See also bug 40713 comment0. The patron_consent table has two datetimes: given_on and refused_on. But (depending on consent type) we should have an expiration date for a given consent. When we reach that date we should ask for reaffirmation. This reaffirmation/expiration is typically needed for the GDPR consent.