Yes to which text?

Article 7(1) GDPR is a short sentence: "Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." The burden of proof lies with the controller, as the European Data Protection Board also states in its Guidelines 05/2020 (para. 104). It is not for the person to show that they did not consent.

In most systems this evidence consists of two fields: a tick box and a timestamp. Newsletter yes, since 14 March. That proves a yes was stored at some point. It does not prove what for, to which wording, through which channel, and whether the person was told about their right to withdraw beforehand, as Article 7(3) requires.

What the Board means by evidence

The GDPR does not prescribe how the evidence must be kept. The guidelines are concrete all the same (para. 108): it must be demonstrable how consent was obtained, when, and which information the person received at that time. Online, the Board gives as an example the information on the session, documentation of the consent workflow at the time, and a copy of the information presented to the person. The next sentence is the important one: it would not be sufficient to merely refer to a correct configuration of the website.

At the same time, the evidence should not become a data collection of its own (para. 106). What is needed is enough to show the link to the processing, and no more. It applies as long as the processing lasts; afterwards only as long as it is needed for a legal obligation or for legal claims (para. 107).

The text changes, the tick box does not

Consent texts get revised. A purpose is added, a service provider changes, the legal department rephrases. The tick box in the database stays where it is, as if the person had agreed to the new wording.

The guidelines are clear on this (para. 110): if the processing changes or evolves considerably, the original consent is no longer valid, and new consent must be obtained. That presupposes knowing, for every single consent, which version of the text it refers to. Without that, you cannot tell whom to ask again. You can only ask everyone or no one.

How isidaten handles it

The Consent Management module treats the consent text as a document with versions. A template bundles the purposes, and each purpose is tied to a processing activity in the record. Approval creates an immutable version with a snapshot of the full wording and a checksum, optionally under the four-eyes principle. Every declaration points to exactly that version, and the choice per purpose is recorded, including refusals.

A person's evidence events are chained: each event carries a hash over its data and that of its predecessor. Anyone who later alters, deletes or inserts an event in the database breaks the chain, and verification shows where. Besides collection through a form, paper and oral declarations can be recorded with an evidence note; example 21 in the guidelines (para. 109) is exactly such a case.

When a template is approved as a substantial change, the module flags all existing consents to it as due for renewal. An editorial correction does not. With double opt-in, consent only comes into existence with the click on the confirmation link; if the template has been changed substantially in the meantime, the confirmation does not cover the new wording.

Consent can be withdrawn through the preference centre via link, by employees under "My consents", and from within a data subject request. The withdrawal points to the version under which consent was given, and the person responsible for the template is notified, because processing for that purpose has to stop. Conversely, the module shows processing activities that list consent as their legal basis in the record but have no active template. For website templates it cross-checks with the Cookie Scan whether every category requiring consent that the site actually sets has a purpose.

The test question

Take any address from your newsletter list. Can you produce the wording that person saw when they said yes?

If the answer is a screenshot of the current form, you have demonstrated the configuration, not the consent.

Sources

Regulation (EU) 2016/679 (GDPR), Article 7. EDPB, Guidelines 05/2020 on consent, paras. 104 to 111. DSK, Short Paper No. 20: Consent under the GDPR (German).