Context: Data protection regulations such as the GDPR and the Brazilian LGPD impose strict requirements on consent management, including demonstrability, revocation support, accountability, and traceability. In practice, however, many existing consent management solutions fail to preserve a reliable historical linkage between user consent decisions and the specific versions of privacy policies in force at the time of collection, which undermines auditability and regulatory compliance. Goal: This paper aims to design a modular, scalable, and interoperable software architecture that supports the registration, explicit versioning, and auditing of user consent, ensuring traceability, integrity, and compliance with privacy regulations while preserving the historical binding between consent records and evolving privacy policies. Method: We follow a Design Science Research approach to derive architectural requirements from GDPR, LGPD, and relevant ISO/IEC standards, and to design a microservice-based consent management architecture. The proposed solution is instantiated as a proof of concept composed of independent services for policy management and consent recording, exposed through RESTful APIs. The architecture is demonstrated in a controlled environment through end-to-end consent lifecycle scenarios, including policy versioning, consent granting and refusal, revocation, and audit querying. Results: The proof of concept shows that explicit policy versioning, cryptographic integrity mechanisms, and event-based consent recording can be combined to preserve immutable historical records of consent decisions. Each consent, refusal, and revocation event is deterministically bound to a specific policy version, enabling consistent audit queries by user, policy, and time. Conclusion: The study indicates that a version-aware, microservice-oriented design provides a feasible foundation for auditable and regulation-compliant consent management. By treating privacy policies as versioned artifacts and consent as a persistent event history, the proposed architecture bridges regulatory requirements and implementable software mechanisms.