Consent version tracking (policy version recorded)

GDPR Articles 13 and 14 require that consent be informed — the contact must know what they are agreeing to at the time they agree. If your privacy policy changes substantially and you cannot show that pre-existing consents were obtained under the old policy (not the new one), you cannot determine whether those consents remain valid for processing under the updated terms. CCPA §1798.100 similarly requires you to be able to characterize what data was collected and under what notice. A policy_version field is the mechanism that makes this determination possible; without it, every privacy policy update potentially invalidates your entire consent corpus.

Define a version constant and populate it on every consent creation path. Place the constant in a shared config file so a single change updates all collection points:

// src/lib/consent/constants.ts
export const CURRENT_POLICY_VERSION = '2025-01-15'
// Bump this string whenever the privacy policy changes materially

// src/lib/consent/create.ts
import { CURRENT_POLICY_VERSION } from './constants'

await db.consentRecord.create({
  data: {
    contactId,
    scope: 'marketing',
    granted: true,
    source: 'signup-form',
    policyVersion: CURRENT_POLICY_VERSION
  }
})

Search all consent-creation paths in src/ for any that do not import and use CURRENT_POLICY_VERSION, and add the field. Run a query against production to count rows where policy_version IS NULL — these represent consents of unknown vintage.