Consent log
A consent log is the server-side record of every cookie choice a website's visitors make, kept so the site can demonstrate that consent was given, to what, and when.The duty comes from Article 7(1) of the GDPR: where processing is based on consent, the controller must be able to demonstrate that the data subject consented. A banner that stores the choice only in the visitor's browser lets the site behave correctly but proves nothing afterwards, because that cookie lives on the visitor's device and can be deleted. The log is the copy the site keeps.
Each entry typically holds a timestamp, the action (accept all, reject all, custom selection, withdrawal), the categories accepted, the version of the banner and its texts, the language, and an identifier that links the entry to the choice stored in the browser. Keeping the full IP address or an email is rarely needed; a random visitor identifier and a pseudonymized trace are enough to match a record to a browser. The log is personal data itself, so it needs a retention period and its own line in the privacy policy.
How long to keep it depends on how long the consent is relied on and on the limitation period for claims, covered in how long to keep consent records. Cookiequiet records every choice with a daily-salted hash of the IP and keeps the log 30 days on Free, 1 year on Starter and 5 years on Pro, with CSV export on Starter and Pro (see pricing).