In this guide 6 sections
Hold consent where every system can read it and where each record keeps its purpose, notice version, source, timestamp and withdrawal. A CRM field is quick but thin. A consent tool suits many web forms. Your own database suits products with logins. Choose by how a withdrawal travels.
What a consent record must carry
A tick box is not a record. A record answers an auditor’s questions months later. What did this person agree to? Which wording were they shown? Where did they say yes, and when?
Five fields do most of the work. Purpose, notice version, source, timestamp and withdrawal status. Add the identifier you will search by, such as an email address or a customer ID.
Withdrawal is its own event. It is not an edit. Keep the original yes and add a dated no beside it. Overwriting the old row erases the evidence you may need.
- Purpose, written as one plain sentence per use
- Notice version or a hash of the text shown
- Source: web form, app screen, paper slip or call
- Timestamp with time zone for grant and for withdrawal
- Person identifier plus any linked parent or guardian
Option one: fields inside the CRM
HubSpot, Zoho and Salesforce all let you add a consent property to a contact. Marketing teams already live there, so adoption is easy. Campaign lists can filter on the field.
The weakness is history. Most CRMs keep one current value and a loose change log. Storing separate rows per purpose and per notice version usually means a custom object, which takes effort.
Treat the CRM as a reader of consent, not the source of truth, unless your needs are small. One newsletter, one form, one team. That case is fine with a field.
Option two: a dedicated consent tool
Tools such as OneTrust, Cookiebot, Usercentrics and Osano present the banner, store the choice and keep a log per visitor. They suit sites with many forms and several tracking scripts. Setup takes days, not months.
Check the export. Can you pull every record for one person as a CSV or through an API? Can the tool push a withdrawal to your CRM and mail platform by webhook? A closed log is a trap. Walk away.
The DPDP Rules in India add a role here. A registered consent manager is a separate entity that lets a person view, give and withdraw consent across businesses. Ask your lawyer whether you need to integrate with one.
- Banner and preference centre included
- Per-visitor log with the wording shown
- Webhooks or API for withdrawal events
- Weak fit for logged-in product behaviour
Option three: your own consent table
A table in your application database gives you full control. One row per grant, one per withdrawal, keyed to the user ID. Foreign keys tie each row to a purpose list and a notice table.
It fits products where people log in, such as a patient portal, a school app or a marketplace. Consent sits beside the data it governs, so a query can join them. A withdrawal can switch off a feature in the same transaction.
The cost is upkeep. You write the screens, the export and the audit trail. Nobody else’s banner covers your marketing site, so you still need something there.
Make a withdrawal reach every copy
Whichever home you pick, copies spread. The mail platform, the CRM, an analytics export and a spreadsheet on a laptop all hold the same email address. One withdrawal must reach each.
Draw the map first. List every system that stores or uses consent, and mark which one is the master. The master emits an event. Every other system listens and acts.
Then test it. Really test it. Withdraw a test contact on Monday and check each system on Tuesday. Write down who fixes a miss. That small drill tells you more than any vendor demo.
Consent home comparison sheet
This comparison sheet has three columns: CRM field, consent tool and own table. Rows list the five record fields, history of changes, export format, withdrawal webhook, login-based products, upkeep owner and rough setup time. A second block lists each system holding a copy, its master or follower status and the date of the last withdrawal test.
Open a blank worksheet to printQuestions owners ask
Can a spreadsheet hold consent records?
For a handful of contacts, yes, if every row carries purpose, notice version, source and timestamp. It breaks once several people edit it or a withdrawal must reach other systems. Plan to move off it early.
Do I need a registered consent manager?
The DPDP Rules describe consent managers as a way for a person to manage consent across businesses. Whether your business must connect to one is a legal reading. Ask your lawyer, then plan the integration with your developers.
How long should consent records be kept?
Keep them as long as you rely on the consent, and for a period your lawyer advises afterwards so you can show what happened. Set the period per purpose and automate the deletion.
Can one tool do both cookies and marketing consent?
Many do, using one preference centre. Confirm that the cookie choice and the email choice are stored as separate purposes. Bundling them makes withdrawal clumsy and weakens the record.