What counts as proof of cookie consent?

Where processing relies on consent, Article 7(1) GDPR says the controller must be able to demonstrate that the person consented. The accountability principle in Article 5(2) makes the same point more broadly. For cookies, the ePrivacy Directive takes the GDPR’s idea of consent, so the burden of proof sits with the website operator, not the visitor or the authority.

The EDPB Guidelines 05/2020 on consent add two limits: you should not collect more data than you need to show consent, and you keep the proof only as long as the processing lasts, plus the time needed to answer claims.

Authorities do not prescribe a format, but a record that can stand up to a question usually shows:

• What was chosen: the categories accepted or refused.
• When: the date and time the choice was received.
• Under which text: the version of the banner and of the cookie policy the visitor saw.
• Where: the website, and ideally the page.
• Which visitor: a pseudonymous identifier that links the record to that browser without storing who the person is.
• Changes: later changes and withdrawals, kept as their own records.

Keeping each published version of the banner matters as much as the log. Without the text the visitor saw, a record of Accept says little about whether the consent was informed.

A consent log shows that a choice was reported for a browser identifier at a given time. It does not identify a person, and it does not prove that a human clicked. Proof of consent also does not cure a banner that was non-compliant in the first place: a record of consent obtained with a pre-ticked box is a record of invalid consent. See what makes a cookie banner compliant.

In Cookie Manager each visitor choice becomes a consent record holding the categories chosen, the date, the banner version and cookie policy it was made under, the website, a random consent ID, a truncated and hashed IP address, the browser family and the page path. It never holds cookie values. Every published version stays on record, records can be searched by consent ID or date and exported as CSV or PDF, and they are kept 3 years by default, adjustable per site from 1 to 10 years. The export states in plain words what a record proves and what it does not. See Cookie Manager.