Proof of consent
Proof of consent is the record a website keeps to demonstrate that a visitor gave valid consent: when, to what, through which banner version, and in which language.Article 7(1) of the GDPR puts the burden of proof on the controller: where processing is based on consent, the controller shall be able to demonstrate that the data subject consented. Brazil's LGPD (Article 8) and South Africa's POPIA say the same. A cookie banner that collects consent but keeps no record leaves the site unable to answer an authority's first question.
A useful record stores, for each choice: a timestamp, the choice (accept all, reject all, custom, withdrawal), the categories accepted, the version of the banner and of the texts shown, the language, the country, a random visitor identifier that lets the record be matched to the browser's stored choice, and a pseudonymized trace such as a salted hash of the IP address. Storing the full IP address or an email is not necessary and creates its own data protection questions.
How long to keep it follows from why you keep it: as long as the consent is relied on, plus the limitation period for claims, which is the reasoning behind how long to keep consent records. Cookiequiet records every choice with these fields, keeps the log 30 days on the Free plan, 1 year on Starter and 5 years on Pro, and exports it as CSV on Starter and Pro. Daily counters of shown, accepted and rejected banners also give you the consent rate without touching individual records.