Do I Need to Keep Proof of Cookie Consent? A Soho Boutique Hotel's Guide to Consent Records (2026)

Meera's Monday in Soho: the banner was perfect, the proof was missing

Meera runs a 28-room boutique hotel off Greek Street in Soho, London — an illustrative example, not a VisionQuantech client. Her site has direct bookings, Google Analytics, a Meta Pixel, and a booking-engine widget. On Monday her manager asks: "If a guest complains to the ICO that we tracked them without permission, what do we show?"

Meera opens the site. The banner is polite and well-designed: "We use cookies to improve your stay." Accept, Reject, preferences — everything works. Then she asks the question that matters: where is the record of what that visitor chose? There is none. The banner remembers a choice in the visitor's browser; nothing on Meera's side proves what happened. That gap — a working banner with no evidence behind it — is the most common consent failure in small business websites.

The short legal answer: consent you cannot demonstrate is consent you do not have

UK law gives this question a blunt answer. Under UK GDPR Article 7(1), where processing is based on consent, "the controller shall be able to demonstrate that the data subject has consented." The ICO's own consent guidance turns that sentence into a checklist: a good record shows who consented, when they consented, what they were told at the time, how they consented, and whether they have withdrawn consent.

Two laws work together. PECR governs storing or accessing information on a visitor's device — the cookie itself — and requires prior consent for non-essential cookies, with narrow exceptions for strictly necessary items like a booking basket. UK GDPR governs the personal data those cookies process, and requires consent to be freely given, specific, informed, and unambiguous, with an equally easy withdrawal.

A pre-ticked box fails. A banner with only an "Accept" button and no real reject option fails. A banner that fires the Meta Pixel before the visitor answers fails, because PECR consent must come before the cookie is set, not after.

Quotable claim for the busy reader: your banner is a promise; your consent record is the evidence. Regulators ask for the evidence.

What changed in February 2026 — and what did not

The Data (Use and Access) Act 2025 (DUAA) changed UK cookie law on 5 February 2026, cutting both ways. On the easier side, it added narrow exceptions for low-risk purposes — first-party analytics used only to improve your own service, remembering preferences such as language, and some security uses — which now need clear information plus a simple, free opt-out rather than prior consent. The ICO's updated guidance treats about six months as a sensible interval for refreshing consent, particularly where a visitor previously declined.

On the harder side, the maximum PECR fine rose from £500,000 to £17.5 million or 4% of global annual turnover, whichever is higher, and the old requirement to prove substantial damage and distress before a penalty was removed. The ICO reported in April 2026 that 99% of the UK's top 1,000 websites now meet its cookie-banner standards — which reads less like a regulator going quiet and more like one moving from "do you have a banner" to "does your banner actually work, and can you prove it."

What did not change matters more for Meera than what did. Advertising cookies, profiling, cross-site tracking, and sharing data with third parties for their own purposes still need prior consent. A default Google Analytics installation does not qualify for the new analytics exception, because the data goes to Google's servers and advertising features push it further out of scope. A Meta Pixel is advertising, full stop. A booking widget that fingerprints visitors is not analytics. The single most common error auditors now report is a site removing its banner because "analytics is exempt" while its advertising tags keep firing. That error is now expensive.

For a Soho hotel, the practical reading: the DUAA gives a small break on genuinely first-party, private analytics — and nothing at all on the pixels and widgets that make you money. Those still need consent, and consent still needs a record.

Banner vs record: why a screenshot proves nothing

Ask what each artefact actually proves, and the gap becomes obvious. A screenshot of your banner proves what the interface looked like on one day. It does not prove that any particular visitor saw it, what version of your privacy notice was live when they clicked, or what they chose. Your records of processing activities describe categories of data and lawful bases; they do not establish that an individual consented on a specific date. Your consent-platform configuration shows how the banner is set up; it is not a consent record.

A real consent event record contains: the visitor's pseudonymous identifier (you do not need their name), the timestamp, the exact choice per purpose (analytics yes, marketing no), the version of the notice they saw, the jurisdiction applied, and any later withdrawal with its timestamp. A withdrawal is itself a record you must keep: it proves you stopped.

Meera's test for any tool is now one question: "Show me one visitor's complete consent history, from first choice to latest withdrawal, in under a minute." A dashboard of aggregate accept rates is analytics about consent, not evidence of it.

Step 1: Audit what your site actually drops before anyone consents

You cannot record consent for purposes you have not listed. This 30-minute audit is the step most small sites skip because it feels technical. It is not.

Step 1 — Open your site in a private browser window and, before touching the banner, open the developer tools' Application or Storage tab and note every cookie and item of local storage already present. Anything there before consent is either strictly necessary or a breach.

Step 2 — Click through your booking flow, play an embedded video, and open the chat widget. Note each new third party: Google Analytics, Meta Pixel, booking engine, maps embed, review widget. Each is a purpose to name in plain language.

Step 3 — Sort every item into four buckets: strictly necessary (basket, login, security, load balancing), preferences (language, currency), analytics (first-party only, genuinely private), and marketing (advertising pixels, retargeting, social widgets, third-party sharing). Only the first bucket runs before consent.

Step 4 — Write one plain sentence per bucket, in a guest's words. "Marketing: lets us show you our hotel on Instagram after you visit." If you cannot write the sentence, you do not understand the purpose well enough to ask consent for it.

Step 5 — Test the reject path, not just the accept path. Click "Reject all" and confirm in developer tools that the marketing tags did not fire. A reject button that still loads the pixel is worse than no banner at all: it creates a written record of a broken promise.

Meera's audit found eleven third parties she had never listed, including a review widget setting marketing cookies on the homepage. Eleven items became four honest sentences. That is the whole audit.

Step 2: Record consent per purpose, per visitor, with versioning

Step 1 — Give every visitor a pseudonymous consent ID stored in their browser, and store the record against that ID on your side — not only in the visitor's browser, where it can be deleted and can never be produced to a regulator.

Step 2 — Record each purpose separately. "Accepted all" is fine as a shortcut for the visitor, but the record underneath must still say analytics: yes, marketing: no, preferences: yes. One blanket "consented: true" tells a regulator nothing about what was actually agreed.

Step 3 — Version your notice. Every time the banner text, the purposes, or the third-party list changes, save that version with its start date. A record that says "consented on 12 March" is only meaningful if you can also show what the visitor was told on 12 March.

Step 4 — Make withdrawal as easy as consent: a persistent footer link or small icon that reopens preferences, effective immediately, with the withdrawal timestamped in the same record. UK GDPR requires withdrawal to be as easy as giving consent, and a guest who cannot find the off switch will find the ICO's complaint form instead.

Step 5 — Let the visitor see their own record. This is the step almost no consent tool leads with, and it is the most persuasive one: a page where a guest enters their consent ID and sees exactly what is recorded for them. It turns an abstract privacy promise into something checkable, and it answers a subject-access request before it becomes a complaint.

How long do you keep the record? Longer than feels comfortable

GDPR sets no single number of years for consent records. It applies storage limitation: keep personal data only as long as necessary. For consent records, necessity has a practical shape that several regulators and practitioners now converge on. Keep a consent record for as long as the processing it authorises is active, and then for a further period covering the limitation window for claims and enforcement — commonly three to five years after processing ends, and in England and Wales the six-year civil limitation period is the reference point many UK advisers use for marketing consent records. Withdrawal records stay for the same period, because they prove you stopped.

Two mistakes to avoid: deleting logs after twelve months destroys the only evidence a campaign was lawful, and keeping them forever breaches storage limitation. The defensible position is a written rule — active plus a defined number of years, then deletion — applied automatically.

Meera's rule, written in one line in her privacy notice: "We keep your consent record while we rely on it and for six years after, then delete it." One line, no ambiguity, no spreadsheet remembering.

The tools compared: banners are cheap, records are the differentiator

Review patterns are consistent. CookieYes wins on ease and support — SaaSWorthy rates it 4.9/5 across 187 ratings — and loses at the paywall boundary: the free tier is small, and the features a growing hotel needs (geo-targeting, exportable logs, scheduled rescans) arrive one paid tier at a time. OneTrust is a different market entirely. The gap ConsentVault attacks is structural: every tool above stores the record on a vendor's cloud dashboard, while a visitor-inspectable, exportable record is the thing none of them leads with.

Honesty note: a demo is not a compliance guarantee. No tool, including ConsentVault, makes a site compliant by itself. Compliance is banner plus blocking plus record plus retention plus a human who checks the reject path.

Frequently asked questions

Do I need a cookie banner if my hotel website only uses analytics?

Only if the analytics needs consent. Strictly necessary cookies never need it. First-party analytics used only to improve your own service, with a free opt-out, may fall under the DUAA exception. A default Google Analytics setup sending data to Google does not qualify, and any advertising pixel still needs prior consent.

Is a screenshot of my cookie banner enough proof for the ICO?

No. A screenshot shows what the banner looked like, not what any visitor chose. The ICO's consent guidance asks for who, when, what they were told, how they consented, and whether they withdrew. Only a per-visitor consent event record answers all five.

How long should I keep cookie consent records?

For as long as you rely on the consent, plus three to five years after processing ends — six years is the reference period many UK advisers use for marketing records in England and Wales. Withdrawal records stay just as long.

Can a guest ask to see their own consent record?

Yes, and make it easy before they ask formally. A record-lookup page — enter a consent ID, see the full history — answers a subject-access request in seconds. ConsentVault's demo is built around exactly this page.

Does the DUAA mean I can remove my cookie banner?

No, unless your site runs only strictly necessary cookies and qualifying first-party analytics with an opt-out. Any Meta Pixel, booking-engine pixel, or advertising tag still needs prior consent, and the fine ceiling is now £17.5 million.

What is the difference between ConsentVault and CookieYes?

CookieYes is a full consent-management platform: banner, scanning, blocking, and policy generation, free for very small sites and paid from $10/month. ConsentVault is a free records demo focused on the per-visitor auditable record and visitor-facing lookup. Use a CMP for the banner engine; use the record model to judge whether its evidence would satisfy a regulator.

Related reading

• VisionQuantech AI services — the done-for-you AI agent services, including the AI Receptionist.
• Do I have to tell customers they are talking to an AI? — disclosure rules for AI on business phones.
• AI chatbot for hotels — what hotel chatbots actually recover, and what they cost.
• How do I know if my law firm is ready for AI? — the readiness-score guide for regulated professionals.
• ConsentVault — free consent-records demo — open the demo and inspect a per-visitor consent record.

References & further reading

1. ICO, "Consent" guidance — who, when, what they were told, how they consented, withdrawal: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/lawful-basis-for-processing/consent/
2. Data (Use and Access) Act 2025 — PECR changes in force 5 February 2026, fine ceiling £17.5 million or 4%: https://www.usercentrics.com/knowledge-hub/data-use-and-access-act-2025-duaa-compliance/
3. "Do UK websites still need a cookie banner? What the Data (Use and Access) Act changed" — Devonic: https://devonicweb.co.uk/blog/uk-cookie-banner-data-use-access-act-analytics-exemptions/
4. ICO updated guidance on storage and access technologies, including six-month consent refresh — Mondaq summary: https://www.mondaq.com:443/uk/privacy-protection/1794248/new-exceptions-for-non-intrusive-cookies-the-icos-updated-guidance-has-landed
5. "GDPR Consent Audit: What Evidence You Need to Prove Compliance" — SecurePrivacy: https://secureprivacy.ai/blog/gdpr-consent-audit-evidence-requirements
6. CookieYes pricing and plans — free 5,000 pageviews/month, Basic $10, Pro $25: https://www.cookieyes.com/lp/free-ccpa-cookie-consent/
7. CookieYes reviews — G2 banner issues, geography settings; SaaSWorthy 4.9/5: https://www.saasworthy.com/product/cookieyes/reviews
8. OneTrust pricing discussion, as cited in VisionQuantech's ConsentVault competitor brief: https://github.com/JoinDataCops/onetrust-alternative-cheaper
9. CookieYes vs Cookiebot comparison, as cited in the same brief: https://complianz.io/cookiebot-alternative-for-wordpress/

Cite this article: Shivam Kumar (2026). Do I Need to Keep Proof of Cookie Consent? A Soho Boutique Hotel's Guide to Consent Records (2026). VisionQuantech. https://visionquantech.com/blog/do-i-need-proof-of-cookie-consent-soho-hotels.html

This article is general information, not legal advice. Cookie and data-protection rules depend on your exact setup; take professional advice before relying on it for a regulated decision.