The consent log
Under the GDPR you have to be able to show that a visitor agreed. The consent log is that proof. This page explains what it holds, what it leaves out, and how you use it.
What each entry holds
Every choice becomes one entry. A visitor who accepts, later changes their preferences and then withdraws leaves three entries with the same consent ID.
| Field | What it holds |
|---|---|
| Time | The date and time we received the choice. |
| Consent ID | A random ID that the visitor's browser made. The same ID is in their consent cookie. |
| Choice | Accepted all, rejected all, chose some, withdrawn, or a privacy signal from the browser. |
| Allowed | Whether preferences, statistics and marketing were allowed. |
| Banner version | The published version the visitor saw. It points to the exact texts of that version. |
| Consent version | The consent version of the site at that moment. |
| Page | The path of the page, without the query string. |
| Language | The language of the banner the visitor saw. |
| Country | The visitor's country, when we can tell it. |
| Browser | The user agent of the browser, cut off at 400 characters. |
| IP address | Shortened, so it no longer points to one connection. See below. |
What the log leaves out
The log holds no name, no email address and no full IP address. It does not hold the values of any cookies either. The key to an entry is the consent ID, and only the visitor's browser has it. So the log shows that a choice was made without becoming a list of people.
Cookiemark shortens every IP address before it is stored. For IPv4 the last of the four numbers becomes zero, so 203.0.113.87 is stored as 203.0.113.0. For IPv6 we keep the first three groups only.
How an entry is made
After a choice, the script sends it to Cookiemark. We accept it only when it comes from one of the domains of your site, or a subdomain of one. That stops another site from writing into your log. A message larger than 2 KB is refused, and so are bursts from one address.
The script does not send anything when a visitor outside your regions gets no banner, because they made no choice. The dashboard preview logs nothing either.
Reading the log
Open Consent log in the sidebar to see the choices on all your sites, or the Log tab of one site. Filter by period and by kind of choice. The search box finds a consent ID or a part of a page address.
What the visitor saw
Select a row to open the entry. Besides the fields above, it shows the title, text and buttons of the banner version the visitor saw, in their language. Every publish keeps its texts, so the entry still shows the old wording after you change it.
Looking up one visitor
A visitor who asks what they agreed to needs their consent ID. Show it to them on your cookie policy page with data-cookiemark-consent-id, as the JavaScript API describes. Paste the ID they quote into the search box, and you see every choice made with it.
The CSV export
Press Export CSV to download the entries of the period you selected, for one site or for all of them. The file has one row per choice. Its columns are the time, site, consent ID and choice, followed by the three categories. Then come the country, language, page, banner version, consent version, shortened IP address and browser.
Fields that start with a character a spreadsheet would treat as a formula get a quote mark in front. That keeps a hostile value from running in your spreadsheet.
How long we keep it
How long we keep the log depends on your plan. Free keeps it for 6 months and Solo for 12 months. Business and the Agency plans keep it for 24 months. After that, entries are deleted. Export the log first if you need older records.
When you archive a site, its banner stops but its log stays for the same period. When you delete your organisation, the whole log goes at once. Export it before you do that.
A paragraph for your privacy policy
Your visitors should be able to read that you keep this record. Adapt this text to your site and fill in the period of your plan.
When you make a choice in our cookie banner, we record it as proof of your consent. We store a random consent ID, your choice, the date and time, and the page you were on. We also store your browser, the language of the banner, your country and a shortened IP address.
We do not store your name or your full IP address. Our consent tool, Cookiemark, keeps this record for us on servers in the EU for [period]. Our cookie policy shows your consent ID, which you can quote when you ask us about your consent.