Consent Records: How Long to Keep Them and Why
Consent logs prove what a visitor agreed to and when. Retention, storage, and deletion rules that keep records useful without hoarding data.
A consent record is evidence: which banner version a visitor saw, what they chose, and when. Kept well, it answers complaints and regulator questions in minutes. Kept forever, in scattered exports nobody owns, it becomes its own liability.
Retention is therefore a decision, not an accident. This guide covers how long consent records earn their keep, what they should contain, and how to delete them on a schedule rather than by panic.
Keep the record that proves the choice
A useful record holds the timestamp, the choices made per purpose, the banner or policy version shown, and a visitor identifier that can be matched if that person asks. Without the version, a timestamp proves a click happened but not what was agreed to.
Store records in one system with controlled access, not in spreadsheet exports on laptops. Evidence that cannot be found, or whose integrity can be questioned, does little work when it is needed.
Set retention from purpose, then automate it
Records need to live at least as long as the processing they justify, plus the period in which a complaint or claim is realistically possible. Beyond that, continued storage is data kept without a job, which privacy rules discourage and breaches punish.
Write the period down, automate deletion or anonymisation at its end, and review the setting when products or laws change. A retention rule that depends on someone remembering an annual tidy up will not survive staff changes.
Deletion requests include consent history
When a visitor exercises deletion rights, their consent records are part of the discussion. Some evidence may need to be kept in minimal form to prove the deletion itself was honoured, which is a narrow, documented exception, not a reason to keep everything.
Rehearse the request end to end: find the person's records, export them for an access request, delete or minimise them for an erasure request. The first real request should not be the first time the team tries.
Related reading
If this topic is useful, these earlier guides go deeper on connected questions: The Best Cookiebot Alternatives for Growing Sites, Consent Banners in Multiple Languages: Getting Localisation Right, and How Long Should Consent Records Be Kept.
Frequently asked questions
What should a consent record contain?
The time of the choice, the purposes accepted or refused, the version of the banner and policy shown, and an identifier that lets the record be found if the visitor asks. The version matters as much as the timestamp.
How long should consent records be kept?
Long enough to cover the processing they justify and a realistic window for complaints or claims, then no longer. The exact period is a documented decision for each business, automated rather than left to memory.
Are consent records deleted when a visitor asks for erasure?
Generally yes, with a narrow exception: a minimal record may be retained to demonstrate that the erasure was carried out, kept restricted and documented. That exception does not preserve the full history.
Why does storage location matter for consent evidence?
Because evidence must be findable and trustworthy. Records scattered across personal drives and old exports cannot be produced reliably or protected properly when a regulator or customer asks.