Section 6(10) of the DPDP Act puts the burden of proof on you: if anyone questions whether consent was given, you must show it. This page explains how ConsentPlix records consent so that proof holds up.
Why a normal database log is not enough
A row in an ordinary database table can be edited, backdated or deleted by anyone with admin access. If a regulator or auditor asks, you cannot easily prove that it was not changed, or which version of the notice the person actually saw.
ConsentPlix signs each record when it is created and never updates it afterwards. Any change to a stored record breaks its signature, so tampering is visible.
What a consent record contains
{
"artifact_id": "art_c7e394b8109f4a56a02e77b1029c",
"site_id": "40f5012a-4c22-4a0b-9cf7-e41d8e1329a1",
"event_type": "GRANT",
"subject_key": "d41d8cd98f00b204e9800998ecf8427e...",
"purposes_granted": ["analytics", "marketing"],
"purposes_denied": ["profiling"],
"policy_version_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"ip_hash": "7b2c918a03f446059d08e709c004a43b...",
"signature": "a8f5c312d1b7428f9901b0a51478201de38e83b4b54019a3b65f49e0c70410a8",
"key_version": 1,
"recorded_at": "2026-10-12T16:29:31.144Z"
}| Field | Meaning |
|---|---|
event_type | GRANT, WITHDRAW or UPDATE |
subject_key | Salted hash of the visitor’s identifier. No raw personal data is stored. |
purposes_granted / purposes_denied | Exactly what the person agreed to and refused |
policy_version_hash | Hash of the notice text the person saw |
ip_hash | Salted hash of the IP address |
signature | HMAC-SHA256 over the record, using your tenant key |
key_version | Which key signed it, so keys can be rotated safely |
Merkle checkpoints
Records are grouped into batches, and each batch is summarised as a Merkle root. If any single record in a batch changes, the root no longer matches. This lets you prove that a record existed at a given time without exposing the other records in the batch.
Verify a record yourself
Auditors and compliance officers can check a signature with standard OpenSSL, without using ConsentPlix at all:
#!/bin/bash
# Recompute the HMAC-SHA256 signature for a consent record
RECORD_DATA="d41d8cd98f00b204e9800998ecf8427e:GRANT:e3b0c44298fc1c149afbf4c8996fb924:2026-10-12T16:29:31.144Z"
TENANT_SECRET="whsec_your_tenant_secret_key"
COMPUTED_SIG=$(echo -n "$RECORD_DATA" | openssl dgst -sha256 -hmac "$TENANT_SECRET" | awk '{print $2}')
echo "Computed signature: $COMPUTED_SIG"If the computed value matches the signature field, the record has not been changed since it was signed.
You can also check a receipt in the browser with the receipt verifier.