Each time a visitor makes or changes a choice in the banner, the consent log records the choice for each category, the date and time of the choice and the version of the banner they saw. Each choice is also stored with a consent ID.
What a consent record holds
- The choice for each cookie category (necessary, functional, analytics and marketing), whether an acceptance, a refusal or an opt-out.
- The date and time of the choice, stored in UTC.
- A consent ID.
- The banner version shown. This ties the record to the text and categories the visitor was presented with, so it shows what they were asked and not only what they answered.
The consent banner page shows an example of one choice: time (UTC) 2026-08-20 09:08:47, consent ID c_44e0d5b2, choice Partial, categories Analytics, banner version v4.2.
What it does not hold
A consent record does not contain the visitor’s name, email address, account details or IP address, and GrantCookie does not link it to any other data it holds. The banner does not ask for a name or an email address.
To show the banner and record a choice, the visitor’s browser sends technical data such as the IP address, the user agent string and the browser’s language setting. GrantCookie uses it while the request is handled and does not add it to the consent record. Server logs that contain it are kept only as long as needed and then deleted on a fixed schedule.
Because a record holds no name, email address or IP address, it usually cannot be found from those details alone. If a visitor makes a request about their record, you verify who they are and give GrantCookie the details that let it find the record. Where it can find the record, it exports or deletes it as you instruct.
Export and retention
Every plan includes the consent log, and you can export it on Growth and Scale. GrantCookie keeps consent records for as long as your account is open, unless you instruct it to delete them earlier, which you can do at any time by email to privacy@grantcookie.com. The end of a trial, a move to the Free plan and disconnecting a domain are not instructions to delete them.
For 30 days after your account closes, you can ask privacy@grantcookie.com for a copy of your consent records in a common machine-readable format, whatever plan you were on. Details are in the data processing agreement.
Records you import from another platform on a paid plan hold the fields in the file you send. See How do I move consent records from another platform?