Cookie Consent Records: How Long to Keep Them and What to Store

Consent is only defensible if you can show it later. What a consent record should contain, how long to keep it, and the mistakes that make records useless.

When a consent question arrives, from a regulator, a partner, or a customer, the banner the visitor saw is long gone. What remains is the record. Stores spend real effort designing banners and almost none thinking about the log those banners produce, until the day someone asks them to prove what a specific visitor agreed to, and when, and under which version of the policy. A consent record is not a count of clicks. It is a small, durable piece of evidence, and building it well is mostly a matter of deciding in advance what it must contain.

What a useful consent record contains

At minimum, a record should tie together who or what consented, what they consented to, and when. In practice that means a timestamp, an identifier for the visitor or session that respects your privacy commitments, the categories accepted or rejected, the version of the banner and policy text shown, and how consent was given, for example an explicit accept click versus a settings save. The version detail is the one stores most often skip, and it matters: agreeing under a banner that listed three categories is a different fact from agreeing under one that listed five.

Store the choices, not just the outcome. A single flag that says consent given cannot show that a visitor accepted analytics but rejected marketing, and granular choice is the entire point of a modern banner. If your reporting only needs totals, aggregate later. The underlying record should keep the category level detail.

How long to keep records

There is no single universal retention period, and anyone who gives you one number for every jurisdiction is guessing. A practical approach has two anchors. Keep records at least as long as the consent they document could be relied on, plus the period in which a question about that consent could realistically be raised. Many stores land on one to three years for the detailed log, reviewed against their legal advice and the markets they sell into. What you should not do is keep everything forever by default. Indefinite retention creates its own privacy problem, because a consent log is itself personal data.

Whatever period you choose, write it down, apply it automatically, and be able to show the deletion working. A retention policy that exists only in a slide is worse than a shorter period that is actually enforced, because the gap between the claim and the practice is what erodes trust in the whole record.

Mistakes that make records useless

The first mistake is logging the banner display instead of the choice. Showing a banner proves nothing about agreement. The second is overwriting history when a visitor changes their preferences. A change should add a new record, not edit the old one, or you lose the ability to show what was true at the time of a past visit or purchase. The third is storing records somewhere nobody can retrieve: an analytics property that samples data, a vendor dashboard you lose when you switch tools, a log that expires in 30 days.

Test retrieval before you need it. Pick a recent visit, and ask your team to produce its consent record within a day. That small drill exposes broken logging, missing version fields, and access problems while the stakes are low. Consent management is often judged as a design task. In the moments that matter, it is a records task, and the stores that fare best are the ones whose boring log was built to be read by a stranger, years later, without help.

Frequently asked questions

What should a cookie consent record include?

A timestamp, a visitor or session identifier, the categories accepted or rejected, the version of the banner and policy shown, and how consent was given. Category level choices and version history are the details most often missing and most often needed.

How long should consent records be kept?

There is no single period for every market. Many stores keep detailed logs for one to three years based on legal advice, covering as long as the consent may be relied on plus the time a question could be raised. Choose a period, document it, and enforce deletion automatically.

Should a consent change overwrite the old record?

No. A new choice should create a new record, preserving the history of what was agreed and when. Overwriting destroys your ability to show what consent was in place at the time of an earlier visit, order, or campaign.

Where should consent records be stored?

Somewhere durable, searchable, and under your control, not only in a sampled analytics tool or a vendor dashboard you would lose on switching. Test that your team can actually retrieve one visitor's record before you ever need it for real.