Seven years ago: Where to store users consent (EU cookie law)
Now: A new GDPR approaches on the websphere....
So now with the GDPR coming in effect next month I'm faced with a cookie law question again.
Since cookies are now classified as personal data there is this consent requirement that is a bit stricter. And since the fines are higher also(4% of year sales), I want a check on what is correct.
My current hunch is:
Store the consent in a cookie, so the site knows what the do -> The functional aspect
Store the consent also serverside in a database -> The legal burden of proof aspect
But what bothers me and I can't find anywhere is:
Do I really need to store the consent also serverside? It does touch on the processing personal data requirement etc... which leads me to saying yes, but i'm not a lawyer nor an expert in the new cookie law.
What would be the wisest approach for handling these permissions?