Compliance overview
What CookieBeam records on your behalf, and which decisions remain yours to make and document.
CookieBeam is a tool you configure. It presents the choices you define, records what each visitor chose, and enforces those choices against the tags you have classified. It does not decide your legal basis, choose your categories, or write your privacy notice — and no consent tool can do those things for you.
This page sets out the division of responsibility. The rest of the section documents exactly what the product records, so you can show your own reviewers the mechanism rather than a marketing claim.
Division of responsibility
| CookieBeam does | You decide and document |
|---|---|
| Presents the banner in the mode configured for the visitor's region | Which regions you operate in, and which model applies |
| Records the visitor's category choices with a server-side timestamp | Which categories exist and what each one covers |
| Distinguishes an explicit choice from a machine-written default | Whether a default-granted model is lawful for your visitors |
| Blocks or allows scripts according to your classification | How every script and cookie in your inventory is classified |
| Detects a browser privacy signal where honoring is switched on, or where a US opt-out rule mandates it, and records that it shaped the outcome | Turning signal honoring on outside that mandate, and whether you treat the signal as binding |
| Stores consent records for your plan's window, and deletes them once it closes unless that window is set to unlimited | Whether that window meets your own obligations |
| Runs a request portal and tracks a deadline per request | Verifying the requester, deciding the outcome, and responding |
| Records administrative actions in an append-only audit trail | Reviewing that trail and retaining what you need beyond the window |
The pattern is consistent: CookieBeam produces evidence of what happened. Deciding what should happen, and defending it, stays with you and your counsel.
What is stored, in one paragraph
Each consent record holds the four category decisions, an opaque consent ID generated in the visitor's browser, both the client-reported and server-side timestamps, the banner and team the record belongs to, the domain, a coarse country and region, the collection method, and whether a browser privacy signal shaped the result.
What is stored depends on which endpoint wrote the record, and the difference matters. Records written by the consent banner and by the preference centre set the IP address and user agent to null deliberately, and truncate and redact the referrer to the grouping level configured for the banner. Records written through the versioned /api/v1/consent/log endpoint store the resolved client IP address, a user agent, and the full sanitized referer. Both write to the same store, so a record's contents follow its ingestion path rather than a single product-wide rule. Consent records sets out both paths field by field.
If you only use the banner, your consent records carry no direct identifiers, and a record identifies a browser through a pseudonymous ID rather than a named person. If anything in your integration posts to the versioned endpoint, that is no longer true for the records it writes, and your own records of processing should say so.
What the records are, and are not
- They are a contemporaneous, server-timestamped log of what the banner recorded, retrievable per banner and exportable.
- They can be issued as a signed receipt whose signature you can verify independently against published keys.
- They are not an assertion that your banner was correctly configured, that your categories were accurate, or that a particular legal standard was met. Those depend on decisions the product cannot see.
See Consent records for the exact field list and the receipt mechanism.
Where to go next
- Consent records — the stored record, collection methods, and signed receipts.
- Retention — how long records live and what deletion does.
- Data subject requests — the request portal, identity checks, and deadlines.
- Audit trail — which administrative actions are recorded and who can read them.
- Regional frameworks — the per-region defaults CookieBeam ships, and privacy signals.
Not legal advice. The defaults CookieBeam ships are starting points chosen to be reasonable, not determinations about your obligations. Have your counsel review your configuration before you rely on it.