Proof of Consent Beyond the Cookie Banner: Recording Consent From Forms, Preference Centres and Apps

When people talk about consent management, they usually mean the cookie banner. But a large share of the consents a business relies on are collected elsewhere: the newsletter checkbox at checkout, marketing channel preferences in account settings, a personalisation toggle in the app.

Proof of Consent Beyond the Cookie Banner: Recording Consent From Forms, Preference Centres and Apps

Under the GDPR (Article 7(1)) and similar laws, you have to be able to demonstrate each of these consents. When a customer asks "when did I agree to this?", the answer has to come from somewhere reliable.

The fragmentation problem

In most companies, consent records are spread across systems. The cookie banner has its own log. Newsletter consent is a field in the email service provider. SMS consent lives in the CRM. The app stores its settings in its own backend.

Each system usually keeps only the current value, not the history. When values disagree, or a customer disputes a choice, compliance teams end up reconstructing events from exports and support tickets. That makes data subject requests slower and complaints harder to answer.

One consent record across channels

UniConsent now records consents collected in your own interfaces in the same place as cookie banner choices.

You define the consents your business needs as custom purposes, either from scratch or from a template. Your forms, preference centre and apps then record each choice in the UniConsent Consent DB. Every record is timestamped and linked to your customer identifiers, and changes are added as new records rather than overwriting the old ones.

A choice made in a form is also reflected in the consent banner, so the customer sees the same status wherever they look.

Templates for common requirements

The dashboard includes templates for consents that regulations or industry rules require to be collected separately:

• Email open tracking, for tracking pixels in emails (guide)
• Marketing by channel: email, SMS, phone and post
• UK gambling direct marketing: the nine opt-ins required by UKGC SR code 5.1.12 (guide)
• Washington consumer health data: separate consents to collect and to share under the My Health My Data Act (checklist)
• Precise location and biometric data, sensitive data that US state laws require opt-in consent for
• Netherlands online gambling advertising opt-out

Privacy by design

Personal identifiers are minimised in the consent record. If you pass an email address, the SDK converts it to a SHA-256 hash before anything is stored, and the dashboard can still find the record when you type the address. Only the purposes you have defined are accepted, and setting the same value again doesn't create duplicate records.

For product managers

Map every place your product asks for consent: registration, checkout, preference centre, app onboarding, in-app settings. Each of these becomes a custom purpose recorded through UniConsent, so the consent model is documented in one place and the same purpose means the same thing on every surface.

For developers

On the web, record choices with __unicapi('setCustomConsent', ...) and identify the customer by pushing user IDs to _unicData. In the iOS, Android, Flutter and React Native SDKs (version 26.10.1 and later), use setUserIds and setCustomConsent, and read the current state with getCustomConsents() to drive feature flags or third-party SDKs. See the custom purposes documentation and the Consent DB guide.

For privacy and legal teams

The Consent DB gives you a searchable, timestamped history per customer across the banner and your own interfaces, which supports accountability under Article 5(2) GDPR, consent disputes and data subject access requests.

About UniConsent

UniConsent is a consent management platform (CMP) for websites and apps, supporting GDPR, the UK GDPR, IAB TCF, US state privacy laws and more. Get started for free.