Seven years ago: Where to store users consent (EU cookie law)

Now: A new GDPR approaches on the websphere....
So now with the GDPR coming in effect next month I'm faced with a cookie law question again.

Since cookies are now classified as personal data there is this consent requirement that is a bit stricter. And since the fines are higher also(4% of year sales), I want a check on what is correct.

My current hunch is:

Store the consent in a cookie, so the site knows what the do -> The functional aspect
Store the consent also serverside in a database -> The legal burden of proof aspect

But what bothers me and I can't find anywhere is:

Do I really need to store the consent also serverside? It does touch on the processing personal data requirement etc... which leads me to saying yes, but i'm not a lawyer nor an expert in the new cookie law.

What would be the wisest approach for handling these permissions?

  • 1
    Should be noted as far as I know no company in existence has been fined or prosecuted for not having cookie consent or notify. GDPR is another gimmick which won't be enforced, not saying not too but don't expect a knock on your door either :) Apr 13, 2018 at 17:55
  • I'm fully aware of that. But in the netherlands up until now you'd get a written warning and time to comply. But now the warning phase is skipped and 4% of your sales can be fined, without warning, and the authority responsible has let it known that they'll actively enforce the rules(why the hell not, its a good cash cow for the govt) Apr 13, 2018 at 18:26
  • Given the trivial cost of coding and storing in a database, why not do it...
    – Steve
    Apr 13, 2018 at 22:38
  • At 25.000 visitors a day it adds up relatively quick. Apr 13, 2018 at 22:42
  • @Tschallacka I am curious what was your conclusion in the topic. I hope you asked a lawyer or the company asked one. As of the logging, it requires and append only database in that rate or a simpler solution is having a service which has an append only file and it just keeps adding records without closing the site until a certain amount.
    – inf3rno
    May 15 at 21:35

2 Answers 2


As with most things in law, if sued, the burden of proof is on both parties to state their case.

In the event that your website/company was ever brought to court over GDPR, you would have to assume that evidence has been gathered against you that shows your visitors were not giving consent. Thus, you want to be able to prove that they did.

If the government ever began questioning you over GDPR, showing them a record of consent may likely be enough for them to leave you alone. Whereas not providing recorded evidence could cause even more questions to be raised.

As a result, you should strongly consider storing all of the consent that users give you. If there is no record of consent, then it may be difficult for you to prove in a court of law that you abided by GDPR consent requirements.

The likelihood of ever getting put under pressure from GDPR law seems incredibly low. But you never know, especially with new political leaders taking office regularly.

Caveat: I'm not a lawyer and this is not law advice.


To be honest I am looking for an answer as well. Just to mention we are not talking about a sue here as Michael wrote, it is a data protection audit, which is done by the data protection authority of the actual country where kind user who reported the problem with your website lives. Ofc. you can convert it into a sue if you don't agree with their judgement, but most of the times you won't win, just pay even more. As of the burden of proof this is a special case, becasue it is solely on the data controller.

Some people claim that logging consents are necessary, but I haven't found anything in the ePrivacy Directive or the GDPR about it. As far as I can tell it might be necessary, but if so, then the current consent logs are hardly an evidence. Normally we have a paper and people write down their identification data and sign it. If we need something analogous, then a digital signature can be. But it would take a lot of extra data processing to have digitally signed consents and I read that if collecting the consents leads to this kind of extra data processing then we can avoid it. In my opinion another problem that companies collect these logs not because they can use it as proof during an audit, but because they want people to click on allow all and they make statistics out of it to analyze different banner solutions and increase consent count. In my opinion demonstrating that the site does not set certain cookies when there is no consent given should be enough. This is pretty easy, they don't even need to understand the code, just visit the site. But I was wrong, I found a document which claims that only logging is accepted as proof. https://ec.europa.eu/newsroom/article29/items/623051/en

For example, in an online context, a controller could retain information on the session in which consent was expressed, together with documentation of the consent workflow at the time of the session, and a copy of the information that was presented to the data subject at that time. It would not be sufficient to merely refer to a correct configuration of the respective website.

New contributor
inf3rno is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.