Under the GDPR, consent youcannot prove did not happen.
ConsentCenter records what each person agreed to, when, and under which notice, so the record answers the question the regulation asks.
- 01 Ask
- 02 Prove
- 03 Respond
Click a provision to read what it says.
Most consent records are a cookie and a hope.
The burden of proof is on you.
Article 7 says the controller must be able to demonstrate consent. A first-party cookie with “accepted=true” says a browser clicked something once. It does not say what the person was shown or which version of the purposes they agreed to.
Where this goes wrong first.
Accept is a button, reject is a maze
Consent has to be freely given and unambiguous. A design that makes refusing harder than agreeing undermines both.
Purposes changed, consent did not
A new vendor or purpose was added last quarter. The stored choices still point at the old list, and nobody asked again.
Requests arrive by email and stall
Access and erasure requests have a deadline. When they land in a shared inbox, the clock runs while someone works out who owns them.
What changes for you.
Collect granular, opt-in consent before optional processing starts.
Keep a demonstrable record tied to the notice and purposes shown.
Run data subject requests against the deadline with clear ownership.
How it works
Ask
Present purposes granularly, with refusing as easy as agreeing.
Prove
Store each choice with the notice version, purposes and timestamp.
Respond
Verify, assign and fulfil rights requests inside the deadline.
How the banner should look.
A ConsentCenter banner set up for the GDPR. Click it: accept, reject or open the preferences.
Allowed to run: Strictly Necessary
What it is doing
- Optional cookies stay off until the visitor accepts.
- “Reject All” is on the first layer, as easy as “Accept All”.
- No optional category is pre-ticked in Preferences.
- A link stays on the page afterwards to change or withdraw consent.
What the text actually says.
- GDPR Article 4(11)
- Consent is a freely given, specific, informed and unambiguous indication of wishes, by a statement or clear affirmative action.
- GDPR Article 7(1)
- Where processing is based on consent, the controller must be able to demonstrate that the data subject consented.
- GDPR Article 7(3)
- The data subject may withdraw consent at any time, and withdrawing must be as easy as giving consent.
- GDPR Article 12(3)
- Requests from data subjects must be answered without undue delay and in any event within one month, extendable by two further months where necessary.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
Cookie Consent
Block optional trackers until consent and keep a record of the choice.
View productUniversal Consent & Preference Management
Carry consent and withdrawal across web, app and email systems.
View productDSAR & Privacy Rights
Track access, erasure and portability requests against the one-month deadline.
View product
Frequently asked questions
No. Article 6 lists six lawful bases, and consent is one of them. ConsentCenter handles the processing you base on consent; choosing the right basis for everything else is a decision for you and your counsel.
Both play a part. The ePrivacy Directive requires consent before non-essential storage or access on a device, and the GDPR defines what valid consent is. See the ePrivacy Directive page for that side.
No product can do that. ConsentCenter is designed to provide the consent collection, record and request workflow. Compliance depends on your processing as a whole.
Bring us your GDPR question.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.