Consent Records: How Long to Keep Them and What They Must Prove

A regulator asks a simple question: prove this user consented. The answer is a record, and most sites either do not have one or have one that proves nothing: a timestamp with no version, a yes with no purposes, a cookie with no CMP behind it. The record is the consent, as far as the law is concerned, and a thin record is the same as no record.

What the law actually requires

GDPR Article 7(1) puts the burden on the controller: where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented. The regulation sets no retention period, which is the part teams get wrong in both directions. There is no rule that says delete consent records after a year, and there is no rule that says keep them forever. The record has to exist for as long as the processing it authorizes continues, plus a defensible period after, long enough to answer a complaint or an investigation about that processing.

The record also has to be specific. A timestamp alone proves someone clicked something at some time. It does not prove what they were shown, what they agreed to, or which CMP recorded it. Regulators and courts look for the same elements every time: who consented, when, to what, and on the basis of what information. A record that cannot answer all four is a record that will not survive the question it exists to answer.

The five fields every record needs

First, the timestamp, with timezone, of the consent decision, and the timestamp of any later change, because consent is a state that changes and the record has to show the change. Second, the identity of the user, or at least the identifier the CMP used: a cookie id, a device id, or an account id, something that ties the record to a person rather than to a page view. Third, the exact purposes consented to, by purpose id, not by a vague yes, because a yes to analytics is not a yes to marketing and the record has to show the difference.

Fourth, the version of the notice and the CMP that recorded it: the privacy notice version, the banner text version, the CMP id and version, and the vendor list version for TCF sites. A consent given to version 3 of a notice is not consent to version 4, and the record has to say which one the user saw. Fifth, the method: banner, preference center, or account setting, and whether it was an explicit action or a default. A record that says accepted without saying how is a record that cannot distinguish consent from a pre-ticked box. For the banner that collects the record, see Auditing Consent: Banner Translations and Language Mismatch.

How long, in practice

Keep the record for the duration of the processing it authorizes, plus the period during which a complaint could still be made about that processing. In practice that means years, not months, for most sites, because a user can complain about processing that happened two years ago and the regulator will ask for the record from then. The exact number depends on your jurisdiction and your limitation periods, and it is a question for counsel, not for a blog post. What is not a question for counsel is the principle: the record outlives the cookie.

Two operational rules follow. Do not tie record retention to cookie expiry: a consent cookie that expires after six months does not erase the obligation to prove the consent it recorded, and the record should live in your own store, not only in the CMP. And do not keep the record in the same place as the data it authorizes without access controls, because the record itself is personal data, and it needs the same protection as the rest. The retention question for the cookie itself is Why Your Consent Banner Reappears: Cookie Expiry and Domain.

Frequently asked questions

How long should I keep consent records?

For the duration of the processing the consent authorizes, plus a defensible period after, long enough to answer a complaint or investigation about that processing. In practice that means years, not months. The exact period depends on your jurisdiction and limitation periods.

Does GDPR set a retention period for consent records?

No. GDPR Article 7(1) requires the controller to be able to demonstrate consent, but it sets no fixed period. There is no rule to delete after a year and no rule to keep forever.

What must a consent record contain?

Who consented, when, to which purposes by id, on the basis of which notice and CMP version, and by what method. A timestamp alone proves almost nothing.

Does cookie expiry end the retention obligation?

No. A consent cookie that expires after six months does not erase the obligation to prove the consent it recorded. The record should live in your own store, not only in the CMP.