Activity & Insights

ConsentStack gives you three tools to understand and prove your compliance: an analytics dashboard for trends, consent logs for audit-ready records, and tracker detection for managing third-party scripts.

Consent Analytics

The analytics dashboard shows you how visitors are responding to your consent banner at a glance.

KPI Cards

Four key metrics sit at the top of the page:

• Total Events. The number of consent interactions during the selected period.
• Consent Rate. The percentage of visitors who opted in (accepted all categories).
• Time to Action. The average time between seeing the banner and making a decision.
• Bounce Rate. The percentage of visitors who left without interacting with the banner at all.

Each card shows a delta indicator when comparison mode is on, so you can see whether a metric is trending up or down versus the prior period.

Trend Chart

Below the KPIs, a trend chart plots your selected metric over time. Use the time range selector to view the last 24 hours, 7 days, 30 days, or 90 days.

Turn on comparison mode to overlay the current period against the previous one. This helps you spot the impact of banner changes or seasonal shifts.

Breakdown Charts

Two breakdown panels round out the dashboard:

• Devices. Consent events split by desktop, mobile, and tablet.
• Top Countries. Consent events by visitor country, with the applicable regulation and per-country consent rate shown inline.

Export

Click Export CSV to download the current dataset. Useful for sharing with legal or plugging into your own reporting tools.

Consent Logs

Every consent decision a visitor makes is recorded as an individual log entry. Logs are your proof of consent: the record you hand to an auditor or regulator when they ask, "Can you prove this visitor consented?"

How do I prove a specific visitor consented?

Export your consent logs and filter by the visitor's anon_id_hash, the SHA-256 hash of their anonymous ConsentStack ID. Every decision that visitor ever made on your site is a row under that one key, each carrying the timestamp, the action taken, the category-level choices, the regulation that applied, and the exact banner configuration version they saw. Those rows are the evidence package.

What Gets Logged: The Export Schema

The CSV export contains exactly 29 columns per consent record. These are the literal column names, in export order:

CSV and JSON exports are not the same schema

The CSV is a fixed 29-column report. The JSON export returns the complete stored record, a superset of the CSV. The extra fields include the Global Privacy Control audit pair (gpc_detected, which records whether a GPC signal was present on the event, and signal_source, which records whether the decision came from an honored signal, a banner click, or the preferences center), the label of the in-page prompt or import that triggered the decision, and, for consent imported from a previous CMP, that CMP's own record. Choose JSON when the audit question involves GPC or imported consent.

Location in a consent log is the visitor's country (country_code) and the consent region that matched, such as a US state (region). City, postal code and coordinates are not stored. The geo-details setting only makes them available to your page's code through window.consentstack.getGeo().

Exporting Consent Logs

In the dashboard, open your site's Activity area, go to Consent Logs, and click Export. Two formats are available:

• Consent Logs (CSV): the 29-column report above, RFC 4180 escaped, with a header row.
• Consent Logs (JSON): newline-delimited JSON (NDJSON), one complete record per line.

Both formats stream your site's entire log, not just the page of results you are viewing. The download is named consent-logs-<site>-<date>.csv or .ndjson.

Export is available on paid plans, and on any plan while a retention hold is active (see How long are consent logs kept?).

Browsing and Inspecting Logs

Logs appear in a paginated table sorted by most recent. Click any row to open the inspector panel on the right, which shows the full detail of that consent event, including the interaction timeline (banner shown, preferences opened, decision made) and metadata like SDK version and banner position.

Privacy by Design

Visitor IDs are cryptographically hashed before they are stored. Your logs contain no names, email addresses or IP addresses, page URLs are stored without their query strings or fragments, and location stops at country and region. If you import consent from a previous CMP, the imported record keeps that CMP's own consent ID as it was issued, so you can match it to the old vendor's log.

How long are consent logs kept?

Retention is enforced by a nightly cleanup job, so these numbers are the storage reality, not a dashboard display setting: Business keeps consent logs for one year, Pro+ keeps 180 days, Pro and Pro Lite keep 30 days, and Basic keeps logs for the current monthly period (counted from the day the site was created). The logs dashboard itself is available on paid plans.

When a plan change would shorten retention, because a paid plan ends and the site moves to Basic or because the site moves to a plan that keeps logs for less time, the site keeps its previous retention for 30 more days. During that hold you can still export the site's logs, even on Basic, and the dashboard shows the date the hold ends. After it ends, the new plan's retention applies and older logs are deleted.

Deleting a site, a workspace or your account deletes its consent logs immediately, so export anything you need first.

How do I delete a visitor's records?

When a visitor asks you to delete their data, you can delete their records yourself from the Consent Logs page. Team owners and admins can do this on any plan that includes consent logs.

1. Get the visitor's ID (see the next section).
2. Open your site's Activity area, go to Consent Logs, and click Delete visitor records.
3. Paste the ID and click Delete records.

The dialog then shows how many records were deleted. Deletion is permanent and can't be undone.

You can also start from a log entry. Open the menu at the end of its row and choose Delete all records for this visitor, or Delete this record to remove just that one entry.

What gets deleted, for that site:

• Every consent record with the visitor's ID: their choices, the page, browser and device details, location, and any consent imported from your previous banner.
• The visitor's ID in tracker detection. Tracker detection keeps a short list of visitor IDs for each tracker, only to count how many different visitors saw it. The visitor's ID is replaced with a random value, so the count, and your tracker list, stay the same.

What stays:

• The visitor count for the current billing period keeps a hashed entry for the visitor, because your plan's visitor limit is counted from it. When the period ends, the entries are deleted and only the total is kept.
• Analytics totals (counts per hour and per day) have no visitor ID. Past totals still include the visitor's choices as numbers.

If the visitor comes back with the same ID, new visits create new records, the same as for anyone else. A choice they made in the last few seconds before you delete can still arrive just after.

Finding the visitor's ID

ConsentStack doesn't know your visitors' names or emails. The banner gives each browser a random ID and keeps it in that browser, on your site, under the name consentstack_anon_id. We only store a one-way hash of it: the Hashed visitor ID in the log inspector, and the anon_id_hash column in exports. The delete dialog accepts either one.

There are three ways to find the right records:

• Ask the visitor for their ID. In the browser they used, on your site, they can open the developer tools and run localStorage.getItem("consentstack_anon_id") in the console. Most people won't know how, so it's easier to show it to them. Add this to your privacy page or your data request form:

  <p>Your visitor ID: <code id="cs-visitor-id">none</code></p>
  <script>
    try {
      document.getElementById("cs-visitor-id").textContent =
        localStorage.getItem("consentstack_anon_id") || "none"
    } catch (e) {}
  </script>

  If your site runs on more than one domain or subdomain, the visitor has a separate ID on each.

• Find them in the logs. If the visitor can't give you an ID, ask when they visited, from which country or state, and on what device and browser. Find the matching entry in Consent Logs, check it in the inspector, then use Delete all records for this visitor on that row. Only do this when you're sure it's their entry.

• Use an export. Every row of a CSV or JSON export carries the hashed ID in anon_id_hash.

If the visitor also wants your site to stop recognizing their browser, they can clear your site's data in their browser settings. Their next visit gets a new ID and shows the banner again.

The deletion log

Click Deletion log on the Consent Logs page to see every deletion on the site: when it happened, who did it, how the records were found, and how many were deleted. It doesn't keep the visitor's ID. It's your record that you handled the request.

An AI agent connected through the MCP server can do the same with the delete_visitor_records tool, and its deletions appear in the same log.

Tracker Detection

ConsentStack automatically detects third-party scripts running on your site and reports them back to the dashboard. This gives you a clear picture of what is loading on your pages, and whether those scripts are properly gated behind consent.

How It Works

The SDK monitors your site for third-party scripts and reports their domains to the dashboard. Those domains are matched against a database of 900+ known tracker patterns and auto-categorized (e.g., Analytics, Advertising, Social Media). Recognized scripts show the vendor name, logo, and a link to the vendor's site.

Scripts that don't match a known domain are flagged as uncategorized and surfaced at the top of the page for your review. You can assign a consent category to any script with a single click.

Triggering a Scan

Trackers appear automatically as visitors browse your site. If you want results immediately (for example, after launching or connecting a new domain), click the Sync button to trigger a fresh scan on demand.

Custom Rules

For scripts that aren't auto-detected, you can add custom domain pattern rules to manually assign a consent category. This is useful for internal tools or niche vendors that aren't in the known tracker database yet.

What's Next

• Categories & Regions. Learn how consent categories and regional rules connect to tracker blocking.
• Script Blocking. Understand how ConsentStack prevents scripts from running before consent is given.
• Analytics & Logs feature overview. See what the analytics dashboard and consent logs look like in practice.