Consent decisions recorded with timestamp, consent version, and categories accepted

GDPR Art. 7(1) and Art. 5(2) (accountability) require that controllers be able to demonstrate that consent was validly obtained. A bare boolean in localStorage — accepted: true — is not evidence of anything: it records no timestamp, no consent version, no which categories were accepted, and is trivially forgeable or deleted. When a regulator or data subject challenges whether consent was given for a specific purpose at a specific time, you need a server-side audit trail tied to a versioned consent notice. Without it, you cannot meet the Art. 5(2) accountability obligation even if you collected consent in good faith.

Record structured consent decisions server-side for authenticated users, with timestamp, consent notice version, and per-category breakdown. Never store consent as a bare boolean.

// app/api/consent/route.ts
export async function POST(req: Request) {
  const { analyticsAccepted, marketingAccepted, consentVersion, anonymousId } = await req.json()
  const session = await getServerSession()
  await db.consentRecord.create({
    data: {
      userId: session?.user?.id ?? null,
      anonymousId: session ? null : (anonymousId ?? null),
      consentVersion,   // e.g. '2026-02-01' — tie to a versioned notice
      analyticsAccepted,
      marketingAccepted,
      userAgent: req.headers.get('user-agent'),
    }
  })
  return Response.json({ ok: true })
}

Append records — never overwrite. Include consentRecord in your DSAR export so users can see what they consented to and when. The consentVersion field is your proof-of-notice: it maps to the privacy policy version in effect at the moment of consent.