Privacy Insights That Matter

How to Prove GDPR Consent: Audit Evidence & Logging Requirements Explained (2026)

A user filed a complaint with their national data protection authority claiming they never consented to analytics tracking on your website. The authority sends a formal information request. You have 30 days to produce the consent record. You pull up your CMP dashboard and find that your logs from that period are incomplete — the system was approaching its monthly consent limit when the user visited, and recording had quietly degraded. The banner appeared. The user made a choice. Nothing was stored.