Consent decisions recorded with timestamp, version, categories

GDPR Art. 7(1) places the burden of proof on the controller to demonstrate that consent was obtained. Art. 5(2) (accountability) reinforces this: the controller must be able to show, on request, that consent was lawful. A stored boolean 'true' fails this standard — it records that something was accepted, not when, under what banner version, or for which specific purposes. Recital 42 notes that consent should include the time of consent and information about what was consented to. Without a timestamped, structured record, the controller cannot demonstrate compliance to a DPA or defend against a subject access request.

Store a structured consent record that includes per-category decisions, timestamp, version, and the method of consent. This record supports both re-consent logic and regulatory accountability.

// src/lib/consent.ts
export type ConsentRecord = {
  necessary: true
  analytics: boolean
  marketing: boolean
  timestamp: string  // ISO 8601
  version: string
  method: 'accept_all' | 'reject_all' | 'custom'
}

// On Accept All:
saveConsent({ analytics: true, marketing: true }, 'accept_all')
// On Reject All:
saveConsent({ analytics: false, marketing: false }, 'reject_all')
// On custom save:
saveConsent({ analytics, marketing }, 'custom')

For authenticated users, send this record to your server (a consent_records table) so you can produce an audit trail across devices and sessions if a regulator requests it.