Consent Records Retention: How Long to Keep Proof and What to Store
Most teams think about consent at the moment of collection. The banner shows, the visitor chooses, the choice is logged somewhere. The harder question arrives months later, when a visitor, a client, or a regulator asks what exactly that person agreed to, and when, and in what words.
That is a records problem, not a banner problem. Retention rules, storage format, and retrievability decide whether your consent logs help you or quietly expire into uselessness. This guide covers what to keep, how long to keep it, and how to prove you kept it properly.
What a complete consent record contains
At minimum: a timestamp, the categories accepted or declined, the version of the notice and banner text shown, the site or app context, and an identifier that connects the record to the visitor without collecting more personal data than the record itself needs. Screenshots or archived copies of each banner version close the gap between what your log says and what a visitor actually saw.
Versioning is the piece most logs miss. Banners change wording, categories, and vendors over time. A record that says accepted on a date is weak if you cannot show which wording was live on that date. Keep a dated archive of banner versions and map each record to the version in force when it was captured.
How long to retain consent proof
A practical rule is to retain proof for the life of the consent plus an additional period that covers complaint and limitation windows in the markets you serve. Deleting records the moment consent is withdrawn removes your evidence that earlier processing was lawful. Retaining them forever creates its own exposure, so set a schedule, write it down, and apply it automatically.
Different categories can carry different schedules. Records tied to ongoing accounts may need to live as long as the account. Records for anonymous visitors who never returned can follow a shorter, fixed period. Whatever you choose, the schedule should be a policy decision someone approved, not whatever the logging tool happened to default to.
Storage, access, and retrieval drills
Store records in a system with access controls, backups, and an audit trail of its own. Consent logs sitting in a marketing tool that half the company can export, edit, or delete will not hold up as evidence. Restrict who can alter retention settings, and log any manual deletions with a reason.
Finally, drill retrieval. Pick a sample record, time how long it takes to produce the full proof for that visitor, and repeat the drill after major site or vendor changes. Teams that drill find broken exports and missing version archives in peacetime. Teams that do not find them during an investigation.
Frequently asked questions
How long should you keep consent records?
For as long as the consent is relied on, plus a further period that covers complaint windows in your markets. Set the exact periods in a written retention schedule by category, apply them automatically, and review the schedule when laws or your processing change.
What should a consent record include?
A timestamp, the categories chosen, the banner and notice version shown, the context it was given in, and an identifier that lets you retrieve that one record. Archive each banner version so the record can be matched to the exact wording the visitor saw.
Should consent records be deleted when a visitor withdraws consent?
Withdrawal stops future processing under that consent, but the record of what was agreed and when is your proof that earlier processing was lawful. Retain the proof under your schedule with restricted access rather than deleting it at withdrawal.
Who should be able to access consent logs?
Only the small group who need them for compliance, support, and audits. Broad access, editing rights, and manual deletion without a logged reason all weaken the logs as evidence and increase the chance of accidental loss.