Consent & cookie banner
Maintain consent purposes, configure the banner, export the evidence.
A consent is legally worth only as much as you can prove – Art. 7(1) GDPR explicitly places the burden of proof on the controller. The module therefore keeps two things separate: the purposes that can be consented to, and the receipts recording who consented to what and when.
At a glance
- Included from
- Professional
- Where in the app
- Data protection → Consent
- Output
- A purpose list, a configured banner and consent receipts as CSV
- Legal basis
- Art. 7 GDPR, § 25 TTDSG
- API
- /api/v1/dsgvo-consent
A consent purpose
| Field | Meaning |
|---|---|
| Purpose and category | What is being consented to and which banner category it falls into – necessary, functional, statistics, marketing. |
| Legal basis | Not everything in a banner is consent. Technically necessary processing runs on a different basis – record that here rather than presenting it as a checkbox. |
| Bilingual labels | Name and description per language. The banner shows visitors the matching version instead of a German label on an English page. |
| Processor and cookie name | Who processes the data, and under which cookie name. A visitor must be able to learn both before agreeing. |
| Retention | How long the data is kept, in days. |
| Active | Only active purposes appear in the banner. Deactivating rather than deleting preserves the traceability of old receipts. |
Banner settings
- Intro text per language – the first sentence a visitor reads.
- Link to the privacy policy. If none is set, the one from your branding settings is used.
- The purpose list itself – the banner shows exactly the active purposes, not a separately maintained copy.
- The public retrieval of the banner configuration is reachable without authentication, so a widget on your website can load it.
What a receipt contains – and what it deliberately does not
A consent receipt records: a visitor identifier, the categories consented to, the timestamp, and – in reduced form – technical context. The IP address is not stored in clear text but as a hash. That is enough to show in a dispute that consent was given, without building an additional personal profile just to keep the evidence.
That is precisely the point: proving consent must not generate more data than the processing that was consented to.
Exporting the receipts
Receipts can be downloaded as UTF-8 CSV – optionally limited to a time range, up to 10,000 rows, newest first. The file name carries the export date. For day-to-day review the paged list in the application is more convenient; you need the export when an authority or a court asks.
Withdrawal must be as easy as consent
Art. 7(3) GDPR requires withdrawal to be as easy as giving consent. A banner with an "accept all" button but no equivalent route to withdraw is therefore vulnerable – regardless of how cleanly the receipts are kept.