# Consent Logs: What to Keep, What to Record, and How Long to Keep It

Source: https://consentfence.com/blog/2026-10-13-consent-logs-retention-guide.html

When a regulator or a plaintiff asks how you know a visitor consented, the banner is not evidence. The log is. Consent under GDPR has to be demonstrable, which means your site needs a record that a specific visitor was shown a specific choice and made it. Many sites gather consent carefully and log it carelessly, or not at all, which converts a compliant banner into an unprovable claim.

This guide covers the practical middle ground: the fields a useful consent record contains, how long to keep records without hoarding them, and the storage choices that keep the log an asset instead of a second liability.

## What a consent record should contain

Six fields cover the regulatory core. A pseudonymous visitor identifier, usually the consent cookie ID. A timestamp. The categories or purposes accepted and rejected. The banner and privacy notice version shown, because consent to version three says nothing about version five. The method, banner click, settings save, or continued configuration. And the jurisdiction or banner variant, since the choice offered in California differs from the one offered in France.

Note what is not required: a name, an email, an account. Consent records attach to a browsing identity, not a person, and over-collecting identifiers in the log makes the log itself more sensitive than it needs to be. Record the choice and its context, not the visitor's life story.

## How long to keep consent records

The governing principle is that the record should outlive the reliance. While a consent is active and you are processing data under it, the record must exist. After the consent expires or is withdrawn, you still need the record for the period in which a complaint or claim could plausibly be made about that processing. For most sites that lands at one to three years after lapse, aligned with limitation periods in their main markets.

Indefinite retention is the opposite failure. A consent log is personal data, with storage-limitation duties of its own, and a decade of records about people who last visited in 2019 is a breach surface with no evidentiary value. Set a retention period, automate deletion, and write both into your records of processing. A schedule you can show beats a pile you can search.

## Storage mistakes that hurt

The most common is logging only accepts. A log that records agreement but not refusal cannot prove the banner offered a real choice, and it makes your acceptance rate look fabricated. Log the full interaction: shown, accepted, rejected, customized, withdrawn. Withdrawals matter most of all, because processing that continued after a logged withdrawal is the fact pattern that gets sites fined.

The second mistake is the unretrievable log. Records scattered across a plugin database, an analytics property, and a developer's spreadsheet cannot be produced for one visitor within the response window a regulator expects. Test retrieval quarterly: pick a consent ID, and time how long it takes to produce the complete record. If the answer embarrasses you, fix the plumbing before someone else asks.

## Syncing the log with reality

A log proves a choice was recorded. It does not prove the choice was honored. The audit that matters pairs the log against behavior: sample consent IDs marked rejected and confirm, with a tag inspector, that marketing tags stayed quiet for those sessions. A banner that logs beautifully and fires anyway is worse than no banner, because the log documents that you knew.

Keep the versions straight while you are at it. When the banner copy, categories, or vendor list changes, the version in the log must change with it, and a material change should trigger re-consent where your policy requires. The log, the banner, and the tag behavior are one system. Audit them as one system.

## Frequently asked questions

### What should a consent log record?

A pseudonymous visitor ID, a timestamp, the categories accepted and rejected, the banner and notice version shown, the method of consent, and the banner variant or jurisdiction. Log refusals and withdrawals as carefully as acceptances: a log of only accepts cannot prove a real choice was offered.

### How long should consent records be kept?

At least while the consent is active and relied on, plus a period afterward covering plausible complaints, commonly one to three years after the consent lapses or is withdrawn. Indefinite retention is its own violation, since the log is personal data under storage-limitation rules. Automate deletion on a schedule.

### Is a consent log itself personal data?

Yes. It links choices to an identifiable browsing identity, so it needs access controls, a retention schedule, and a place in your records of processing. Keep identifiers pseudonymous and avoid storing names or emails in the log unless an account relationship genuinely requires it.

### How do you test whether consent logging works?

Two tests. Retrieval: pick a consent ID and produce its complete record quickly, as you would for a regulator. Honor: sample IDs recorded as rejected or withdrawn and verify with a tag inspector that restricted tags did not fire. The log must be both findable and true.

## Get a free consent audit of your website

[Free consent audit](mailto:hello@consentfence.com?subject=Free%20consent%20audit%20-%20consentfence.com)