Thanks for the answer. Not sure if I misunderstood the GDPR but I thought it had the requirement to be able to provide the consent documentation for any identifiers used (like Google Analytics ID or Matomo ID).

The user has the consent documentation on their device. But I can't provide the documentation myself.

I actually don't think the risk is very high. And I agree that storing this information on my side is additional data privacy risk.

But I don't feel GDPR is easy here.