GDPR Consent Proof requirements — check your consent records free

Four consent records, fifteen findings, and not one of them provable — that is what a Berlin retailer's own consent log returned the first time it was read as evidence instead of as a table.

The team had done the visible part right. The banner rendered, reject-all sat next to accept-all, nothing fired before the click. What nobody had read was the row the code wrote afterwards. GDPR Article 7(1) is blunt about which of the two matters: "the controller shall be able to demonstrate that the data subject has consented." A banner that renders is not a demonstration. The stored record is.

Most consent logs are a user id, a timestamp and a boolean. That is also, almost exactly, what an AI assistant produces when you ask it to store the consent — and it is the shape that passes code review, because as a database row there is nothing wrong with it. It fails as evidence, for four separate reasons, and a complaint surfaces all four at once.

It cannot say which wording the person read. Without a hash of the exact text, a later rewrite quietly inherits the old version label. It cannot say whether anything was already switched on before the person acted — Recital 32 rules out pre-ticked boxes and silence, so a record that does not distinguish granted-by-default from granted-by-click is not recording consent at all. It cannot say how the person could take it back, which Article 7(3) requires to be as easy as giving. And it usually has no end date, so a consent given in 2024 is still being relied on today, against Article 5(1)(e) and against the six-to-thirteen-month refresh window supervisory authorities work to.

Consent Proof Record Lint reads that file directly. The VS Code extension carries 14 rules, each tied to a named source: Articles 4(11), 5(1)(e), 6(1)(a), 7(1), 7(3) and 13(1)(a), Recital 32, EDPB guidelines 05/2020, and IAB TCF v2.2 for the case where a tc_string is stored without the cmp_id that produced it. Open the JSON, run one command, and every finding lands in the Problems panel on the line of the record that caused it.

The numbers in the first sentence are reproducible. Two fixtures ship inside the extension. _fixtures/clean.json holds three well-formed records and returns 0 findings. _fixtures/dirty.json holds four records from a homegrown logger and returns 15 findings — 10 errors and 5 warnings — and trips all 14 rules between them. Run both before you point the linter at anything of your own.

Free cookie scanners do not cover this. A scanner loads the page and reports which trackers fire before consent; that is the front of the house. Article 7(1) asks about the back, and no scanner opens the log you stored.

The clock is the part teams underestimate. Article 12(3) gives one month to answer a data subject's request, and Article 83(5) puts consent breaches in the top fine tier — up to 20 million euro or 4% of worldwide annual turnover. A GDPR consultant reviewing a consent log bills 150 to 250 dollars an hour,.

Checking the file you have open is free and complete: all 14 rules, every finding on its line, running entirely on your machine with no network call and no telemetry — which matters, because the file being linted is a log of other people's decisions. A free web page runs the same engine with nothing installed. When the audit is not one file but the whole log, the full version runs every consent-record file in the workspace in one pass and writes a dated evidence report you keep and hand to the auditor.