The record is the disclosure, not the tick
The common failure is retaining the fact that a consumer consented without retaining what they consented to. A database row saying consent equals true, dated, is close to worthless, because the question that eventually gets asked is what the consumer was actually shown.
A usable record captures the disclosure text exactly as served, the page it appeared on, the timestamp, and the parties named in it. If the disclosure changed between the consumer seeing it and the record being reviewed, the version served is what matters.
Named parties, not categories
Consent to be contacted by 'our partners' is materially weaker than consent to be contacted by a named company. Where the consumer cannot reasonably know who will call them, the consent is doing very little work.
This is the point where lead generation economics and compliance pull against each other, because naming parties constrains how widely an enquiry can be distributed. That tension is real, and the resolution is to build the distribution model around what the disclosure supports rather than the other way round.
Retention, and being able to actually find it
A record that exists but cannot be retrieved against a specific phone number, on request, within a reasonable time, will not help anyone. Retrieval matters as much as retention.
The practical test is simple: pick a call from three months ago and try to produce its full consent trail. If that takes a developer and an afternoon, the arrangement is not ready for the moment it is genuinely needed.