Consent record / proof of consent
The audit trail proving who consented, when, how, for which purposes, under which wording, and when they withdrew.
What it is
A consent record is the evidence behind a claimed yes. GDPR Article 7(1) requires a controller to be able to demonstrate consent, so the record needs more than a boolean: who consented, when, how, for which specific purposes, what notice and interface they saw, and which version was live. It should also record withdrawal and the systems told to stop.
Create one for marketing subscriptions, optional cookies, research participation, and any other processing that actually relies on consent. An append-only event history makes changes legible: granted, narrowed, withdrawn, re-requested after a notice change. Keep the evidence only as long as needed to support the processing and related claims.
Gotcha: perfect logging cannot rescue invalid consent. A pre-ticked box, bundled purposes, vague copy, or a choice that was not freely given stays invalid even with a timestamp. The other failure is operational: the ledger says withdrawn while the email platform and ad pixels keep going.
Ask AI for it
Design an append-only PostgreSQL consent ledger that can prove consent under GDPR Article 7(1). Store a pseudonymous subject ID, purpose IDs, granted or withdrawn event, RFC 3339 timestamp, collection channel, UI action, locale, policy and interface version, and a SHA-256 digest of the exact notice text using Web Crypto crypto.subtle.digest. Include idempotency keys, an immutable event schema, current-state queries, retention and access controls, and webhooks that propagate withdrawal to each downstream processor. Return SQL migrations, example grant and withdraw events, and tests proving that a withdrawal stops every purpose it covers.