Privacy LitigationConsent Banners
Can Your Website Prove Consent? What Courts Expect from Consent Records
Consent is one of the main defenses to website tracking claims. Courts generally expect businesses that raise consent to prove it with records of what the banner displayed, what visitors chose, and what the website did afterward. Many consent platforms keep those records only for a limited time, and finding a specific visitor's choice usually requires an identifier stored in that visitor's browser.
By Alex Proctor
Published October 17, 2026
Summary
A consent record is the evidence that a consent platform keeps of what visitors were shown and what they chose. Courts have accepted consent defenses that were supported by copies of the banners and notices that visitors saw. Because records of anonymous visitors are tied to identifiers in their browsers, matching a record to a specific plaintiff may depend on evidence that the plaintiff holds. I recommend that businesses confirm what their consent platforms record, how long the records are kept, and whether earlier versions of their banners are preserved.
Who Has to Prove Consent?
Courts generally place the burden on the party that claims consent has been achieved. In 2003, a federal appeals court explained the reason in an early website tracking case under the federal Wiretap Act. It wrote that the party seeking the benefit of the exception "is more likely to have evidence pertinent to the issue of consent." That reasoning fits less neatly with consent banners, because the identifier that is generally needed to find an anonymous visitor's record is stored in the visitor's browser.
The standard for consent is also demanding. In 2024, another federal appeals court stated, in a case against Google, that the question is whether a reasonable person understood what would happen, so that their agreement shows "knowing authorization." It added that the disclosures have to "explicitly notify" users of the conduct at issue.
What Do Courts Look for in a Consent Defense?
Courts have looked closely at what visitors have seen and the actions they have taken on websites. Businesses have to show what the consent experience looked like when the plaintiffs visited, and that it was enough to count as consent.
In 2025, a federal judge in California dismissed tracking claims against a video game company on the basis of consent, at an early stage of the case. The court considered copies of the company's banner, cookie settings, privacy policy, and account creation screens, without objection from the plaintiffs. To buy games, visitors had to create an account and check a box accepting the privacy policy, which disclosed that partners set cookies. The court found that the company "has carried its burden in establishing consent," in a ruling that the plaintiffs have appealed.
A consent log entry matched to the plaintiff would likely be the strongest evidence of the consent experience, because it shows what that visitor chose, when, and on which version of the banner. Matching an entry to a plaintiff also raises the lookup problem described below. Consent that is tied to an account, as it was in the video game case, avoids that problem. However, even a complete record may not help if the banner was designed to steer visitors, because consent obtained that way might not count.
What Do Consent Platforms Record?
Consent platforms typically keep a log entry for each visitor choice. The contents vary by platform, although most platforms document a similar set of fields:
| Typical Record | What It Can Show |
|---|---|
| Random identifier | The key for looking up a specific endpoint's choice |
| IP address | Roughly where the visit came from |
| Date and time | When the choice was made |
| Banner or configuration version | What visitors were shown at the time |
| Choice for each category | What visitors accepted or declined |
Based on documentation published by several consent platforms, as of October 2026.
Several platforms delete log entries after about 12 months by default. CIPA does not set its own filing deadline, although defendants often argue that California's one-year limit for statutory penalties applies. Federal Wiretap Act claims can be filed up to two years after plaintiffs discover the tracking. Under either period, a claim can arrive close to the time that the record is deleted, or after it.
For anonymous visitors, the entries are usually tied to a random identifier that the consent platform stores in a cookie in the visitor's browser, rather than to a name or an email address. Looking up a specific visitor's choices typically requires that value. Depending on website visitor volume, details in the log, such as the time of the visit and the IP address, may narrow the search even without it.
Taken together, the operational challenge is that businesses generally bear the burden of proving consent, while the identifier that unlocks their records is typically stored in plaintiffs' browsers. It may be reasonable to ask plaintiffs to provide it. That can be difficult unless they saved a HAR file, which records the network traffic during a visit, or took detailed screenshots. Some demand letters and complaints include evidence of this kind, which can show the cookie value.
Do Regulations Require These Records?
Europe's GDPR states explicitly that businesses relying on consent "shall be able to demonstrate" that it was given. European regulators have added that it is not enough to point to a functioning configuration of the website.
U.S. rules are narrower. California's regulations require businesses to keep records of consumer requests, including opt-outs, and of how they responded, "for at least 24 months." Colorado has a similar requirement. Neither rule addresses banner consent directly, although the California rule relates to consent banner records indirectly.
When visitors use consent banners to opt out of the sale or sharing of their personal information, or send opt-out signals that the banners process, those choices are a form of opt-out request. A platform that deletes those entries after 12 months may fall short of the 24 months that California requires. Beyond opt-outs, the practical pressure to keep banner records in the U.S. comes mostly from litigation.
What Should Businesses Keep?
A defensible record generally includes more than the consent log:
- Consent logs, kept for a period that is chosen deliberately
- Dated copies of each version of the banner and the privacy notice
- A history of changes to the consent platform and the tag manager
- Evidence that the website honored the choices that it recorded
A record of a choice does not show that the tracking tools responded to it. When a demand letter or complaint arrives, the consent logs and banner versions from the period that it describes should be preserved before routine deletion removes them. I recommend that businesses confirm what their consent platforms record, how long the records are kept, and whether entries can be matched to a visit, before a claim arrives.
Questions
Can the evidence in a demand letter help find a consent record?+
It can. HAR files and screenshots attached to demand letters or complaints sometimes show the consent cookie, including its identifier. Matching that value to the consent platform's log can show what the claimant chose and when, if the entry has not been deleted. Evidence of this kind should go to counsel first.
Do consent records conflict with data minimization?+
Generally not, if they are used only as records. California's regulations say that keeping request records, when the information is not used for any other purpose, does not by itself violate the law. The records still contain personal information, such as IP addresses and identifiers. They should be protected and kept only as long as the business has decided is necessary.
Does a consent record defeat a tracking claim by itself?+
Not by itself, although it supports the defense. Courts also examine whether the disclosures explicitly described the tracking and whether visitors took an affirmative action to agree. Timing matters as well, because consent given after tracking has started may not cover the earlier activity. The record also has to match what the website did.
Briefings are informational and do not constitute legal advice.
Not sure your banner works?
I'll check whether visitor choices are honored.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.