Customer data glossary

Consent state

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

Consent state is the current, per-person and per-purpose record of what a customer has agreed to or refused, including when, how and under which wording.

Part of the Learn hub and the customer data glossary.

What it means in practice

Under GDPR, consent is "any freely given, specific, informed and unambiguous indication of the data subject's wishes", given by a statement or a clear affirmative action (Article 4(11)). The controller must be able to demonstrate that consent was given (Article 7(1)), and withdrawal must be possible at any time and "as easy to withdraw as to give" (Article 7(3)) 1. A yes/no flag cannot meet that. A consent state stores the purpose, the status, a timestamp, the channel and source, the version of the notice shown and the jurisdiction, and it keeps history so an earlier decision can be evidenced.

The consent state belongs with the customer profile and must be enforced where data leaves the platform, at activation and in journey orchestration, using the value at the moment of use rather than a copy from last week's export.

Consent is only one lawful basis. Mature models also record other bases and objections, and keep service messages separate from marketing.

When identity resolution merges two profiles, the combined profile should take the most restrictive state for each purpose until the person says otherwise.

Example (retail banking): a customer withdraws marketing consent in the mobile app. The change must reach email, SMS and advertising-audience destinations promptly, and the bank must later be able to show when the withdrawal arrived and when each channel stopped.

Suppression list: the enforcement filter for withdrawals.
Purpose limitation: why consent is per purpose.
Activation: where consent is enforced.
Identity resolution: merges must not widen consent.
Audit ledger: the evidence trail.

Where it matters

Consent withdrawal across channels: a suppression architecture: propagating a withdrawal.
Customer journey orchestration: the consent problem in journeys.

Back to the customer data glossary or the Learn hub.

Frequently asked questions

Is consent state the same as a cookie banner choice?

A banner choice is one input. Consent state covers every purpose and channel and ties the choice to a person, not just a browser, so it can be enforced across email, SMS and ads.

How long should consent records be kept?

GDPR does not set a period for consent records. Keep them as long as you rely on the consent and need to demonstrate it (Article 7(1)), and set the period in your retention policy.

What happens to consent when profiles merge?

Apply the most restrictive state per purpose, log the merge, and reconfirm before any broader use. A merge must never widen what a person agreed to.

Sources

Regulation (EU) 2016/679 (GDPR), Articles 4(11) and 7 Open source

This entry is general information, not legal advice.