When a regulator or a plaintiff asks you to prove consent, 'the banner was live' is not evidence. A consent receipt is the record that answers: who, when, what version of the notice, and which choices. Retention is the hard part.
Consent has an unusual property among legal bases: you must be able to demonstrate it. Not assert it, demonstrate it. The demonstration lives or dies on records most teams generate accidentally, store inconsistently, and delete on a schedule nobody chose for this purpose.
What a receipt must contain
Five elements make a receipt worth keeping: who consented (the best identifier you have, from account ID down to a pseudonymous cookie ID), when, what they were shown (the exact notice text and policy version, not today's version), what they chose per category, and the mechanism, banner, settings page, or checkout, that captured it.
Versioning is where most records fail. Teams store the choice but overwrite the notice text with every redesign, so two years later they hold a yes they cannot reconstruct the question for. Snapshot the notice and the category definitions with the receipt, or store immutable version IDs that resolve to archived text.
Where receipts should live
Consent platform vendors store receipts in their systems, which is convenient and a dependency. Confirm you can export them, in bulk, in a usable format, on a timeline that suits an inquiry rather than the vendor's roadmap. A receipt you cannot retrieve is a rumor.
For account holders, tie consent state to the account record so preferences survive devices and so a withdrawal propagates. For anonymous visitors, the cookie ID is the thread; when it expires, the receipt outlives its subject, which is fine for evidence and must still follow your retention schedule.
Retention: the genuinely hard part
The floor is set by accountability: keep receipts while the processing they authorize continues, because an inquiry can arrive at any point in that window. The tail is set by limitation periods for regulatory action and civil claims in your markets, which run to years, not months. Most defensible schedules land on the life of the relationship plus a fixed tail, reviewed with counsel.
The counter-pressure is storage limitation: keeping personal data forever 'just in case' is its own violation. Pseudonymize where you can; a receipt needs to prove a choice was made and what it was, and after the tail it needs to prove nothing at all, which is when it should go.
Withdrawal records matter as much
A withdrawal is also a receipt-worthy event: when it happened, what it covered, and when your systems honored it. The gap between withdrawal and honoring is the fact pattern in real enforcement: the visitor said no on Tuesday and the tags kept firing until the next deploy.
Test the propagation, not just the capture. Change a choice in your own banner, then verify the tag behavior, the analytics stream, and the marketing platforms reflect it within your stated window. Your receipts say what the visitor chose; your systems should be able to say what they did about it.
Related reading
These earlier guides go deeper on connected questions: Consent and Video Embeds: What Loads Before a Visitor Agrees Embedded videos often load trackers, cookies, and fingerprinting scripts before any consent choice. This guide covers two click solutions, facades, and what a compliant embed looks like., Consent and Social Login: What the Buttons Collect Before Sign In Social login buttons phone home before a visitor clicks them, loading trackers from the network on a page the visitor may never use to sign in. This guide covers what loads and how to gate it., and Newsletter Signup Tracking and Consent: What Fires Before the Form Is Sent Newsletter forms carry analytics, anti spam tools, and advertising pixels that can fire on page load or keystroke. Consent should govern those tools, not just the email subscription itself..
Frequently asked questions
What is a consent receipt?
It is the evidentiary record of a consent interaction: who, when, which version of the notice, which categories were accepted or rejected, and how the choice was captured. It is what turns 'we had a banner' into demonstrable consent.
How long should consent records be kept?
At minimum while the processing continues, plus a tail covering limitation periods for claims and regulatory action in your markets. Set the schedule with counsel and apply it; indefinite retention creates its own compliance problem.
Do we need to store the exact banner text?
You need to reconstruct what the visitor agreed to, which means the notice and category definitions as they stood at that moment. Immutable versioning or snapshots both work; overwriting the text with redesigns does not.
What should happen when a visitor withdraws consent?
Record the withdrawal with the same care as the grant, and honor it across tags, analytics, and marketing systems within a stated window. Then be able to show both records and the propagation when asked.