Everyone knows they should record consent. Far fewer have checked what their records would look like to someone who does not already believe them. That gap only becomes visible under complaint, which is the worst moment to find it.
What a usable record contains
- Who — the phone number in canonical international format, plus your internal identifier.
- When — a UTC timestamp, to the second.
- What they saw — the exact wording displayed, not a description of it.
- How — checkout box, keyword message, click-to-chat, in-conversation, imported with provenance.
- Scope — transactional, marketing, or both, held separately.
- Where — the page URL, form identifier or campaign that collected it.
The wording field is the one people skip
"Consented: true" proves nothing. It does not show what was agreed to. Store the literal consent text as it appeared, and version it, so a record from March can be matched to March's wording rather than to today's.
Version your consent copy
Each time you change the wording on a checkout box or an opt-in page, give the new text a version identifier and store that identifier on every consent captured afterwards. Keep the full text of every version indefinitely. Without this you cannot reconstruct what a customer agreed to two years ago, and reconstruction is exactly what a complaint demands.
Make withdrawal equally evidenced
Record the opt-out with the same rigour: timestamp, the message or action that triggered it, the scope withdrawn, and confirmation that suppression applied. A common and damaging scenario is a business that honoured an opt-out but cannot prove it, and so cannot rebut a claim of continued messaging.
Imported contacts need provenance
If contacts arrive from another system, carry the original consent metadata across — not the import date. A record showing consent obtained on the day of the import is either wrong or evidence that no real consent exists. Where the original data genuinely does not exist, mark those contacts as unproven and re-permission them rather than quietly treating the import as consent.
Retention
Keep consent records for as long as you rely on that consent, plus a limitation period afterwards. Deleting the evidence the moment someone unsubscribes is a mistake — you may need to show that you had permission for messages already sent, and that you acted on the withdrawal.
That is a narrow, defensible retention of a small record, not a reason to keep the whole contact profile forever.
Test it like an auditor would
Pick three contacts at random. Without asking anyone, produce: when they consented, to what exactly, through what route, and what has been sent to them since. If that takes more than a few minutes, or requires someone's memory, your records are not yet doing their job.
Run that drill twice a year. It is the cheapest compliance work available, and it finds problems while they are still fixable.