Skip to content
allanninal.dev/build
Collaborate

Part 5 of 7 · Consent preference keeper series ~5 min read

How consent evidence holds up

Everything in this system exists for a conversation that happens rarely and matters disproportionately: somebody asks why they were contacted, and the quality of the answer determines whether it ends there.

Key takeaways

  • The answer names a date, a source, the exact wording, and what proves it was them.
  • It is produced in seconds, from one query, by whoever answers the email.
  • Retention of consent evidence outlives the consent itself, and that is deliberate.
  • Deleting a person’s data and keeping the record that they withdrew are both required.
  • The number to watch is unconfirmed suppressions, not consent rate.

What an answer looks like

“Why are you emailing me?”

  • You subscribed on 14 March 2025 through the newsletter form on our pricing page.
  • The wording you agreed to was: “Email me occasional product news and offers. You can unsubscribe at any time.”
  • You confirmed it by clicking the link in a confirmation email sent to this address on the same day.
  • You have not withdrawn from marketing since. Your last change was on 14 March 2025.
  • If you would like to stop, here is the link — it takes effect immediately across everything we use.

That is producible in about ten seconds by whoever is answering the email, from one query, and it ends the conversation in the large majority of cases. The version without this system — “our records show you are subscribed” — does not, and escalates at a meaningfully higher rate.

What makes it credible

How a consent challenge is answered from the event logA vertical chain of five steps entered by a box labelled A challenge, asking why did you email me. Step one finds the events with one query by person against the append-only event log. Step two asks whether there is wording, verbatim from the time; if not it exits to Weak answer, offering only a date and a source. Step three asks whether there is proof such as a token or a confirmation; if not it exits to Weaker still, and says so honestly. Step four composes the answer with the date, the wording and the proof. Step five offers the withdrawal link, always, in the same reply. A note says the last step matters, because an answer that defends without offering an exit reads badly.AWS ACCOUNTA challenge'why did you email me'Find the eventsone query, by personEvent logappend-onlyIs there wording?verbatim, from thenWeak answera date and a source onlynoIs there proof?a token, a confirmationWeaker stillsay so honestlynoCompose the answerdate, wording, proofOffer the withdrawalalways, in the same replyThe last step matters. An answer that defends without offering an exit reads badly.
Fig 1. How a challenge is answered. The two branches downward are what an imported or legacy consent produces, and being honest about them is better than dressing them up.
  • Database
  • App integration
  • Security & identity
  • Management
  • Analytics
  • Front-end & mobile

Every business that adopts a system like this has a pile of existing subscribers whose consent predates it, and those produce the weak answer: a date, maybe a source, no wording, no proof.

The honest handling is to mark those events explicitly as imported, with whatever provenance exists, and to know that the answer for those people is weaker. Some businesses respond by re-permissioning the imported list, which costs subscribers and produces a list where every remaining person has a strong record. That is a commercial decision rather than a technical one, and the system’s job is to make the distinction visible enough that somebody can make it.

The retention question

Why a withdrawal record is kept even after data deletionA horizontal row of five boxes. They withdraw: and ask for deletion. Delete their data: as required. Keep the withdrawal: or you will email them again. A suppression record: minimal, and held separately. Both obligations met: and they conflict. A note says deleting the record that somebody opted out is how they get contacted again.THE GENUINELY DIFFICULT ONEThey withdrawand ask for deletionDelete their dataas requiredKeep the withdrawalor you will email them againA suppression recordminimal, and separateBoth obligations metand they conflictDeleting the record that somebody opted out is how they get contacted again.
Fig 2. The retention conflict that has no clean answer. Both obligations are real and they point in opposite directions.
  • Machine learning
  • Security & identity
  • People

This is the one place in the whole series where the right answer is genuinely contested and depends on jurisdiction. The common resolution is a minimal suppression record — a hash of the address and the fact of withdrawal, nothing else — retained separately from everything else, on the basis that it exists solely to honour the withdrawal.

What the system can do is make that record genuinely minimal and genuinely separate, so that whoever has to defend the decision has something defensible to point at rather than a full customer record that was supposed to be deleted.

The numbers

One quarter of consent management summarised in five numbersA horizontal row of five boxes. Events: four hundred and twelve this quarter. Withdrawals: eighty-seven. Confirmed everywhere: eighty-six. Unconfirmed: one, escalated. Reconciliation gaps: zero. A note says the fourth and fifth are the only ones that require anybody to do anything.ONE QUARTER OF CONSENTEvents412 this quarterWithdrawals87Confirmed everywhere86Unconfirmed1, escalatedReconciliation gaps0The fourth and fifth are the only ones that require anybody to do anything.
Fig 3. A quarter of consent activity in five numbers. Only the last two describe a problem; the first three are the system working.
  • Machine learning
  • Security & identity
  • Management

Consent rate is deliberately not on that list. It is a marketing metric and putting it in a compliance report creates a quiet pressure to make the wording less clear, which is precisely the thing that makes the evidence weaker later.

Next: what all of this costs to run.

All posts