How Long Should Consent Records Be Kept

October 23, 2026

Consent records prove choices were real, but keeping them forever carries its own risk. A practical approach to retention periods for consent data.

Every consent record is personal data about a persons choices, kept to prove those choices happened. That dual nature creates the retention question: delete too early and the store cannot evidence consent it relied on. Keep forever and the store holds personal data with no remaining purpose, which is its own compliance problem.

There is no single mandated number that fits every store, but there is a defensible way to choose one. This guide covers what the record must outlive, what shortens or lengthens the period, and how to document the decision.

The record must outlive the reliance

As a floor, a consent record should be kept at least as long as the store acts on that consent, plus the period during which the consent could realistically be questioned. Deleting the record while the tracking it authorised still runs leaves the store asserting a consent it cannot show.

When a visitor withdraws consent or a customer relationship ends, the clock changes rather than stops. The record of the withdrawn consent is exactly what evidences that processing after that date should have ceased.

Match retention to the record type

Not all consent artefacts age alike. The individual choice record, the banner version and wording shown, and the configuration snapshot each support different questions, and each can carry its own period, provided the set still reconstructs what a given visitor saw and chose.

Version artefacts often deserve the longest keeping, because they are small, not personal in themselves, and are the piece stores most often discover missing when an old consent is challenged.

Write the period down as policy

A retention period that exists only as a vendors default setting is not a policy. The chosen periods, the reasoning, and the deletion method should be written into the stores privacy documentation, owned by a named role, and reviewed when the consent setup changes.

Deletion must actually happen: scheduled, verified, and covering backups and exports, not only the live console. A policy that promises deletion the systems never perform is worse than a longer honest period.

Expect the question to arrive late

Consent questions often surface years after the choice, attached to a complaint, an audit, or a transaction due diligence. The retention decision made today is really a decision about what evidence will exist on that future date.

That is the balancing test in one line: keep records long enough that a legitimate question can be answered, and not so long that the store is warehousing personal data nobody can justify. Documenting that reasoning is most of the defence.

Frequently asked questions

Is there a legally fixed retention period for consent records?

No single period fits all stores and jurisdictions. The defensible approach is a documented period tied to how long the consent is relied on and how long it could be questioned, reviewed with counsel for your situation.

Can consent records be deleted when a customer leaves?

Not immediately. The record evidences what was consented to and when it was withdrawn, which is needed precisely after the relationship ends. Retention should run for a defined period past the end of reliance.

Why keep banner versions longer than individual records?

Because a challenged consent turns on what the visitor was shown. Wording and configuration versions are small, impersonal, and the piece most often missing when it is needed.

What makes a retention policy credible?

That it is written, owned, and actually executed, including deletions in backups and exports. A shorter period honestly enforced beats a perfect policy the systems ignore.