What is the single most important field in a consent record?

The notice version is the one most often missing and most often decisive. Without it, you can show a choice was recorded but not what wording, purposes, or vendors the choice referred to, which weakens the record badly in a dispute.

How long should consent records be retained?

Tie the period to the relationship length plus the applicable limitation period for claims in your markets, write it into a retention schedule, and apply deletion across every copy, including warehouse exports and backups, when the period ends.

Does a consent banner log prove tags behaved?

No. The log proves the choice as recorded. Proving behaviour needs a production check that tags fired or stayed silent according to that state. Keep evidence of both, and repeat the behaviour check after tag manager changes.

Should rejected consent be stored with the same care as accepted?

Yes. A recorded refusal, with timestamp and version, is what stops a team from re prompting aggressively or accidentally enabling a purpose later. It also demonstrates that refusal was honoured, which regulators treat as part of valid consent design.

Consent Record Retention: How Long to Keep Proof of Opt Out and Opt In

November 2, 2026

Keeping consent records forever is not a strategy and deleting them early is a risk. A practical retention approach: what to keep, in what form, and who can ask for it.

Every consent platform writes a record: who, when, what they were shown, what they chose. Then most stores never think about those records again until one of two bad days arrives. A regulator or a complainant asks the store to prove a specific person's consent from fourteen months ago, or a routine data review discovers the store is holding millions of consent logs tied to identifiers it had no plan for, kept forever because nobody set a retention period. Both days are worse than the afternoon it takes to set a policy.

Retention is a balance between two real obligations. You need records long enough to demonstrate consent for as long as you rely on it, and to answer complaints that arrive after the fact. You also owe data minimisation: personal data kept indefinitely, just in case, is its own compliance problem, and consent logs often contain IP addresses and device details that count as personal data in their own right.

What a usable record contains

A record proves consent only if it can answer five questions: who consented, when, what they were shown at the time, what exactly they agreed to, and how they agreed, banner button, preference toggle, or another mechanism. The version point matters more than teams expect. A record saying a shopper accepted marketing in March proves little if the March banner text and category list cannot be produced. Keep banner versions and category definitions with the records, versioned, or the archive has a hole exactly where an investigator will look.

Test retrieval before you need it. Pick a test consent from last quarter and time how long it takes someone on the team to produce the full record, banner version included. If the answer involves a vendor ticket and a week, your retention is theoretical. The policy should name who can retrieve, through what tool, and in what format a record gets exported when a request arrives.

Setting the period without guessing blindly

Anchor the period to reliance and risk, not to a round number copied from another company's policy. While a consent is active and you are processing on its basis, the record stays. After a consent is withdrawn or the relationship ends, keep the record for the period in which a complaint or claim about that processing could realistically arrive in your jurisdictions, then delete or anonymise. That period differs between the EU, UK, and US state regimes, which is why the policy should be written per regime with counsel, not as one global number invented in a marketing meeting.

Anonymisation is the underused middle path. Aggregated statistics, counts of accepts and declines by month and banner version, can be kept indefinitely for reporting once identifiers are removed. What expires is the link to a person. A store that anonymises on schedule keeps its trend reporting and drops its exposure, and can say both things plainly in its privacy notice.

Deletion has to actually happen

A retention policy that no job enforces is a wish. Schedule the deletion or anonymisation in the consent platform if it supports it, or as a recurring task with an owner and a log entry. Include backups and exports in the thinking: a spreadsheet of consent records exported to a shared drive during a migration can quietly outlive the platform's tidy retention by years, and it will be the copy a breach or a subject request finds.

Review the policy when the stack changes. A new consent platform, a new tag manager setup, or selling into a new jurisdiction all change what records exist and which rules apply to them. Put record retention on the same change checklist as the banner itself, so the archive is designed rather than accumulated.

Frequently asked questions

How long should consent records be kept?

There is no single universal period. Keep them while the consent is relied on, then for a defined period afterwards that matches complaint and limitation windows in the jurisdictions you sell into, set with counsel. After that, delete or anonymise. Indefinite retention by default is a risk, not a safety measure.

What must a consent record include to be useful?

Who consented, when, the banner or notice version shown, the categories or purposes agreed to, and the mechanism used. Without the version shown, the record cannot prove what the person actually agreed to, which is the first thing a regulator or complainant will test.

Are IP addresses in consent logs personal data?

In the EU and UK, yes, IP addresses in logs are generally treated as personal data, which is why consent logs fall under retention and minimisation rules at all. That does not prevent keeping them for a justified period. It does mean forever needs a justification most stores do not have.

What should happen to records when we switch platforms?

Export them in a durable format with banner versions, store them under the same retention policy, and include old exports in the deletion schedule. Migrations are where stray copies appear on shared drives and inboxes. The new platform's retention settings do not govern the spreadsheet someone exported in March.