How long to keep consent records (and what to keep)

Two different durations hide behind the question "how long should I keep consent". The first is how long a visitor's choice stays valid before you ask again: about six months is the figure both the CNIL and the ICO give. The second is how long you keep the proof that the choice was made: for as long as you process data on the basis of that consent, and after that only as long as you need it to meet a legal obligation or defend a claim, which is the EDPB's reading of the GDPR. The proof itself should be small: a timestamp, what was chosen, which banner version and text the visitor saw, and a pseudonymous identifier.

Duration 1: how long a choice stays valid

The GDPR sets no time limit on consent. The EDPB's guidelines on consent say so explicitly: there is no specific time limit, the duration depends on the context, the scope of the original consent and the expectations of the data subject, and if the processing changes considerably the original consent is no longer valid. As a best practice the EDPB recommends refreshing consent at appropriate intervals.

For cookies, two authorities have put a number on it. The CNIL's recommendation of September 2020 says that keeping the visitor's choice, consent as well as refusal, for six months is good practice. The ICO's guidance says neither PECR nor the UK GDPR sets a limit, that you should not repeatedly ask people to specify their preferences as a matter of course, and suggests six months as a suitable interval before asking again someone who declined. The ICO also notes that preference cookies often come with default expiries such as 90 days, and asks you to assess whether that default is appropriate and document the decision.

Practical consequence: store the choice in a first-party cookie, keep it for about six months (Cookiequiet's default is 182 days, configurable), and only ask again earlier when your purposes or your tools change, in which case the banner version increases and visitors are asked anew.

Duration 2: how long to keep the proof

Article 7(1) of the GDPR puts the burden on you: "the controller shall be able to demonstrate that the data subject has consented". The EDPB's guidelines spell out the timeline in paragraph 107: as long as the processing activity lasts, the obligation to demonstrate consent exists; after the processing ends, proof of consent should be kept no longer than strictly necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims. The ICO's advice is the same in fewer words: keep the evidence for as long as you are still processing based on the consent.

What that means for cookie consent:

• While the consent is live (the six months above), you must be able to show it.
• Data collected under that consent (analytics, ad attribution) may live longer in your tools; while it does, the proof that it was collected lawfully should exist.
• After that, the retention is a matter of limitation periods for claims and complaints, which vary by country, and of the practical fact that an authority investigating a complaint about last year's banner will ask what visitors saw last year.

Five years covers most of these situations; thirty days does not cover much beyond the current month. Cookiequiet keeps the consent log 30 days on the Free plan, 1 year on Starter and 5 years on Pro, exportable as CSV on Starter and Pro, so that the record outlives the consent it proves.

What to record

The EDPB describes the online case in paragraph 108: a controller could retain information on the session in which consent was expressed, together with documentation of the consent workflow at the time and a copy of the information presented to the data subject. It adds that merely referring to a correct configuration of the website is not sufficient. The ICO's list for consent records is who consented, when, what they were told, how they consented, and whether and when they withdrew.

For a cookie banner, a sufficient record has:

Keep the versioned banner texts and the cookie policy versions alongside, so that a record from eight months ago can be matched to the exact words the visitor saw.

The EDPB also warns that the duty to demonstrate consent should not lead to excessive additional processing: enough data to show the link, no more. Do not store raw IP addresses or names for this purpose.

Records for refusals and for third parties

Record refusals too. They prove that the banner offered a real choice, they justify why no analytics data exists for that visitor, and they let you avoid asking again before six months.

If a partner collects consent on your behalf, or you collect it for a partner, each controller must still be able to prove it. The CNIL's recommendation says a contractual clause by which one party promises to collect valid consent for the other is not enough on its own, and asks that the collecting party make the proof available to the others. The CNIL applied that reasoning on 15 June 2023 when it fined an advertising technology company €40 million, in part because it could not demonstrate that visitors of its partners' websites had consented to its tracker, and its contract clause alone did not guarantee valid consent.

A policy you can write down

• The visitor's choice is stored for 6 months, then asked again.
• The choice is asked again earlier when the banner version changes.
• Each choice is logged with timestamp, choice, categories, banner version, language, country, a random visitor id, a daily-salted IP hash and the user agent.
• Logs are kept 5 years, then deleted.
• Banner texts and policy versions are archived with their dates.
• Logs can be exported on request from the authority or for a complaint.

Write it into your records of processing and your privacy policy's retention section, and the question is answered before anyone asks it.