Consent and compliance
Audit Trails That Prove Marketing Consent
An audit trail for marketing consent lets you show, for any message, which permission and exclusion state allowed it to be sent. It needs three linked records: the consent events, the exact wording shown and a log of each send with the state checked.
In short
- In Great Britain, licensees must "be able to provide evidence which establishes that consent."
- Australia's regulator advises keeping records of who consented, when and how, because the sender must be able to prove it.
- Store consent as append-only events, never as an overwritten field.
- Log the permission and exclusion state used for every send, with a reason code.
Scope and limits. A design pattern for evidence. It does not set a retention period; that depends on your legal advice and the rules in each market.
What the rules ask for
The Gambling Commission's social responsibility code 5.1.11, which applies to all licenses in Great Britain, ends: "Licensees must be able to provide evidence which establishes that consent." The Australian Communications and Media Authority (ACMA) gives the same advice for the Spam Act: businesses should keep records of who gave consent, when and how, because they must be able to prove it. For BetStop, the ACMA adds that "The onus is on the wagering provider to prove" it took reasonable precautions.
None of these texts prescribes a format. The pattern below is one way to meet them.
Three linked records
| Record | Contents | Why it matters |
|---|---|---|
| Consent events | Every grant, refusal, withdrawal, objection and exclusion, with time, source and actor | Shows the history behind the current value |
| Wording versions | The exact text and options shown, with a version ID and the dates it was live | Shows what the customer agreed to |
| Send log | Message ID, customer, product, channel, time, decision result and reason code | Shows which state allowed or blocked each send |
The event fields are listed in consent and exclusion event fields. The send log is written by the decision point described in CRM architecture.
Versioning starts at the screen: designing consent capture and preference centers explains how to store each wording version as it goes live.
Append-only storage
Never update a consent record in place. Each change is a new row, and the current value is derived from the latest row. If a record was entered in error, add a correcting event that points to the one it corrects. This keeps the trail honest and lets you answer "what did we believe on that date?"
Answering a request
Example, illustrative only. A customer complains about a casino text message received on October 3. The trail should let you answer in minutes:
- Send log: message M-88231, casino, text message, decision "eligible_for_review" at 17:40, approved by campaign manager J-17 at 17:55 under the casino text rule set, sent 18:02.
- Consent events: casino text opt-in granted August 12 through the preference center; no withdrawal before October 3.
- Wording: version prefs-v4, live from July 1, shown with separate product and channel choices.
- Safeguarding: no exclusion recorded before the send.
If any line is missing, you cannot show the consent, which is itself the finding.
How long to keep it
Keep consent evidence for as long as you rely on that consent, and for a period afterwards set by your retention policy, so you can answer complaints about past sends. Balance this against the principle in data minimization: keep the evidence, not the full marketing profile.
When you compare vendors on this point, use consent and preference platform criteria.
Common gaps
- The wording shown at registration was changed, but the old version was overwritten and cannot be retrieved.
- Opt-outs made through a text reply are applied in the messaging tool but never written back to the permission store.
- Consent recorded by support staff has no actor, so it cannot be traced to a real request.
- Send logs record that a message was delivered, but not the permission and exclusion state used to decide it.
Each gap is easier to close in the design than to reconstruct after a complaint.
Questions
Is a screenshot of the registration page enough evidence?
It helps as a record of the wording version, but you also need the per-customer event that shows that this person chose the option, and when.
Should staff be able to edit the trail?
No. Corrections should be new events that point to the record they correct, with the staff member recorded as actor.
Sources
- Gambling Commission, LCCP Condition 5.1.11 - Direct electronic marketing consent, no date shown.
- Australian Communications and Media Authority, Avoid sending spam, no date shown.
- Australian Communications and Media Authority, FAQs for wagering providers: BetStop, the National Self-Exclusion Register, no date shown.
- Information Commissioner's Office, What is valid consent?, page dated August 4, 2026 (under review after the Data (Use and Access) Act).
Every source was read on October 28, 2026. How we choose sources: data sources.
Safer gambling support is listed on the safer gambling page.