records in a shared drive is a breach report waiting for a date.
Test the record before the bad day
Pick one consent, your own, given today in a private window. Then play the auditor: find the record, resolve every field, open the exact banner text that was shown, and confirm the stored categories match the choices you made, including the one you changed. Time how long it takes. If the exercise needs a developer, a vendor ticket, or a shrug at any field, the record is a promise, not evidence, and now is the cheapest moment that fact will ever be available to you.
Related reading: WordPress Consent on Donation Forms: Trackers Fire Before the Gift, WordPress Consent for Appointment Booking Plugins, WordPress Consent for Webinar and Event Registrations.
Frequently asked questions
What must a consent record include?
Who consented, when, what they were told, what they agreed to, and how they agreed: an identifier, timestamps including later changes, the archived banner and policy text version, the individual categories, and the mechanism used.
How long should consent records be kept?
Generally for as long as the processing they authorise continues, plus the period in which a related claim could be brought. After that, delete them on a defined schedule rather than keeping them indefinitely.
Why store the banner text version with the record?
Because consent is judged against what the visitor was actually told. A version number is useless if the text it points to has been edited since; archive the texts so the disclosure can be produced years later.
Should a consent record include browsing history?
No. It should hold the minimum needed to prove the decision. Extra behavioural detail creates a privacy risk inside the evidence store itself and widens access and retention problems.