Cookie banner
Layouts, categories and consent
Consent analytics and records
A record of every choice.
Kukie.io keeps every answer your banner collects as a dated record with a consent ID. It shows acceptance by category and country, so you can see what each banner change did.
Watch the explainer
From every answer to every page load.
See what each level counts, from the answers your banner collects to the page loads where nobody answered.
2 minutes 17 seconds, narrated, with captions in the player. The sites and rules in it are examples.
Read the transcript
- 0:00 Almost every visitor answers your cookie banner. Kukie.io turns those answers into figures you can read, and keeps each one as a record.
- 0:10 Analytics comes in two levels. Basic, on every plan, counts the choices visitors make. Advanced also counts what the banner itself did.
- 0:19 Basic shows the headline split: accepted everything, refused everything, or chose by category. Follow it by day, week or month. Today's figures are live.
- 0:31 Add acceptance by category, your top 50 countries, and a CSV export for owners and admins.
- 0:38 And behind every figure is a consent record, with a consent ID you can look up later.
- 0:44 But a record only starts when somebody answers. Advanced analytics also counts the page loads where the banner was shown, and nobody did.
- 0:53 Interactions shows banner displays, the interaction and ignore rates, the accept and consent rates, each against the previous period, with a marker where each banner version starts.
- 1:05 See which layer and which button each choice came from. Close is counted on its own. Returning visitors are kept apart, with withdrawals counted separately.
- 1:15 Categories gives the opt-in rate of every category and service, day by day.
- 1:20 Audience splits it by country, region, device, browser, language and consent model, leaving out any row under 10 displays.
- 1:29 Coverage shows how many page loads already carry a stored choice, and in opt-out regions, how often a privacy signal opted a visitor out automatically.
- 1:40 It all stays as counts, not records. The IP address becomes a country, the user agent a device and a browser, then both are discarded. No cookies, no visitor identifier, and visitors can opt out.
- 1:54 Turn it on for each site you choose. Counting starts from that moment.
- 1:58 Basic counts the answers, on every plan. Advanced adds every page load around them.
- 2:09 Kukie.io. Know how your banner performs.
Two jobs
Consent data answers two questions.
One you ask yourself after a change: are people accepting, and has that moved? The other arrives in writing from someone else, about one visitor on one day.
-
The dashboard
What everybody is doing
Aggregate figures from every answer your banner has collected: the split between accepting, refusing and choosing categories, how it moves day by day, which categories visitors are willing to allow and how any of it differs by country.
It is the half you look at by choice. It tells you what your measurement really covers, which is not the same as what your analytics tool reports, and whether a change to the banner made any difference.
-
The record
What one person did
Every decision is stored on its own, with a consent ID you can look up later to confirm what that visitor chose. Refusals are stored as carefully as acceptances, and so is a later change of mind.
It is the half you need on the day a complaint, a client questionnaire or a supervisory authority asks you to demonstrate that consent was given. It cannot be created after the fact.
Basic analytics, on every plan
Six views, filled from the first visit.
There is nothing to set up. From the moment the banner is live, every answer feeds these views for the site you are looking at.
-
The headline split
How many decisions came in over the period, and what share accepted everything, refused everything or chose category by category. The third figure shows how many people engage with the detail.
-
A day-by-day trend
The same split over the last 7, 30 or 90 days, or any date range you enter. You can see the line before and after the day you changed the wording.
-
Acceptance by category
Visitors often allow analytics and refuse marketing. Your measurement and your advertising run on different consent rates on the same site.
-
A country breakdown
Decisions grouped by country, each with its own accepted, refused and customised counts. If you set a different rule for each region, you see their effect side by side.
-
Today, live
Today's figures are read straight from the incoming decisions, with no overnight step. Publish a banner change in the morning and watch the answers arrive the same afternoon.
-
The figures as a file
Organisation owners and admins can download the trend and the country figures as a CSV file, for a spreadsheet or a monthly report.
The dashboard does not give you a target to hit. Acceptance rates vary with the audience, the region, the traffic source and how the banner is written, so a figure that would be alarming on one site is normal on another. The articles at the end of this page look at how to read them.
Advanced analytics
See how the banner itself performs.
A consent record starts when a visitor answers. Advanced analytics also counts the page loads where nobody did, so you can see how often the banner is shown, how often it is answered and with which button.
Advanced analytics is included on the Unlimited plan. It is off until an owner or admin turns it on for a site in Site Settings, and counting starts from that moment.
Displays and ignore rate
How often the banner or the cookie wall was shown, the share of those displays that got an answer and the share that got none.
The button and the layer
Whether each choice came from the first layer, the preferences panel or the cookie wall, and which button made it, with Close counted apart from Reject all.
First choices and returns
First answers kept apart from visitors who come back and change their choice, with withdrawals counted on their own.
Opt-in by category and service
The share of choices that allow each optional category, and each service on sites that ask for consent per service, day by day.
Audience
Banner displays, the interaction rate and the share of Accept all by country, region, device type, browser and banner language. A row with fewer than 10 displays is left out.
Coverage and privacy signals
How many page loads already carry a stored choice, and in opt-out regions such as US states, how often Global Privacy Control or Do Not Track opted a visitor out automatically.
Basic and Advanced, side by side.
Basic analytics counts the answers. Advanced analytics adds what happened on the page loads around them, for the sites you turn it on for.
| Feature | Basic analytics | Advanced analytics |
|---|---|---|
| Plans | Every plan | The Unlimited plan |
| What it counts | The choices visitors make | The choices, and what the banner did on every page load |
| Accept, reject and custom rates | Included | Included |
| Daily, weekly or monthly trend | Included | Included |
| Categories | How often each was allowed | Opt-in rate of each, day by day |
| Services | Not included | Opt-in rate of each, on sites that ask per service |
| Countries | The top 50, by choices | Each with at least 10 displays, with its answer rates |
| Banner displays, interaction and ignore rate | Not included | Included |
| The layer and the button behind each choice | Not included | Included |
| First choices, returning visitors and withdrawals | Not included | Included |
| Region, device, browser, banner language and consent model | Not included | Included |
| Coverage and automatic opt-outs from privacy signals | Not included | Included |
| Change on the previous period and banner version markers | Not included | Included |
| CSV export for owners and admins | The summary, trend, categories and countries | Every tab in one file |
| How it starts | On for every site from the first answer | Off until an owner or admin turns it on for a site and confirms a notice |
| Extra request from the visitor's browser | None | One small anonymous request per page load |
| What is kept | A consent record for each choice | Daily counts, one breakdown at a time |
Learn how to turn on Advanced analytics
Counts, not records.
Advanced analytics keeps daily totals for each site, one breakdown at a time, so no figure describes a narrow group of visitors. This is what happens to each piece of data it touches.
| Data | What happens to it |
|---|---|
| IP address | Used to find the country and region, then discarded. It never reaches the counts, not even as a hash. |
| Browser user agent | Reduced to a device type, such as phone, tablet or computer, and a browser family, then discarded. It never reaches the counts, not even as a hash. |
| Page address and referrer | Never sent. The request for each page load leaves both out. |
| Cookies | The request for each page load carries none, and the script that sends it reads and writes none. |
| Visitor identifier | None. No identifier of any kind reaches a count. |
| Visitors who object | Not counted. A visitor can opt out with a link you add to your privacy notice, and a browser that sends Global Privacy Control or Do Not Track is not counted either, except in opt-out regions such as US states. There visitors are counted as usual, and a page load on which your banner applied the signal is counted as an automatic opt-out. |
| The consent record | Unchanged. Where a choice was made and with which button are counted, not added to the record. |
| The daily totals | Kept for the site's consent retention period, then deleted with the consent records. On a very busy site Kukie.io may count a share of page loads and weight the totals to match. |
From a question to an exported file.
Under the GDPR, where you rely on consent you have to be able to demonstrate it1. The request often comes first from a customer, a client's legal team or a buyer doing due diligence, not from a regulator.
Your current banner proves nothing about what somebody was shown last March, and there is no way to build the records after the fact.
-
Step 1: Narrow it down
The Consent Log filters by date range, by the type of decision and by country, so a question about one period or one market becomes a short list. Records are listed newest first, one row per decision.
-
Step 2: Read the record
Each row carries the time, the decision, the categories that were allowed, the country, the page it happened on and its consent ID. Everything in it is there because somebody might one day have to justify it.
-
Step 3: Confirm one consent ID
The consent ID belongs to that one decision and can be looked up later to confirm it exists and what it says. That makes a single record checkable, not a line typed into a spreadsheet.
-
Step 4: Send it as a file
Organisation owners and admins can export whatever the filters show as a CSV file, the format anyone asking for evidence expects. No screenshots of a dashboard, no copying rows by hand.
A record shows what was chosen. Whether that consent was validly obtained depends on how your banner is set up, and most of that is decided in the banner itself.
Learn more about the consent banner
When a visitor asks to see or delete their data, the consent ID they give you finds every record of their browser, ready to export or delete, and a request form brings those questions into one inbox.
The record
What one consent record holds.
One row is written each time a visitor answers the banner. Every field in the table is stored for every decision, refusals included.
The CSV export carries all of them except the visitor identifier, the user agent hash and the Consent Mode state.
| In the record | What it holds | Why it is there |
|---|---|---|
| Time | The date and time the decision was made | Shows that consent existed before the cookies that depend on it were set |
| Consent ID | A unique identifier for that one decision | Lets a single record be looked up and confirmed later, on its own |
| Decision | Accept all, reject all, a custom selection, an update to an earlier choice, implied consent, an opt-out, or one category accepted outside the banner (from an embed placeholder's Accept button, for example) | The answer itself, in the form it was given, including the region-specific ones and grants made from the page |
| Categories allowed | The list of consent categories the visitor allowed | Shows what was agreed to and, by omission, what was refused |
| Banner version | The version of your banner configuration that was live at that moment | Ties the decision to the wording and controls the visitor saw, not to today's banner |
| Country | The 2-letter country code the visit resolved to | Shows which regional consent rules applied to that visitor |
| Page | The page the decision was made on | Locates the visit and shows where on your site people are asked |
| Visitor identifier | A random identifier generated in the visitor's browser | Connects a later change of mind to the same visitor's earlier answer |
| IP address and user agent | A keyed hash of each, never the raw value | Supports the record without storing the raw IP address or user agent |
| Consent Mode state | Where supplied, the Google Consent Mode state the choice produced | Shows what Google's tags were told for that decision |
Data minimisation
Keeping the proof without keeping the person.
Proof of consent is only useful if it is specific. The obvious way to make it specific is to store more about the visitor, which leaves you holding a searchable file of who visited what and when.
Hashed, not stored
Kukie.io stores a keyed, one-way hash of the IP address and the user agent instead of the values themselves. A hash cannot be read back into an address, so the record still supports a decision without carrying the identifiable part of it. Where the data is stored is on the security page.
Not in a consent record
- A name
- An email address
- A raw IP address
- A raw browser user agent
What remains is enough to show that a decision was made, and not enough to build a profile of the person who made it.
Cleared on time
Records are evidence, but they are also personal data, so keeping them forever is not the cautious option it looks like. You set the retention window for each site, up to your plan's maximum, and older records are cleared automatically once they pass it. The pricing page lists the window on each plan.
When it matters most
Who needs consent records most.
Every site that relies on consent should keep them. These are the situations where you are most likely to need them soon.
-
You sell to businesses
Supplier questionnaires and procurement reviews ask how consent is recorded, and the answer has to be more than a description of your banner. A dated export answers it in one reply.
-
You work for clients
Consent records show an agency's clients that what it installed is working, month after month, without asking them to take it on trust. They also show who was responsible for what, and when.
-
Your traffic numbers dropped
When analytics drops sharply after a banner goes live, the useful question is what share of visitors allow the analytics category. The category breakdown answers it directly.
-
Somebody else will inherit the site
A sale, a handover or a new person in the role. Stored records let the next owner answer questions about a period they were not there for.
Consent logging is on by default, and you can turn it off for a site in Site Settings if you would rather not keep records. The categories visitors choose between come from your cookie scan, so a record is only as meaningful as the categories behind it.
Questions about consent analytics and records
What is a consent record?
A consent record is the stored evidence of one visitor answering your cookie banner once. In Kukie.io it holds the date and time, the decision itself, the list of categories that were allowed, the country the visit resolved to, the page it happened on, the version of your banner configuration that was live at that moment and a consent ID for that single decision. It also holds a random visitor identifier, keyed hashes of the IP address and user agent and, where supplied, the Google Consent Mode state. A record is written for every answer, including refusals and later changes of mind.
How do you prove cookie consent if a regulator asks?
You produce the records. Under the GDPR the burden of proof sits with you: where you rely on consent, you have to be able to demonstrate that the visitor consented. A screenshot of your current banner does not do that, because it says nothing about what any individual was shown months ago. A consent record does, because it is dated, it names the categories that were allowed and it is tied to the banner configuration in force at the time. Kukie.io provides that record and lets you export it. Whether your consent was validly obtained still depends on how the banner was set up.
How long should consent records be kept?
There is no single number in law. The working principle is that you should be able to demonstrate consent for as long as you rely on it, and no longer than you need it, because the records are themselves personal data. In Kukie.io you set the retention window for each site, up to your plan's maximum, and older records are cleared automatically once they pass it. How long you can keep them depends on your plan.
Are cookie consent logs personal data?
Treat them as personal data, yes. A dated record of what a particular browser chose is information about a person even when it carries no name. That is why Kukie.io stores a keyed, one-way hash of the IP address and the user agent instead of the raw values: the record still supports the decision, but the identifiable part is not sitting in your database waiting to be exported or breached. There is no name and no email address in a consent record.
Can I see cookie consent rates by country?
Yes. The dashboard breaks consent down by country, showing how many decisions came from each one and how they split between accepting, refusing and choosing individual categories. It shows whether the rules you have set for a region produce the behaviour you expected, and whether one market behaves very differently from the rest.
How current is the data in the consent dashboard?
Today's figures are live. There is no overnight step to wait for, so a banner change you publish this morning shows up in the numbers this afternoon rather than tomorrow. Completed days are summarised for speed, and the day-by-day trend covers the window you select: the last 7, 30 or 90 days, or any date range you enter.
What does Advanced analytics add?
Basic analytics, on every plan, counts the choices visitors make. Advanced analytics, on the Unlimited plan, also counts what the banner did on each page load: how often it was shown, how often it was answered and how often it was left unanswered. It shows which button and which layer each choice came from, opt-in rates by category and service, and banner displays and answer rates by country, region, device, browser and banner language. It is off until an owner or admin turns it on for a site in Site Settings.
Does Advanced analytics add anything to the consent record?
No. A consent record holds the same fields with Advanced analytics on or off. The extra details about a choice (where it was made, which button was used, the consent model and the banner language) are added to daily counts for the site and then discarded. The banner also sends one small request on each page load, saying only what the banner did there. That request carries no cookie, no page address and no visitor identifier, and it is counted, never stored as a record. Visitors who opt out are not counted, and neither are browsers that send Global Privacy Control or Do Not Track, outside opt-out regions such as US states.
Start keeping consent records.
The dashboard and the records fill from the first visitor who answers your banner. How long records are kept depends on your plan.
Related features
Consent records come from the banner and are protected by the platform underneath it. These are the pieces closest to them.
-
-
Cookie scanner
Find the cookies your site sets
-
Security
EU storage, hashing, 2FA
More on reading consent data
How to read acceptance rates, what happens to your analytics after a banner goes live and what an investigation looks like.
-
Cookie consent rates in published studies, and what moves them
In a 2024 Bitkom survey of 1,013 internet users in Germany, 45% said they accept all cookies as a rule and 21% reject all. In a 2020 experim...
-
How to Improve Cookie Consent Rates Without Using Dark Patterns
Cookie consent rates vary wildly depending on how your banner looks, what it says, and when it appears. This guide covers ethical, regulatio...
-
Why Google Analytics traffic drops after adding a cookie banner
A GA4 drop after a cookie banner goes live is the share of visits that did not consent, not lost visitors: Search Console clicks and server...
-
Cookie Consent as Evidence: What to Prepare for a DPA Investigation
When a data protection authority opens an investigation, your cookie consent records become your primary defence. Knowing what regulators re...
Footnotes
Kukie.io provides tools to collect and record consent. It is not legal advice, and using it does not by itself make a website compliant with any law.
- 1. Article 7(1) of the General Data Protection Regulation (EU) 2016/679: where processing is based on consent, the controller must be able to demonstrate that the data subject has consented. Back to footnote 1 in the text
