Consent Records: How Long to Keep Proof, and What to Keep
A visitor complains that your site tracked them without consent. The regulator asks for the record. You open the CMP dashboard and find a log entry that says a user accepted, with no timestamp, no record of what the banner showed, and no way to tie the entry to the complaint. That log entry is worthless, and the banner that produced it was theater. Consent records are the part of compliance that only matters when something goes wrong, which is exactly when they have to be complete.
The GDPR is blunt about this. Article 7 requires the controller to be able to demonstrate that consent was given, and Recital 42 ties valid consent to a record of what the person was told. A banner that collects consent and keeps no usable record has done half the job.
What a record has to contain
Four things, minimum. The choice itself, per purpose and per vendor where the banner offers that granularity. The version of the banner and the privacy notice the visitor saw, because a consent given to version 3 of your purposes is not consent to version 4. The timestamp, with timezone, so the record can be placed against a complaint date. And an identifier that ties the record to the visitor without storing more personal data than necessary, usually a pseudonymous consent ID rather than an email address.
The TCF consent string is a useful part of this, not the whole of it. The string encodes which vendors and purposes were granted, and it lives in the EUCONSENT-V2 cookie. But a string alone does not record what the banner displayed, and the Belgian DPA's 2022 ruling against the TCF turned partly on whether consent obtained through a list of 900-plus vendors could ever be informed. Keep the string and keep the banner version it was collected under.
How long to keep it
There is no single retention period in the GDPR, which is why this question gets vague answers. The practical rule is to keep records for as long as a complaint could plausibly arrive, plus the limitation period for enforcement in your jurisdiction. Most practitioners keep consent records for the life of the processing plus three to six years, and some keep them for the life of the user relationship. Deleting them early saves storage and creates a gap you cannot fill later.
Retention has to be a policy, not a habit. Write down the period, the reason for it, and the deletion process, and apply it to the consent log the same way you apply it to other records. A log that nobody ever deletes is a liability in the other direction: personal data held without a purpose is its own violation.
The test that finds the gaps
File a test complaint against your own site. Pick a date, a browser, and a choice, then try to reconstruct it from the records alone. Can you find the entry. Does it show the purposes granted. Does it show the banner version. Can you tell whether the visitor later withdrew consent, and when. If any answer is no, the record is incomplete, and the fix is in the CMP configuration, not in the banner copy.
Check withdrawal specifically, because that is where most records break. TCF 2.2 tightened the requirement that withdrawing consent be as easy as giving it, and a log that records grants but not withdrawals tells a story that stops halfway. The withdrawal entry matters as much as the grant, and it has to be as easy to find.
Keep reading: The Best OneTrust Alternatives for 2026, Test the Denied State. That Is Where Consent Actually Lives., and One Brand, Several Domains: Keeping Consent State Coherent Across Subdomains cover the nearby cases in this series.
Frequently asked questions
What must a consent record contain?
The choice per purpose and vendor, the version of the banner and privacy notice shown, a timestamp with timezone, and a pseudonymous identifier tying the record to the visitor. The TCF consent string covers the choice; the banner version has to be recorded separately.
How long should I keep consent records?
There is no single GDPR retention period. Most practitioners keep them for the life of the processing plus three to six years. Write the period into a retention policy instead of letting the log grow forever or deleting it early.
Is the TCF consent string enough as a record?
No. The string encodes which vendors and purposes were granted, but it does not record what the banner displayed or which policy version was live. Keep the string and the banner version together.
Do I need to record consent withdrawals too?
Yes. A log that records grants but not withdrawals tells half the story. Withdrawal has to be as easy to give as consent, and the withdrawal entry has to be as easy to find as the grant.