How long to keep consent records: retention without hoarding

Clock one is the proof clock. Article 7 of the GDPR puts the burden of demonstrating consent on the controller, so while you process data on the basis of a consent given in 2024, you need the record of that consent, who, when, what they were told, what they agreed to, for as long as the processing continues and for a defensible tail afterwards, aligned with limitation periods for complaints and claims in your markets.

Clock two is the freshness clock. Regulators recommend asking again after a period even when consent was never withdrawn: CNIL well known guidance uses six months for cookie consent choices in its recommendations. That is an instruction about the validity of relying on an old choice, not an instruction to delete the record of it at six months. Teams that delete proof on the freshness schedule have obeyed the wrong clock and destroyed their own evidence.

Two clocks that get confused constantly

A proportionate record holds the identifier of the user or device, the timestamp, the purposes granted or refused, the banner or notice version and text shown, and the method of capture. After withdrawal or expiry, most operational value in that record ends. What must survive for accountability is a reduced proof: that a consent existed, its scope, when it ended, and that processing stopped. The granular payload data the consent once authorised follows its own retention rules and mostly should not outlive the consent.

Anonymisation is the honest middle state for analytics about consent itself. Aggregate rates, accept and reject proportions by banner version, survive fine as statistics with no identifiers. If a record cannot justify its identifier, strip the identifier and keep the statistic. Hoarded logs full of identifiers and IP addresses, kept just in case, are a storage limitation finding waiting for its auditor.

What the minimal retained record looks like

When a user withdraws consent, the GDPR says withdrawal does not make past processing unlawful. Your records should mirror that: mark the consent withdrawn, timestamp it, stop the processing it authorised, and retain the proof of the original grant and the withdrawal for the accountability tail. Deleting the whole history on withdrawal feels respectful and destroys the demonstration that you complied while consent stood, and that you stopped when it ended.

Withdrawal changes the record, it does not erase history

Keep reading: Consent Mode default states by region: the setting that decides data before the banner, The reopen link in the footer: the smallest consent feature with the longest memory.

A schedule a real company can run

Downstream copies are where withdrawals go to die. The consent platform updates, the warehouse table does not. Retention design has to include the copies: tag manager records, CRM flags, exported audiences. A schedule that only governs the consent tool governs the smallest copy of the data. Map the copies first, then write periods against the map.

In practice: active consent records retained while consent is relied on. Withdrawn or expired records reduced to minimal proof and kept for a defined accountability period, commonly aligned to the complaint and claim windows your counsel sets for your markets, then deleted on an automated job with a log of the deletion itself. Banner interaction logs without choices, impressions and dismissals, anonymised or deleted on a shorter cycle, since their value is design diagnostics, not legal proof.

Write the schedule down, per record type, with the deletion mechanism named for each, and review it when the banner or the markets change. An unwritten schedule is indistinguishable from hoarding during an audit. A written one, followed, is storage limitation demonstrated, which is the entire regulatory point. Get counsel in your operating markets to set the periods. This is the shape, not their numbers.

Frequently asked questions

Does the six month cookie guidance mean I must delete consent records after six months?

No. The CNIL six month figure is a recommendation about re seeking consent, the freshness of relying on an old choice. Record retention is a separate question governed by your need to demonstrate consent while you rely on it plus a defensible period after. Deleting proof at six months while still processing on that consent would undermine your own accountability.

What should we keep after a user withdraws consent?

A minimal proof record: that consent was given, its scope, when it was withdrawn, and confirmation that processing stopped. The processing the consent authorised must end, and data held only under that consent should be deleted or anonymised per your schedule. The proof itself is retained for the accountability period your counsel sets.

How long should we keep proof of consent after it ends?

There is no single Union wide number. Set the period against the complaint and limitation windows in the markets where you operate, with counsel, and apply it consistently with automated deletion at the end. Indefinite retention just in case is not defensible under storage limitation principles.

Should consent logs include IP addresses?

Only if you can justify them. Many implementations log IPs by default without a purpose. A proportionate record usually needs an identifier, timestamp, purposes, notice version, and capture method. If the IP adds nothing to demonstrating consent in your setup, collecting and retaining it is risk without benefit.