All regions
How to prove consent: what to record and how long to keep it
Every privacy regime puts the burden of proof on you. What a consent record should contain, what it should not, how long each region expects you to keep it, and how Macaw handles it.
Last reviewed
What the law requires
Why a banner is not enough
A choice kept only in the visitor's browser can be cleared, edited or lost, and you hold no copy. The GDPR (Art. 7(1)) and India's DPDP Act (s.6(10)) both put the burden of proving consent on you, and California requires records of consumer requests. You need your own record of each decision.
What a consent record should contain
- A stable, pseudonymous identifier for the person or device.
- Every category shown and the choice for each, including refusals.
- The exact notice wording the person saw.
- How they decided (accept all, reject all or a custom choice) and when.
- Enough context to show where it happened, without building a profile.
What it should not contain
Full IP addresses, full user agents, raw user IDs, names, email addresses, device fingerprints, browsing history or URL query strings. None of these is needed to prove consent, and storing them creates a new privacy risk.
How long to keep records
- EU and UK: as long as you rely on the consent and can be asked to demonstrate it (accountability principle).
- India: processing logs for at least one year; registered consent managers keep records for seven years.
- California: records of consumer requests and responses for at least 24 months.
How to comply with Macaw
What Macaw stores for each decision
A random consent ID from the visitor's browser, your user ID as a keyed hash (never the raw ID), every category's choice, the method, the notice version, server and browser time, the page path without its query string, the IP with its last part removed, and the browser and OS family only.
Tamper evidence
Each visitor's records form a hash chain: every record includes a hash of the one before. If any stored decision is changed, the chain no longer verifies, and Consent Records shows it as broken.
Retention, handled for you
Choose 6 to 84 months under Compliance > Consent Records. A nightly job deletes the records of visitors whose last decision is older than that, and logs only how many were removed.
Erasure without losing proof
Erasing a person removes their consent ID and user ID from every record. The anonymous records remain as proof that consent was given and later erased, and they can no longer be found by the person's IDs.
Keep proof of every decision
Macaw stores each Reject all, Save choices and Accept all on its servers with every category's choice, the exact banner wording shown (as a notice version), the time, the page path and a truncated IP. Records are hash-chained, so a changed record is detected. Find one person under Compliance > Consent Records, or export everything as CSV for an audit.
What Macaw does not do yet
- Consent records are kept in one region, where your Macaw instance is hosted; there is no per-region storage yet.
Sources
- EDPB: Cookie Banner Taskforce report (Jan 2023)
- Cal. Code Regs. tit. 11 §7101, Record-keeping (LII)
- Tsaaro: Consent managers under the DPDP Act and Rules
This guide summarises public regulator guidance and legal commentary to help you configure consent. It is not legal advice. Laws, deadlines and enforcement change; have your counsel confirm what applies to your business.