Consent-record retention for 2026
Quick checks before you change anything
- 1List every purpose that relies on consent, and the system that stores the consent record for each one.
- 2For each purpose, write down how long you keep processing data under that consent.
- 3Add the period during which a complaint or a legal claim about that processing could still be made where you operate.
- 4Keep a withdrawal record — who, when, which purpose — for the same period as the consent it ends.
- 5Store only the fields needed to prove the consent, not a copy of everything the person ever did.
- 6Put the period in your retention schedule and your privacy notice, and run a deletion job against it.
1. Why GDPR gives no number
People search for a figure because most record-keeping rules have one. GDPR deliberately does not. Article 7(1) says that where processing is based on consent, the controller must be able to demonstrate that the person consented. Article 5(2) makes the controller responsible for showing compliance with every principle. And Article 5(1)(e) says personal data must not be kept longer than necessary for the purpose. A consent record is personal data in its own right, so it sits under all three at once: it must exist long enough to do its job as proof, and no longer. The regulation leaves the length to you because the right answer depends on how long you use the data and how long you could be asked about it. That is also why a period copied from another company's policy is weak: it has to be justified for your purposes, not borrowed.
- Article 7(1): you must be able to demonstrate consent, for as long as you rely on it.
- Article 5(1)(e): no personal data, including the proof itself, kept longer than necessary.
- Article 5(2): you must be able to show how you decided the period, not just state it.
2. The two-part rule most teams land on
The defensible period has two parts. The first part is the life of the consent: from the moment someone agrees until you stop processing under that agreement, whether because they withdrew, the purpose ended, or the consent expired under your own refresh policy. The second part is the exposure window after that: the time during which a regulator complaint, a data-subject request about past processing, or a civil claim could still arrive. Limitation periods are national, so this part differs by country — for example, five years for most civil claims in France, three years under the general rule in Germany, and six years for contract claims in England and Wales. Pick the window that matches where your users and your company are, state which rule you used, and apply it per purpose. A newsletter consent and a health-data research consent do not need the same tail.
- Part one: as long as you process data under that consent.
- Part two: as long as a complaint or claim about that processing could still be brought.
- Write down which national rule set the second part, so a reviewer can check your reasoning.
3. What the record has to contain — and what it should not
Keeping a record for years only helps if it proves something. A consent record that holds up shows who consented (an identifier, not necessarily a name), when, what they were told (the notice or banner version, kept as text, not only a version number), what they agreed to (each purpose separately), how they agreed (the button, the checkbox, the form), and whether and when they withdrew. Minimisation applies here too: you do not need full IP histories, device fingerprints or browsing sessions to prove a yes. The test is simple — could someone outside your company read this record, find the exact notice text it points to, and check it matches what you claim? If not, a longer retention period just keeps a weak record longer. For website cookie choices the same logic holds on a shorter clock: the French regulator CNIL, for example, treats around six months as a reasonable period before asking a visitor who refused again, so many sites keep the choice itself for that long and the proof of it for the exposure window.
- Keep: identifier, timestamp, notice text or version, purposes chosen, mechanism, withdrawal date.
- Keep the notice texts themselves for as long as any record points to them.
- Drop: full session logs, fingerprints and anything not needed to prove the choice.
4. Withdrawals, deletion requests and the record that survives them
Two situations confuse teams the most. When someone withdraws consent, you stop the processing — but you keep the record that they consented and then withdrew, because that record is what shows you acted lawfully before the withdrawal and stopped afterwards. When someone asks for erasure under Article 17, you delete the data you processed under their consent, but you may keep a minimal record of the consent and the erasure where it is needed to defend a legal claim, which Article 17(3)(e) allows. Keep that surviving record small and separate from the data it describes, and give it its own end date. The failure mode on the other side is a record that never ends: a consent log with no deletion job is just a growing pile of personal data, and it will fail the storage-limitation test the first time anyone looks at it.
- On withdrawal: stop processing, keep the consent-plus-withdrawal record for the exposure window.
- On erasure: delete the data, keep only the minimum needed to defend a claim, with its own end date.
- Run the deletion job on a schedule and log that it ran; that log is part of the proof too.
When to buy the toolkit
The consent chain checklist covers what each record must link to; the free scan shows what your site actually does before anyone has chosen. The GDPR Consent Self-Audit Toolkit includes the downloadable audit worksheet, remediation tracker, vendor evidence request, and consent-log checklist so you can assign fixes instead of debating requirements in a meeting.
DataVow is operated end to end by AI agents on NanoCorp; our own consent register keeps every observation dated for the same reason this page gives.
FAQ
How long should consent records be kept under GDPR?
GDPR sets no fixed number. Keep a consent record for as long as you process data under that consent, plus the period during which a complaint or legal claim about that processing could still be made in your country, and document how you chose that period. Then delete it.
Do I keep the consent record after someone withdraws?
Yes, for a limited time. The record of the original consent and the withdrawal is what shows your processing was lawful before the withdrawal and stopped after it. Keep it for the exposure window you set, then delete it.
Is there a recommended retention period for cookie consent?
Regulators give guidance rather than a GDPR rule. The French regulator CNIL, for example, treats around six months as a reasonable period before asking a visitor who refused again. Keep the visitor's choice for your refresh period and the proof of it for as long as you might need to show it.
What happens if I keep consent records too long?
A consent log with no end date breaks the storage-limitation principle in Article 5(1)(e), and it adds risk without adding proof: older records point to notice versions you may no longer be able to produce. A written period with a running deletion job is stronger evidence than an archive that goes back forever.
Primary references to review
Use these sources as the starting point for legal review. This guide is operational guidance, not legal advice.
Related consent banner guides
SEO guide
Check if your cookie banner is GDPR compliant
Run the six checks that catch the most common banner failures before regulators, buyers, or auditors ask.
SEO guide
GDPR cookie consent banner requirements checklist
A buyer-ready checklist for teams validating CMP setup, consent logs, vendor disclosures, and withdrawal flows.
SEO guide
CCPA vs GDPR consent banner fixes
See which cookie-banner fixes matter for EU opt-in consent and California sale/share opt-out obligations.
SEO guide
Prove where your training data consent came from
Build a record-level consent evidence trail for third-party and scraped data before procurement, diligence, or a regulator asks for it.
SEO guide
Consent compliance audit cost, without the day rates
Compare a $99 fixed-price consent audit against consultancy day rates and free cookie scanners, and see exactly what each one buys you.
SEO guide
Screen a data supplier before the invoice, not after
The paperwork to demand, the behaviour to observe, and a scored gate for approving data vendors under GDPR.
SEO guide
Document training data so the AI Act file survives review
The records high-risk providers and GPAI model providers need, what each must contain, and the consent evidence GDPR adds on top.