Question

A privacy engineer is designing a preference management platform for a global e-commerce site. Users can opt in or out of several distinct processing purposes (marketing email, personalized recommendations, third-party data sharing). Marketing wants a single "Accept All" toggle stored as one boolean to simplify the backend, arguing it reduces database complexity. What is the engineer's BEST design recommendation to support technical enforcement of privacy requirements?

Accepted Answer

Store each purpose as a separate, timestamped consent record with its own status, source, and version of the notice presented

Answer

Store a single aggregate boolean and infer individual purpose consent from the user's account creation date

Answer

Store consent only in the user's browser cookie so no server-side records need to be maintained

Answer

Store the aggregate boolean now and add granular fields later only if a regulator requests evidence