Docs menu
Consent logs
CookieHug consent logs: what a consent record contains (and what it does not), panel view, CSV/NDJSON export, API and 90-day retention.
What a consent record is
Every visitor decision in the banner (acceptance, rejection, settings change, withdrawal) creates a consent record — evidence you can browse and export. Records are deliberately minimised: they let you demonstrate that consent was collected, but they do not identify a person.
What a record contains
| Field | Details |
|---|---|
| Event type | e.g. acceptance, rejection, change, withdrawal of consent |
| Consent categories | necessary / analytics / marketing / preferences |
| Region | e.g. "EEA", "PL" — from Cloudflare geolocation headers, not from the IP address on our side |
| Device type | desktop / mobile / tablet — from window width, not from the user agent |
| Consent method | how the decision was made (e.g. button, GPC) |
| Banner language and variant | exactly what the visitor saw |
| GPC/DNT signals | whether the browser sent Global Privacy Control / Do Not Track |
| Time to decision | from banner display to the choice |
| Timestamp | date and time of the event |
| Blocked services | count and list of services blocked before consent |
What a record does not contain
A record on the CookieHug side does not contain: the IP address (in any form), the user agent, a visitor identifier, or the address of the visited page. The identifier generated by the SDK stays exclusively in the visitor's browser.
Full data-flow description: How CookieHug processes consent data.
Viewing and export
You will find the records in the domain panel (consent analytics tab). Export is available as CSV and NDJSON, and programmatically via the Public API with a Bearer token.
Aggregate statistics (acceptance rates, GPC impact, region breakdown) are computed from the records and stay available in the panel indefinitely.
Retention
Raw consent records are kept for 90 days and then deleted automatically — export them earlier if you need a longer history. Statistical aggregates (with no personal data) are kept indefinitely. Deleting a domain or the account deletes the associated records.
Formal rules: Data retention and the DPA.