How to audit a customer data platform's consent trail before renewal

What to take away

A consent audit tests what the CDP records for each contact, not what the vendor's policy says.
You need six fields per consent eventidentity, purpose, timestamp, source, notice version and withdrawal route.
PECR and UK GDPR set the legal floor for electronic marketing and lawful bases.
Run the test on live pages before renewal, then fix gaps or move tools.
Hand unresolved AI or scoping gaps to a separate approval process.

Consent evidence versus a compliance claim

A vendor can show a policy page that sounds correct. A consent trail audit asks for the raw records behind one contact. You pick a real email address, open its profile in the CDP, and inspect every consent field. If the platform cannot show how that person opted in, the claim is untested.

This matters because consent is not a single tick box. UK GDPR requires consent to be freely given, specific, informed and unambiguous. PECR adds rules for electronic marketing. The ICO direct marketing and privacy guidance hub explains those consent and electronic marketing rules for UK senders. ICO direct marketing guidance

The minimum record for each consent event

Use this table to compare what a CDP stores against what you need.

Consent record fields to audit

Field

Identity key: Email, phone or ID
Purpose: Named reason per channel
Timestamp: Opt-in and withdrawal time
Source: Form, import, call centre
Notice version: Wording shown at capture
Withdrawal: Method and time logged

What to check

Identity key: Split duplicate profiles
Purpose: One blanket flag
Timestamp: Only latest kept
Source: Empty for imports
Notice version: No version history
Withdrawal: Logged as deletion

Common gap

Identity key
Purpose
Timestamp
Source
Notice version
Withdrawal

Field	What to check	Common gap
Identity key	Email, phone or customer ID linked to the profile	Duplicate profiles with split consent
Purpose	Named reason such as email news or SMS offers	One blanket flag for all channels
Timestamp	Date and time of opt-in or withdrawal	Only the latest update is kept
Source	Form, import, call centre or app	Source field empty for imported lists
Notice version	Privacy notice wording shown at capture	No version history
Withdrawal	Method and time of objection	Withdrawal logged as a deletion

The table turns consent from a policy statement into a page-by-page audit. If a field is blank, ask the vendor how the CDP fills it during identity resolution. The ICO GDPR guide covers lawful bases, transparency and individual rights that affect that matching work. ICO GDPR guide

A live test in six steps

Pick five real contacts from different sources, including one imported list and one app sign-up.
Open each profile and record the six fields from the table above.
Search the consent log for the notice version shown at capture.
Check the preference centre updates the same fields, not a separate marketing table.
Export a segment and confirm the export keeps the consent purpose and timestamp.
Ask for a deletion or withdrawal test and time how long the change propagates.

Small businesses often run Dotdigital, Klaviyo, Zoho CDP or Segment alongside a spreadsheet. BlueVenn and similar tools may offer stronger identity resolution. Test the tool you own, on your data, before renewal talks. The UK GDPR contents page sets the principles for accuracy and storage limitation that apply to stale consent records. UK GDPR contents

Live consent trail test

Pick five contacts from different sources
Record the six consent fields per profile
Search consent log for notice version
Check preference centre writes same fields
Export segment and verify purpose and timestamp
Time how long withdrawal takes to propagate

Renewal checklist for consent fields

Every consent event has identity, purpose, timestamp, source and notice version.
Withdrawal is recorded as a change of status, not a silent delete.
Preference centre writes to the same profile the CDP uses for segments.
Imports carry a source label and the date of collection.
AI scoring or next-best-action tasks inherit the consent purpose.

Example: tracing one opt-in across a CDP and an email tool

Suppose a customer ticks email offers on a checkout page. The CDP should record the source as checkout, the purpose as email offers, the timestamp and the notice version. If Klaviyo sends the email, the consent must travel with the profile or the send becomes a PECR risk.

A consent trail is only complete when the sending tool and the CDP agree on the same purpose, timestamp and withdrawal state.

When gaps need an AI scoping page

If the CDP uses AI to score, rank or predict, a consent flag for email is not enough. You must scope the AI task, the data used, human authority and rollback controls. Start with scoping CDP AI applications before approving any model. scoping CDP AI applications

For buying decisions, compare UK customer data platforms for small businesses on VAT, hosting and support before renewal. UK customer data platforms for small businesses

Common questions

What is a CDP consent audit?

A CDP consent audit is a page-by-page review of the records a platform holds for each consent event. It checks identity, purpose, timestamp, source, notice version and withdrawal.

Which UK rules apply?

UK GDPR sets the lawful basis and individual rights. PECR sets consent rules for email, SMS and calls. The ICO enforces both.

How often should we test the trail?

Test before every renewal and after any import, migration or new channel. A consent record that cannot be reproduced is a gap.

What if the CDP cannot show the source?

Ask for a data map and a consent log export. If the source is missing, treat the record as unproven and seek advice before sending.