Question

A privacy engineer is designing the consent capture subsystem for a new marketing platform. Legal counsel requires the organization to be able to demonstrate, at any future point, the exact consent text a user agreed to, the timestamp, and the version of the privacy notice in effect at that time. Which design approach BEST satisfies this requirement?

Accepted Answer

Persist an immutable, versioned consent record capturing the consent string, notice version identifier, purpose, timestamp, and capture method as an append-only log

Answer

Store a boolean 'consent_given' flag on the user profile that is overwritten each time the user updates their preferences

Answer

Rely on the marketing platform's session logs, which retain user interactions for 90 days for troubleshooting

Answer

Email the user a confirmation of their consent and archive the outbound message in the mail server