Privacy is not a later problem.It is a procurement problem.
ConsentCenter gives you a consent setup you will not have to unpick when the first serious customer asks how it works.
- GDPR Article 7(1)
- GDPR Article 12(3)
- GDPR Article 30(5)
You will not get fined first.
You will get asked first.
The security questionnaire from your first real prospect asks what you collect, on what basis, and how someone withdraws. The deal stalls while four people reconstruct an answer, and the honest answer is that nobody decided.
Where this goes wrong first.
The analytics went in on day one
Before there was a policy, a legal review or anyone whose job this was. Now it is wired into three dashboards people make decisions with, and unpicking it is a project.
Nobody owns it, so everybody assumes
Engineering assumes legal signed off. Legal assumes engineering configured it. Marketing adds a pixel. The assumption holds until someone external asks a direct question.
Retrofitting costs more than starting right
Adding a consent record later means backfilling choices you never captured — which you cannot do. The gap in the history is permanent, and it starts on the day you shipped.
What you are actually buying.
Ask for the purposes you actually use, from the first deploy.
Hold a consent record you can show a prospect without a week of preparation.
Add preference management and privacy requests when you need them, not all at once.
How it works
Start
Put a working consent experience on the site without a compliance project first.
Record
Keep the history from the beginning, so there is no gap to explain later.
Grow
Add preference management and rights workflows as customers start asking for them.
What the text actually says.
- GDPR Article 7(1)
- The controller must be able to demonstrate that the person consented — which means the record has to exist from the start.
- GDPR Article 12(3)
- A data subject request must be answered within one month of receipt, extendable by two further months where the request is genuinely complex.
- GDPR Article 30(5)
- Organisations with fewer than 250 employees are exempt from keeping records of processing only if the processing is occasional, low-risk and excludes special categories of data.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
Cookie Consent
The fastest honest starting point: know what runs and hold the optional parts.
View productUniversal Consent & Preference Management
Add purpose-based preferences once you have more than one way of contacting people.
View productDSAR & Privacy Rights
Have an answer ready the first time someone asks for their data back.
View product
Frequently asked questions
The consent record is the part that cannot be backfilled, so starting it early is cheap and starting it late is impossible. Everything else here can wait.
No, and we will not pretend otherwise. What reviews tend to ask for is a clear basis for what you collect and a working way to withdraw. That is a small subset of this page.
No. ConsentCenter supports the operational side — capturing choices, enforcing them and keeping the record. Which requirements apply to you is a question for your own counsel.
Bring us the startups version of this problem.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.