How to prove you collected valid consent if audited
Under GDPR you do not just have to get consent, you have to be able to demonstrate it. If a regulator or a customer asks how you obtained someone's consent, "we have a banner" is not an answer. Here is what actually counts.
What a defensible record includes
- Who consented (a user or device identifier, as far as is proportionate).
- When, with a timestamp.
- What they were shown, the exact banner version and wording.
- What they agreed to, which categories, and that it was a clear affirmative action.
- How to withdraw, and a record of withdrawals.
Where most setups fall short
A lot of banners collect a choice and store it in a cookie, but keep no auditable log, and if the choice is not even remembered, there is nothing to show at all. A homemade banner almost never logs this properly.
How to fix it
Use a consent platform that keeps a consent log, or implement one server-side, and make sure the banner genuinely records and retains each choice. This is not legal advice, but it is what demonstrable consent looks like, and it is part of a full consent and tracking audit.
Want us to check your tracking in 10 seconds?
Pop in your domain and we will show you what is firing, what is not, and where data is leaking. Free, no signup.
Check my tracking freeGet a plain-English audit
We check your live GA4, Google Tag Manager and consent setup by hand and tell you exactly what is wrong. The audit comes off any build.
See how it works & pricingDatahound are analytics and ad-tracking specialists. We fix broken GA4, Google Tag Manager and server-side tracking so every sale, form and call gets counted. Back to datahound.agency · All tracking guides · Is your cookie banner compliant?