Most platforms store consent as state: a contact is subscribed, or they are not. That is compact, and it fails the moment anyone asks a question that state cannot answer.
Consent evidence is the alternative: the interaction is recorded as an event at the time it happens, and retained. Current state is derived from the event history rather than replacing it.
What a defensible record contains
- What happened — requested, granted, confirmed, withdrawn, or migrated.
- The lawful basis relied on: consent, contract, legal obligation, or legitimate interest.
- What it applies to — the specific brand, contact, address, and subscription topic. Consent is specific; it is not a blanket permission for your whole company.
- The source — which form, preference centre, import, or API call.
- When it occurred, stored separately from when it was recorded.
- The evidence itself — structured proof of the interaction, ideally with a reference to the consent wording that was shown.
Why “occurred” and “recorded” are separate fields
This looks pedantic until you migrate platforms. The consent did not happen when you ran the import; it happened months earlier on someone else’s form. Collapsing the two timestamps produces a record claiming every contact opted in on the day you switched vendors — which is false, and visibly false to anyone reviewing it.
Keeping them apart lets you carry the original timing across and be accurate about when you learned it.
When you will need it
Rarely, and always inconveniently: a complaint that escalates, a client offboarding that asks you to prove the list is clean, a regulator’s enquiry, or a due-diligence process during an acquisition. Reconstructing it after the fact from form screenshots and export timestamps is expensive, slow, and unconvincing.
The test worth applying
Ask any platform — including this one — to produce the complete consent history for a single contact: every event, with basis, source, and timing. If it can only show you a current state, you do not have evidence. You have a claim.