Tamper-Evident Consent: Portable, Verifiable Proof

A consent record is only useful for as long as someone is willing to take it on faith. Months or years after a banner captures a "yes," the party asking for proof is rarely the one that built the platform — a regulator investigating a complaint, an auditor closing a review, a counterparty checking a data-sharing agreement. None of them start from a position of trusting the vendor. They need to check that the record is genuine and unaltered on their own terms.

ConsentIQ was built around that constraint: proof that holds up to someone who has no reason to believe ConsentIQ.

Every record points to the one before it

Each consent artefact ConsentIQ writes carries a hash of its own contents and a reference to the hash of the artefact immediately before it. The two are linked by construction: change a past record's purpose, timestamp, or consent status, and its hash no longer matches what the following entry expects. The chain breaks at that point, and ConsentIQ's own console surfaces the mismatch rather than accepting the edit silently.

This doesn't depend on trusting whoever operates the system not to touch old rows. The structure makes tampering visible on its own, the same way a torn page in a bound ledger is obvious even if no one saw who tore it.

Signing a record on its own only proves it hasn't changed since it was signed. It says nothing about whether an entry was quietly deleted, or inserted after the fact to make history look tidier. Chaining closes that gap: because each entry's hash accounts for the entry before it, removing or inserting anywhere in the sequence changes every hash that follows, and the break is visible from that point forward, not just at the edited record itself.

Two signatures, two audiences

Every artefact carries an internal integrity signature, which ConsentIQ uses to confirm the record hasn't changed since it was written — a standard integrity check for the platform's own systems.

Alongside it, an artefact can carry a second signature built for a different audience: a portable signature, verifiable against a public key ConsentIQ publishes. A regulator, auditor, or business partner can verify a single consent receipt themselves, with no ConsentIQ login and no call back into the platform.

Verification that doesn't ask for an account

The practical form of that portability is a public verify endpoint. Given a consent receipt, anyone can confirm that its place in the hash chain is intact, without authenticating as a ConsentIQ customer. A regulator can fetch the published key and check a receipt during an investigation without opening an account or waiting on ConsentIQ to confirm anything on their behalf.

The same published key and open endpoint work whether the record is checked from inside ConsentIQ's console or from a system that has never seen ConsentIQ before:

What's being checked	Mechanism	Who can check it
Chain integrity — has any past record been altered	a tamper-evident link to the previous entry	ConsentIQ console, on demand
A single receipt's authenticity	a portable signature verifiable against the published key	Any third party, against the published key, no account required
Machine-readable, standards-based proof	W3C Verifiable Credential (JSON-LD)	Systems built to verify W3C credentials
Consent-receipt portability across vendors	Kantara Consent Receipt	Systems expecting the Kantara standard

Formats built for the systems that will read them

A receipt that only opens inside ConsentIQ is not much use to an auditor working from their own tooling. Records export as a human-readable PDF for disclosure and record-keeping, and also in three formats meant to travel: a W3C Verifiable Credential in JSON-LD, checkable by any system that already verifies W3C credentials; a Kantara Consent Receipt, the established consent-receipt standard for portability between vendors; and a MeitY-aligned artefact, a JSON profile structured around India's Electronic Consent Framework, distinct from a conformant ECF XML export. Each format carries the same underlying signature and chain position — the choice is which downstream system needs to read it.

Why this matters months after the fact

The value of a chained, independently verifiable record shows up late, not at the moment of collection. When a data principal disputes what they agreed to, or a regulator asks a company to substantiate a consent basis it relied on months earlier, the answer can't depend on the vendor's word. A hash chain that flags its own tampering, a signature checkable against a published key, and export formats that other systems already understand mean the proof stands on its own once the moment of collection has long passed.

A consent record checked only by asking the vendor that issued it rests on the vendor's word. ConsentIQ chains, signs, and publishes the means to verify each record independently of ConsentIQ itself: book a ConsentIQ demo and proof of concept.