Consent Log & Export
Every time a visitor interacts with your banner, ConsentLayer writes an immutable record of what they decided. This is your audit trail — the evidence that consent was collected, what was accepted or rejected, and under which signals. There's nothing to wire up: the log is populated automatically by the banner.
Consent records are treated as immutable audit data. Deleting a site is refused while any records exist — they age out on their own via retention (see below).
What's recorded
Each record captures the decision and the context around it:
| Field | Description |
|---|---|
createdAt | When the decision was made (ISO 8601) |
visitorId | Anonymous visitor identifier |
ipCountry | Country inferred from IP (ISO 3166-1 alpha-2, e.g. DE) |
ipAnonymized | Truncated IP (IPv4 /24, IPv6 /48) — never the full address |
userAgent | Visitor's browser user-agent string |
jurisdiction | Ruleset that applied: gdpr, ccpa, or none |
consentVersion | Version of the banner configuration the visitor saw |
bannerTemplate | Banner style shown (e.g. floating, bar, modal) |
gpcSignal | Whether the browser sent a Global Privacy Control signal |
doNotSell | Whether the visitor opted out of sale/sharing |
categoriesConsented | Per-category accept/reject map |
decisions | Structured per-category and per-service breakdown |
The overall decision is also classified into one bucket — accepted (all categories on), rejected (only required on), or partial (a mix) — for filtering and reporting.
Viewing and filtering
In the dashboard, open Site → Consent Log. You can filter records by:
- Date range — from / to.
- Country — two-letter code.
- Decision — accepted, rejected, or partial.
- Banner version — the
consentVersiona visitor saw.
Open any record to see the full per-category and per-service breakdown.
CSV export
Click Download CSV on the Consent Log page to export the records matching your current filters. The export streams — large sites can pull their entire history without timing out. Columns, in order:
id, created_at, visitor_id, ip_country, ip_anonymized, user_agent,
jurisdiction, consent_version, banner_template, gpc_signal,
do_not_sell, decision, categories_consented, decisionscategories_consented and decisions are serialized as JSON within their
cells, so the full structured decision survives the round-trip into a
spreadsheet.
Retention & storage
Records are stored in ConsentLayer's database and kept for your plan's retention window, then purged automatically by a daily cleanup job. Defaults are 30 days on Free and one year or more on paid plans. Retention is enforced at the organization level across all your sites.
Programmatic access
For server-side compliance reporting across all visitors, use the
Consent Records API —
GET /sites/{id}/consent-records returns paginated records with the same date
filtering. To read the current visitor's state in the browser instead, use
the SDK's getConsentState().