Consent Records Retention: How Long to Keep Proof of Consent
Every consent system creates a second dataset alongside the marketing or analytics data itself: the record of who agreed, to what, when, and through which notice. Teams guard the first dataset carefully and often forget the second, leaving consent logs to grow forever in a forgotten table.
Indefinite retention is not the safe option it feels like. Old consent records contain identifiers, timestamps, and sometimes IP addresses, and keeping them past their purpose creates its own privacy problem. This guide explains how long consent proof needs to live, what should trigger its deletion, and how to document the schedule.
Retention should follow the life of the data the consent covers
Consent proof exists to demonstrate that processing was lawful. While you still hold or use the data a person consented to share, the matching consent record needs to survive; deleting the proof while keeping the data leaves you unable to show your basis for holding it. Once the underlying data is deleted or anonymised, the clock starts: keep the consent record for the window in which the person, a regulator, or a court could plausibly question the processing, which in many places tracks local limitation periods for privacy claims. When that window closes, delete the consent record itself. The schedule should be written per consent type, because a newsletter consent, a cookie consent, and a photo release have very different data lifespans.
What a defensible schedule actually contains
A retention schedule is a short table, not a policy essay. For each consent type it names the record kept, the trigger that starts the retention clock, the retention period after that trigger, and the deletion method. Triggers should be events your systems can detect: consent withdrawn, account closed, data deleted, or campaign ended. Avoid triggers like periodic review with no owner, which in practice means never. The schedule also needs an owner who runs a deletion job or reviews a report at a set interval. Auditors and regulators ask two questions about consent records: can you produce them, and can you show they are deleted on time. A schedule with evidence of both answers is worth more than a long policy nobody follows.
Withdrawals and deletions both need proof that survives carefully
Here is the tension: when someone withdraws consent or asks for erasure, you must stop using their data, yet you may need a minimal record showing you honoured the request, so the person is not accidentally re-added from an old list. The usual solution is a suppression record: a hashed identifier, the request date, and the scope, kept separately from marketing data and used only to prevent re-contact. Suppression records are themselves personal data, so they belong in the retention schedule too, with access limited to the suppression process. What should not survive is the full original profile kept just in case. Erasure means the data goes; the slim proof that it went is a different, smaller thing.
Legal holds pause the schedule, they do not cancel it
When a complaint, dispute, or investigation begins, deleting records on the normal schedule could destroy evidence you are obliged to keep. A legal hold suspends deletion for the specific records in scope, for as long as the matter is live. Holds should be written, narrow, and time bounded: which records, whose request, what matter, and who authorised it. When the matter closes, the hold lifts and the normal schedule resumes, including deletion of anything that was only kept because of the hold. Teams get into trouble at both extremes: deleting through a hold, or treating one hold as a reason to keep everything forever. Documenting the start and end of each hold is what separates a careful retention practice from a growing archive nobody can explain.
Related reading
These earlier guides cover connected questions in more depth: Consent and Smart TV Viewing Data: What Your Television Collects, Consent Records Retention: How Long to Keep Proof of Consent, and Consent in Weather Apps: Location Sharing That Goes Far Beyond the Forecast.
Frequently asked questions
How long should cookie consent records be kept?
A practical rule is to keep them while the consent is relied on, plus a defined period afterwards that reflects local complaint and limitation windows. Many organisations use one to three years after the consent lapses or is withdrawn. The key is a written, consistently applied period.
Should consent records be deleted when a customer leaves?
The full record can be reduced once the underlying data is gone and the post-use window has passed. Until then, keep the core proof: who, what, when, and which notice version. A minimal suppression entry may be kept separately to prevent accidental re-contact.
What happens to consent records during a legal dispute?
A legal hold pauses scheduled deletion for the records relevant to the dispute. The hold should be documented, limited in scope, and lifted when the matter closes, after which normal deletion resumes.
Who should own the consent retention schedule?
One named owner, usually in privacy, compliance, or data operations, should own the schedule and evidence that deletions happen. Shared ownership with no named person usually means deletions quietly stop happening.