Consent Records When You Migrate Platforms or Change Consent Tools
Migrations move products, orders, and customers, and quietly abandon consent records in the old tool. Why those records need a migration plan of their own, and what to export before you switch.
A platform migration checklist runs to hundreds of items, and consent records are rarely one of them. The store moves, the new consent tool starts collecting fresh choices, and the history, who agreed to what, under which wording, and when, stays behind in a tool the business stops paying for. Months later, a complaint or an audit asks for proof of consent that the store used to have.
Consent records are business records with retention duties, not vendor exhaust. A short migration step, done before the old tool is cancelled, protects the store through the whole transition.
What exactly needs to survive the move
For each consent record: the visitor or customer identifier it can be tied to, the choices made, the timestamp, and the version of the banner and policy wording in force at the time. Exports that keep choices but drop the wording version lose the part that proves what the person actually agreed to. Before switching tools, run a full export, open it, and confirm the fields are really there, not just promised in a settings page.
Hold the old tool until the export is verified
Sequence matters. Export first, verify the file, and only then cancel the old subscription and remove its scripts. Vendors purge data after cancellation on their own schedules, and a store that cancels in the excitement of launch day may find the records gone when it goes back for them. Keep the export with your other compliance records, in a place that survives staff changes, with a note of where it came from and when.
Choices must carry over, not just history
A returning customer who rejected marketing cookies on the old platform should not be treated as a fresh unknown on the new one and re-bannered into a different default. Where identifiers allow, import current consent states into the new tool so existing choices are honored from the first visit. Where they cannot be carried, say so in the migration plan and expect a wave of re-prompts, rather than discovering them as a complaint spike after launch.
Test consent on the new stack like a launch feature
After migration, test the whole consent path on the new platform with fresh visits: banner appears, choices save, trackers obey them, records land in the new tool correctly. Migrations break consent quietly through tag manager changes and leftover scripts from the old tool firing alongside the new one. A store running two consent systems at once has, in practice, none that it can fully stand behind.
Related reading
If this topic is useful, these earlier guides go deeper on connected questions: Cookie Consent for Age Verification and Gated Content, Cookie Banner Design Mistakes That Lower Consent and Break Trust, and Cookiebot Alternatives Compared Side by Side.
Frequently asked questions
What consent data should be exported before switching tools?
The full record set: identifiers, the choices each visitor made, timestamps, and the banner and policy versions in force. Verify the export contains those fields before cancelling the old tool, because vendors purge data after accounts close.
Do old consent choices have to be honored after a migration?
Yes, where they can be identified. A customer who rejected marketing cookies should not silently become a new, unconsented visitor because the store changed platforms. Import current states into the new tool when possible.
How long should exported consent records be kept?
At least as long as the consent they document is relied on, and in line with the store's record retention policy for compliance material. Treat the export as a legal record, not a temporary migration file to delete after launch.
What breaks consent most often in a migration?
Leftover scripts from the old tool firing beside the new one, and tag manager rules that assume the old consent signals. A fresh visit test that checks which trackers fire in each consent state catches both before shoppers do.