Evidence
Manage consent records and retention
Keep useful evidence without collecting unnecessary identity data.
What to record
Store the pseudonymous visitor reference, time, selected purposes, applicable region and the notice/configuration version. Avoid names, emails or full IP addresses unless separately justified.
Example consent evidence sequence
A useful review follows a sequence: the visitor rejects optional purposes, later grants Analytics, then withdraws. Keep the time, pseudonymous reference, changed purposes and configuration context for each stored decision. Check which fields your export actually provides rather than assuming every suggested field is collected.
Separate the browser preference lifetime from evidence retention. A record can help explain an earlier choice, but it must not be used to restore a withdrawn permission. Agree who can export records, how they are protected and when expired evidence is removed.
When another team needs reviewable evidence, follow the consent evidence export procedure and document the scope of the export.
Define retention
Set a documented period based on accountability needs and limitation periods. Automatically delete or aggregate expired records and restrict export access by role.
Keep the retention decision separate from the lifetime of a browser preference. A short-lived consent cookie may need a fresh choice while the evidence record is retained for a separately documented accountability purpose.
Handle withdrawal
Append the new choice rather than rewriting history. Operational systems should receive the withdrawal immediately while the evidence log preserves the sequence of decisions.
A withdrawal should reach the same systems that received the original permission, including tag managers, marketing audiences and server-side destinations where applicable.