Two failure modes sit at opposite ends of the same filing cabinet. One team purges consent logs after a year and cannot prove permission for a list it still mails. Another keeps every log, IP address, and user agent string forever, just in case, creating the largest personal data store in the building.
Retention is a decision with numbers in it. Make it once, write it down, and automate it.
What a consent record needs to prove anything
At minimum: who, when, what they were told, and how they agreed. In practice that is an identifier like an email address, a timestamp, the wording or version of the notice shown, and the mechanism, form, banner version, or double opt in confirmation.
IP address and user agent are supporting evidence, useful in a dispute, and also the parts with the weakest case for indefinite storage. Many retention schedules keep the core record longer than the technical metadata, and that split is a defensible, deliberate choice worth documenting.
Anchor the period to the relationship, then add a tail
While someone is subscribed, a customer, or otherwise in the relationship the consent supports, the record's purpose is alive. When the relationship ends, start a tail period sized to your realistic complaint and limitation windows, commonly a small number of years, then delete or irreversibly anonymise.
The exact tail is a jurisdiction and sector question, which is why it belongs in a written schedule reviewed by whoever advises you on privacy, not in a platform default. A tag manager or consent tool deleting logs at 12 or 13 months by default is a product setting, not a legal analysis of your situation.
Deletion must include the boring copies
Backups, exports, the spreadsheet someone downloaded for an audit two years ago, the analytics property that received consent IDs as event parameters. A retention schedule that only covers the main database is theatre.
List every place consent records replicate, assign each a deletion or anonymisation method, and test the ugliest one, usually backups, against a real restore. If deletion from backups is handled by expiry rather than surgery, write that down with the expiry window. Written honesty beats quiet impossibility.
Anonymisation done properly still leaves value
Aggregated statistics, consent rates by banner version, accept and reject percentages by month, can be kept indefinitely once they no longer identify anyone. That trend data is genuinely useful for proving a programme existed and worked, without keeping a single person's record to do it.
Check anonymisation for small group leaks: a version tested on twelve people is not anonymous just because names were removed. Suppress tiny cohorts, keep the aggregates coarse, and the statistics stay both useful and safe.
Related reading
These earlier guides go deeper on connected questions: Cookie Consent on Mobile: Designing a Banner That Fits a Small Screen Desktop banners pasted onto phones cover half the content and train people to tap anything. Mobile specific consent design: size, thumb reach, equal choices, and reading order., Consent for Pop Ups and Lead Magnets: The Signup Nobody Reads A lead magnet signup bundles consent decisions into one hurried click. Separating marketing consent from the download, writing the line people actually see, and keeping the evidence tidy., and SMS Marketing Consent: Keeping Proof That Survives a Complaint Text message marketing runs on stricter consent rules than email in many markets. What proof to capture at signup, how double opt in helps, and records that answer a complaint..
Frequently asked questions
How long should consent records be kept?
For the duration of the relationship they authorise, plus a defined tail period after it ends to handle complaints and claims. The tail length depends on jurisdiction and sector and should be set in a written schedule, not left to a tool's default.
Can I keep consent logs forever to be safe?
Keeping everything forever conflicts with storage limitation principles in GDPR style laws: personal data should not be kept longer than needed for its purpose. Indefinite logs with IP addresses become a risk in themselves, especially in a breach.
What fields does a consent record need?
Who consented, when, what wording or notice version they saw, and the mechanism used to agree. Technical metadata like IP address can support a dispute but may follow a shorter retention period than the core record.
Do backups have to be deleted too?
They have to be addressed in the schedule. Many organisations delete from backups by expiry cycle and document that window. The unacceptable position is a schedule silent about backups, exports, and analytics copies where consent data also lives.