A consent record is the evidence that a particular person agreed to receive your emails. A useful record answers four questions: who agreed (the email address), when (date and time), how (the form, page, event or checkout where it happened) and to what (the wording or purpose they agreed to). Many businesses also store the IP address and, for double opt-in, the time the confirmation link was clicked.
The reason is accountability. Under India’s DPDP Act, where consent is the basis for processing, the data fiduciary must be able to prove that notice was given and consent was obtained. The GDPR has a similar duty to demonstrate consent. If a subscriber says “I never signed up” or a regulator asks how you built your list, a clear record ends the conversation quickly.
Consent records should be a history, not a single checkbox. People subscribe, change preferences, unsubscribe and sometimes come back. Each change should be logged with its own date and source so that you can show what the person’s choice was at any moment. Withdrawals matter as much as sign-ups.
Common gaps include imports with no source noted, sign-up forms whose wording was changed without keeping the old version, and contacts added by colleagues from business cards. When you import a list, record where it came from and when and how those people agreed. If you can’t answer that, the list probably shouldn’t receive marketing email.
A subscriber complains that a Chandigarh gym keeps emailing him. The gym looks up his record: he joined through the “Free trial week” landing page on 3 March at 7:42 pm, confirmed by email two minutes later, and has never unsubscribed. The gym shares this and offers a one-click unsubscribe, which he uses.
MailNesto logs consent events for each contact, including the form, event page, integration or link involved, the time and the IP address, and its privacy dashboard shows how many contacts have proof of consent.