Written for Cookie Rocks 2.11.2, checked on 7 November 2026.
What this screen is for. The Proof of consent screen comes with Cookie Rocks Pro: it keeps a record of each visitor’s choice, so that you can show who consented to what, and when, if a data protection authority asks.
Cookie Rocks Audit has no Proofs screen. It checks whether the cookie banner you already use keeps such a record, and tells you what the laws of your countries ask.
What to do here
With the Audit alone:
- Open the Consent screen and read the row Record of the choices.
- Open the Obligations screen and read the point Proving consent: it says what your countries ask.
- If your banner keeps no record, look for that option in its settings, or in your account with its publisher.
With Cookie Rocks Pro, on the Proofs screen:
- Keep Keep a trace of each choice (recommended), and choose its proof retention under Keep them for.
- Click Save Changes.
- If you want a copy outside your site, choose a destination under Backup copy, then click Save the destination.
- If an authority or a visitor asks, find the choice under Find a choice, or download the register under Export.
Four durations, not one. Choice duration: a visitor’s choice lasts the number of months set on the Consent screen. After that, the banner asks again. Refusal duration: how long a refusal is kept before the banner may ask again. If you target them, a refusal lasts at least 6 months for France and 12 months for California, among others, when that is longer than the choice: the banner does not ask again before that. For Colorado, a refusal is renewed at each visit: the banner never asks again by itself. Without Rules by country, the longest of these durations applies to every visitor. Proof retention: each choice is kept as proof for the months you set here, then deleted automatically. It is kept at least as long as the choice or the refusal lasts, plus 12 months, or longer when a country you target requires it (for example 24 months for California and Colorado): a shorter setting is raised to that floor. Opt-out records: refusals sent by the browser (Global Privacy Control) and opt-out requests are kept for at least 24 months, as California and Colorado require. When several durations apply to the same record, the longest one applies.
For example, a choice that lasts 13 months is kept as proof for at least 25 months. A refusal sent by the browser is kept for at least 24 months. For a refusal given with a 13-month choice, the record is kept 25 months: the longest duration applies. The Proofs screen shows these durations with the values of your site.
What the Audit checks
On the Consent screen, under Your cookie banner, the row Record of the choices shows:
- Kept on your site: your banner records each choice in your site’s database. When Cookie Rocks can read how long, the row says so, for example “Kept on your site, 12 months”.
- None on your site: “If an authority asks, you cannot show who consented to what, and when.”
The row appears when Cookie Rocks can read this setting on your site, or knows how the free version of your banner works.
On the Obligations screen, the point Proving consent is done when your banner records each choice on your site, to do when it keeps none, and to check when Cookie Rocks cannot tell. It adds what your countries ask, and its legal source, such as the GDPR, article 7. When some of your countries ask instead for a record of visitors’ requests about their data, it names them and sends you to their sheets on the Laws screen. Country by country: Proof of consent: what to keep, and for how long.
If the Overview shows nothing to fix about proofs, that is expected: its points about proofs are under Good to know. When Proving consent is to do, it counts in the Overview point “… points of what the law asks of your site are still to do”, with See my obligations. Some banners keep the choices on their publisher’s servers, depending on your plan: check in your account that they are kept, and for how long.
Every setting of the Proofs screen (Pro)
The screen opens with Proof of consent and, in short, what your countries ask about it: which ones require or recommend a proof, and how long to keep it. When some of your countries ask for something else, such as a record of visitors’ requests about their data, open What each of your jurisdictions asks to read it country by country. Then comes what Cookie Rocks keeps for each choice.
| Setting | Choices | Default | Effect |
|---|---|---|---|
| Proof of consent | Keep a trace of each choice (recommended), Keep no trace | Keep a trace | One small request when the visitor chooses, never on other pages. |
| Keep them for | 6, 12, 24, 36 or 60 months. Durations under the floor of your site are greyed out. | 24 months, raised to the floor of your site | Older proofs are erased each day. The setting never goes under the floor: the longer of the choice duration and the refusal duration, plus 12 months, or the opt-out records duration of a country you target if it is longer. The text under the setting gives the floor of your site and its reason. When the same visitor chooses again, the previous choice is kept with the new one. |
Under the settings, the four durations of your site are listed: Choice duration, Refusal duration (only when a country you target sets one), Proof retention and Opt-out records (only when a country you target sets one).
The refusals that browsers send without a click are recorded only if you tick Also record the refusals sent by browsers, without a click on the Consent screen. They are kept at least 24 months.
Without a valid key, these settings keep their value and are locked. The register keeps recording the choices.
What a proof contains
- An identifier drawn at random. Visitors see the identifier of their choice in the details panel, and can give it to you.
- The date and time, in UTC.
- The choice: Accept all, Reject all, Own choice, One service allowed (one tool allowed from a blocked video or map) or Refused by the browser (GPC).
- The categories accepted, and the tools allowed one by one.
- The consent version, the version of the texts the visitor read, and their language.
- Whether the browser sent the Global Privacy Control signal.
- With Rules by country on: the rules shown (Strict, or Opt-out). When the visitor’s country led to the opt-out rules, the country and how it was found are kept too.
- When the choice ends, so the banner asks again.
A proof never contains an IP address, a name or an e-mail address. The identifier is still an online identifier: treat these records as personal data. The IP address is used only in hashed form, to limit each address to 30 proofs every 10 minutes, and is never stored. The whole site accepts up to 600 proofs a minute. When proofs are refused by this limit, the Proofs screen says how many, and when.
Reading and exporting the register
- Backup copy: see below.
- The last 30 days: the number of choices recorded, and the share of each kind of choice.
- Find a choice: type the Identifier given by the visitor, then click Search. The list is then titled Choices with this identifier.
- Latest choices: the last 10 choices, with Show more up to 200, with Date, Identifier, Choice, Accepted and Texts read, plus Rules shown when Rules by country is on. A choice that accepted nothing shows Necessary only.
- Versions of the texts: what visitors read, kept for each version of the banner texts, with its date and language. Each choice names the version it was made on.
If you see “No choice with this identifier. Proofs older than the chosen period are erased.”, the choice is older than Keep them for, or the identifier is mistyped. Before the first choice, the list says “No choice recorded yet.” Before the banner is first shown, Versions of the texts says “No version kept yet: the first one is kept when the banner is shown.”
Under Export, choose the dates under From and to, then click Download the proofs (zip). The zip holds:
proofs.csv: one line per choice, in UTF-8.versions.json: the texts each version of the banner showed.- One
banner-….htmlfile per version: a copy of the banner to open in a browser. Its buttons record nothing. manifest.json: the period, the number of proofs, the durations applied, the SHA-256 fingerprint of each file and the fingerprint of the previous export. Anyone can check the files without access to your site.README.txt: what each file contains, and how to check it.
If your server lacks the zip extension of PHP, the button is Download the spreadsheet (CSV) and gives the CSV file alone. The CSV has these columns:
date_utc, consent_id, action, categories, services, revision, text_version, locale, gpc, profile, country, source, choice_expires_utc, purge_after_utcchoice_expires_utc is when the banner asks again. purge_after_utc is the earliest date the proof is deleted: later if the same visitor chose again.
For an agency dashboard, the same data comes from the REST API, with an application password of an administrator:
GET https://example.com/wp-json/cookie-rocks/v1/proofs?from=2026-10-01&to=2026-10-31The parameters are from, to, consent, limit (1000 by default) and offset. See PHP filters, actions and REST API.
Backup copy
Every day or every week, the new proofs leave as a package, with the same files as the export, for a storage of yours. The files go from your site to your account: they pass through no other server. The proofs stay in the register of your site.
| Setting | Choices | Default | Effect |
|---|---|---|---|
| Send the proofs to | Nowhere (you download them from this page when you need them), Dropbox, WebDAV (Nextcloud, kDrive, Synology, ownCloud…), Webhook (your own tools, Make, n8n, Zapier), E-mail | Nowhere | Where the packages go. |
| How often | Every day, Every week | Every day | Each package takes the proofs recorded since the previous one, and names the manifest of the previous one. |
| Copies (Dropbox and WebDAV) | Delete the packages older than the retention of the proofs in the destination too | Ticked | The deletion announced in your policy then applies to the copies as well. Unticked, the copies stay as long as you keep them. |
- Dropbox: click Get a code from Dropbox, allow Cookie Rocks to write in its own folder, then paste the code and save. The packages go into
Apps/Cookie Rocks/, in a folder named after your site, one dated folder each. - WebDAV: give the WebDAV address of a folder (https only), a User and a Password. Use an application password rather than the password of the account.
- Webhook: give the Webhook address (https only). Each package is announced by a POST in JSON, with the manifest and a download address valid 24 hours. Each notice is signed with a secret shown once after you save: HMAC SHA-256 of the body, in the header
X-Cookie-Rocks-Signature. Tick Create a new secret (the current one stops working) to replace it. - E-mail: the package comes as a zip attachment, up to 10 MB. Beyond, the message says to download it from the Proofs screen. E-mail is the least protected destination: prefer Dropbox or WebDAV.
Below the form, a status says Incomplete, Waiting (the first package leaves within the hour), On (with the last run and the packages sent) or Error. Send now sends a package at once. When a destination is set, the Obligations screen adds the point Proofs copied to …: name that storage in your privacy policy, and See the text to copy gives a sentence for it. Step by step: Keep a copy of your proofs outside your site.
When you delete a plugin
The register belongs to Cookie Rocks Pro. Deleting Cookie Rocks Pro from WordPress erases the register and the archived texts. Export the register first if you need it.
Next step: Prove consent if an authority asks.