Keep a record of consent
Store who agreed to what, when and to which version of the wording, instead of a yes/no flag you can't prove.
Skip to the promptWho needs this
- You rely on consent for anything: marketing emails, optional cookies, sharing data with partners, processing sensitive data.
- You have users in the EU, UK or Canada, where you may have to prove consent.
Why it matters
- Where you rely on consent, GDPR Art. 7(1) says you must be able to demonstrate that the person consented. A true/false column or the state of a checkbox can't show what they agreed to, or when.
- Consent must be as easy to withdraw as to give (Art. 7(3)), and withdrawing must actually stop the processing.
- Canada's anti-spam law (CASL) also puts the burden of proving consent to marketing email on the sender. In Germany, confirming email sign-ups with a double opt-in link is the usual way to prove it.
Before you paste
- A list of everything you ask consent for, and where (sign-up form, cookie banner, settings).
- The exact wording users see for each.
The prompt
Copy it into your AI builder. Fill in anything in [brackets] first, and review every change before you ship it.
Add proper consent records to this app. 1. DATA MODEL Create a consent_events table (append-only): - id, user_id (or an anonymous visitor id), purpose (for example marketing_email, analytics_cookies, partner_sharing) - granted (true for given, false for withdrawn) - wording_version: an id or hash of the exact text shown, plus a table or file that stores each version's full text - source: where it happened (signup_form, cookie_banner, settings_page, email_confirmation) - created_at timestamp Never update or delete rows: a new row records each change. Withdrawals are rows too. 2. CAPTURE - Sign-up: marketing consent is its own checkbox, unticked by default, separate from accepting the terms. Write a row whichever way they choose. - Marketing email: send a confirmation link (double opt-in) and record the confirmation as its own row. - Cookie banner: write a row per category when the visitor chooses (use an anonymous id until they sign in, then link it). 3. USE IT - A helper hasConsent(userId, purpose) returns the latest row for that purpose. Use it everywhere the app decides to send marketing, load optional cookies or share data. Don't keep separate flags that can drift. 4. LET PEOPLE CHANGE IT - A privacy settings page lists each purpose with its current state and the date it was given or withdrawn, with a toggle that writes a new row. - Every marketing email's unsubscribe link writes a withdrawal row. 5. PROVE IT - An admin view (or a query I can run) showing a person's full consent history with the wording they saw. When you're done: list every file you changed, explain each change in one line, and give me a step-by-step test for each numbered item above. Don't change anything unrelated.
Builder tips
Lovable
Ask Lovable to add Row Level Security so users can read their own consent rows but only the server can insert them.
Claude Code
Ask it to replace every existing marketing_opt_in style flag with calls to the new helper, and list where each was used.
Cursor
Use Agent mode and @-mention the files that matter (your layout, auth and database files), so it reads them before editing.
Common mistakes
- Overwriting a single boolean column, which destroys the history you need to prove consent.
- Bundling marketing consent with 'I accept the terms'.
- Pre-ticked boxes.
- Not storing the wording, so you can't show what the person actually agreed to.
Check it worked
- 1Sign up with marketing unticked: one row with granted = false (or no marketing row).
- 2Opt in from settings, then opt out: two new rows; earlier rows unchanged.
- 3Unsubscribe from an email: a withdrawal row appears and the next campaign skips you.
- 4Run the history query for a test user: you can see each choice, when it was made and the exact wording.
What a SafeLaunch scan adds
SafeLaunch judges proof of consent from your code: consent tables, timestamps and version fields count; yes/no flags don't. It shows where you rely on consent in each market.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
Questions
Sources
General guidance for common problems, not legal advice. Whether a rule applies depends on where you operate, who your users are and the size of your business.