Retention depends on your lawful basis and product policy. OptinStack keeps synced consent records for twelve (12) months on standard plans, with automatic deletion after the window. export records, or use Enterprise Consent Forwarding if you need a longer archive you control. Confirm legal retention with counsel for your markets.
What a consent record is
A consent record is a stored entry that evidences a single visitor's consent decision. It is the artifact you produce when a regulator, a customer, or your own auditor asks: did this person agree, and to what?
GDPR Article 7(1) is explicit: where processing is based on consent, the controller shall be able to demonstrate that the data subject consented. The burden of proof is on you, not the visitor. The UK ICO's consent guidance reinforces that records must show what was shown, when, and how the choice was made.
What each record should capture
A usable record is more than a yes or no. It captures enough context to reconstruct what happened.
| Field | Why it matters |
|---|---|
| Timestamp | When the choice was made, in an immutable order |
| Identifier | A pseudonymous ID tying the record to the visitor without extra personal data |
| Decision per category | Which of necessary, analytics, marketing, preferences were accepted or rejected |
| Banner version | The exact text and layout shown, so old choices stay interpretable |
| Mechanism | How consent was given: accept-all, granular toggle, GPC signal, etc. |
| Policy links | The privacy and cookie policy versions in effect at the time |
Withdrawal is part of the record
GDPR Article 7(3) requires that withdrawal be as easy as giving consent, and that it does not affect the lawfulness of processing done before. A good record therefore tracks the full history, not just the latest choice. If a visitor accepts on Monday and withdraws on Wednesday, both events are stored, time-stamped, and the enforcement follows the most recent one.
Why an audit trail matters
A single latest-state record tells you what a visitor currently consents to. An audit trail tells you the story. Regulators and internal reviewers often ask for the timeline: when consent was given, changed, or withdrawn, and which version of the banner was shown at each step, without the trail, you can prove the current state but not how you got there.
If a visitor disputes a consent claim and you can only show a current boolean, you have not demonstrated consent. You need the timestamp, the mechanism, and the banner version that were in effect when the choice was made.
Retention depends on your lawful basis and product policy. OptinStack keeps synced consent records for twelve (12) months on standard plans, with automatic deletion after the window. export records, or use Enterprise Consent Forwarding if you need a longer archive you control. Confirm legal retention with counsel for your markets.
Retention is a balance. You keep records long enough to prove consent for the period you processed the data, but not indefinitely, because holding personal data beyond its purpose violates the data minimisation principle. The exact window depends on your jurisdiction and your data retention policy, but the safe approach is to tie consent record retention to the lifetime of the processing it justified, then delete.
Consent records create evidence designed to support accountability and audit workflows, but do not by themselves prove legal compliance. Capture the timestamp, the choice, the mechanism, and the banner version, keep the full history, and export them when an audit asks. Done well, the record is the thing that makes your consent trustworthy both to visitors and to regulators.
Materially reviewed July 11, 2026. Regulatory and implementation guidance is general information, not legal advice.
Primary sources
Was this post helpful?
Put consent in front of your trackers
OptinStack pairs a first-layer consent banner with enforcement that respects what each visitor chose, plus consent evidence. Create a free account and activate one production hostname; upgrade when you need more design, exports, capacity, or regional controls.
Related posts
Consent enforcement: blocking vs releasing scripts by category
What consent enforcement is, how trackers get gated by category, the common failure modes like load-order gaps, and how to verify the page actually obeys each visitor's choice.
What is Global Privacy Control (GPC) and how to respect it
What Global Privacy Control is, how the Sec-GPC header and navigator.globalPrivacyControl signal work, what California and Colorado require, and how to honor it before trackers run.
What is a consent management platform (CMP), and do you need one?
What a consent management platform is, the components that make it work, the fixed consent categories, and how to tell whether your site needs one.
What is PII (personally identifiable information)?
What actually counts as PII, how it differs from personal data under the GDPR, and why the distinction matters for the trackers running on your site.