# Consent receipts: what to store and for how long

Source: https://consentfort.com/blog/2026-11-06-consent-receipts-what-to-store-how-long.html

A consent record that says a visitor consented, with no timestamp, no text version, and no list of purposes, is not a record. It is a claim, and a claim does not survive an audit. GDPR Article 7(1) puts the burden of proof on the controller: when processing is based on consent, the controller must be able to demonstrate that the data subject consented. Demonstrate is a strong word. It means evidence, and evidence means the details of the moment consent was given.

The receipt has five fields, and all five matter. The timestamp, so the record can be placed in time. The text version the visitor saw, so the record proves what was consented to, not what the current banner says. The purposes consented to, each one separately, so a partial consent is recorded as partial. The mechanism, banner, preference centre, or footer link, so the record shows how the choice was made. And an identifier for the visitor that does not itself become a privacy problem, usually a pseudonymous consent ID rather than an email address.

## The text version is the field everyone skips

Missing the consent text version is the most common gap in consent records, and regulators treat it as equivalent to no record at all. The reason is simple: if you cannot prove what the visitor saw, you cannot prove what they consented to. A banner that changes its wording every quarter, with records that do not say which wording was live, is a set of timestamps attached to nothing. Version the banner text, store the version with every record, and keep the old versions so the record can be reconstructed later.

The CNIL's cookie enforcement actions have checked exactly this, systematically, asking whether consent logs included the text version, the timestamp, and the purposes. The fines that followed were not for missing banners. They were for missing evidence, on sites that had banners and thought the banner was the compliance.

## How long to keep the receipt

Keep the record for as long as the processing continues, plus the limitation period for potential enforcement. That is the rule, and it is longer than most teams expect. Deleting the receipt when the visitor withdraws consent is a mistake, because the withdrawal itself is an event that needs a record, and the record of the original consent is what proves the processing before withdrawal was lawful. The receipt survives the withdrawal. What stops is the processing, not the evidence.

Retention is not forever either. A consent record for a visitor who has not returned in years, whose data has been deleted, and whose processing has ended, has no purpose anymore, and keeping it becomes its own problem. Set the retention period in the policy, apply it, and delete on schedule. A record kept without a reason is a liability in the same way a record missing its fields is.

## The export test

The test for a consent receipt system is the export: can you produce, for a given visitor, the timestamp, the text version, the purposes, and the mechanism, in a format an auditor can read? If the answer is a database query and a versioned copy of the banner, the system works. If the answer is a log file and a shrug, it does not, and the fix is in the fields, not in the banner.

Keep reading: [Consent proof timestamps and clock skew](2026-11-04-consent-proof-timestamp-clock-skew.md), [Consent vendor purpose mapping errors](2026-11-04-consent-vendor-purpose-mapping-errors.md).

## Frequently asked questions

### What fields must a consent record contain?

Five: the timestamp, the version of the consent text the visitor saw, the purposes consented to, the mechanism used, and a pseudonymous identifier for the visitor. All five matter, and the text version is the one most often missing.

### Why does the consent text version matter so much?

Because without it you cannot prove what the visitor consented to. Regulators treat a record without the text version as equivalent to no record at all. Version the banner text and store the version with every record.

### Should I delete a consent record when the visitor withdraws?

No. The withdrawal is itself an event that needs a record, and the original consent record proves the processing before withdrawal was lawful. What stops is the processing, not the evidence.

### How long should I keep consent records?

For as long as the processing continues, plus the limitation period for potential enforcement. After that, delete on schedule. A record kept without a reason becomes a liability of its own.