Prove consent if an authority asks: Cookie Rocks documentation

Written for Cookie Rocks 2.11.0, checked on 6 November 2026. The current version is 2.11.2: some details may have changed.

This guide is for site owners who want to be ready if a data protection authority, or a visitor, asks who consented to what, and when.

You need: Cookie Rocks Audit (free) to check whether your current banner keeps a record. Cookie Rocks Pro for a register of proofs on your own site, which you can search and export.

The Proofs page of Cookie Rocks Pro, with the latest choices and the export — Cookie Rocks 2.11.2 · Click to enlarge

Check your current banner

Open Cookie Rocks, then Consent. Under Your cookie banner, read the row Record of the choices.
Kept on your site means your banner records each choice in your database. None on your site means you cannot show who consented to what, and when.
Open Obligations and read the point Proving consent. It says what your countries ask, and the proof retention when a text sets one.
If no record is kept, look in the settings of your cookie plugin for a record or log of consents, and turn it on. Some plugins keep it on their own servers, depending on your plan: check how long in your account.

With Cookie Rocks Pro

Cookie Rocks Pro records each choice in your site’s database: an identifier drawn at random, the date, what was accepted, the version of the texts the visitor read and their language. Never an IP address or anything that identifies the visitor.

Open Proof of consent. Check that Proof of consent is set to Keep a trace of each choice (recommended). It is the default.
Choose Keep them for: 6, 12, 24, 36 or 60 months (24 by default). This is the proof retention: each proof is kept at least as long as the choice or the refusal lasts, plus 12 months, or longer when a country you target requires it (for example 24 months for California and Colorado). Shorter durations are greyed out. Older proofs are erased each day. Click Save Changes.
When someone asks about one visitor: the visitor finds “ID of your choice” in the details panel of the banner. Type it in Find a choice, under Identifier given by the visitor, then click Search.
When an authority asks about a period: under Export, choose the dates in From and to, then click Download the proofs (zip). The zip holds the proofs in a spreadsheet (CSV), the texts each version showed, a copy of the banner and a manifest with a fingerprint (SHA-256) of each file. If your server cannot make zip files, the button is Download the spreadsheet (CSV).
To show what visitors read, open Versions of the texts: each choice names the version it was made on.

Tip. With Cookie Rocks Pro, keep a copy of the proofs outside your site. On the Proof of consent page, under Backup copy, choose where to Send the proofs to: Dropbox, a WebDAV storage (Nextcloud, kDrive, Synology, ownCloud), a webhook signed with a secret, or an e-mail address. Then choose Every day or Every week and click Save the destination. The files go straight from your site to your storage. E-mail is the least protected choice: prefer Dropbox or WebDAV.

If you delete Cookie Rocks Pro… the register of proofs is erased with it. Download the proofs first, or check that a copy is in your storage.

More detail: Proof of consent. Country by country: Proof of consent: what to keep, and for how long.

Next step: Fix what the Overview shows

Cookie Rocks helps you find your way through cookie and privacy rules. It does not replace a lawyer’s advice.