# Consent records and audit trails: why you need them

> What a consent record is, what it should capture, how long to keep it, and why an audit trail of every choice is the part teams most often skip. Sourced from GDPR Article 7 and ICO guidance.

Author: OptinStack Team  
Published: 2026-06-27  
Page: https://optinstack.com/blog/consent-records-and-audit-trails  
Markdown: https://optinstack.com/llms.md/blog/consent-records-and-audit-trails

Retention depends on your lawful basis and product policy\. OptinStack keeps synced consent records for twelve \(12\) months on standard plans, with automatic deletion after the window\. export records, or use Enterprise Consent Forwarding if you need a longer archive you control\. Confirm legal retention with counsel for your markets\.

## What a consent record is

A consent record is a stored entry that evidences a single visitor's consent decision\. It is the artifact you produce when a regulator, a customer, or your own auditor asks: did this person agree, and to what?

> **Info:** GDPR Article 7(1) is explicit: where processing is based on consent, the controller shall be able to demonstrate that the data subject consented. The burden of proof is on you, not the visitor. The UK ICO's consent guidance reinforces that records must show what was shown, when, and how the choice was made.

## What each record should capture

A usable record is more than a yes or no\. It captures enough context to reconstruct what happened\.

*What a complete consent record should contain*

| Field | Why it matters |
| --- | --- |
| Timestamp | When the choice was made, in an immutable order |
| Identifier | A pseudonymous ID tying the record to the visitor without extra personal data |
| Decision per category | Which of necessary, analytics, marketing, preferences were accepted or rejected |
| Banner version | The exact text and layout shown, so old choices stay interpretable |
| Mechanism | How consent was given: accept-all, granular toggle, GPC signal, etc. |
| Policy links | The privacy and cookie policy versions in effect at the time |

## Withdrawal is part of the record

GDPR Article 7\(3\) requires that withdrawal be as easy as giving consent, and that it does not affect the lawfulness of processing done before\. A good record therefore tracks the full history, not just the latest choice\. If a visitor accepts on Monday and withdraws on Wednesday, both events are stored, time\-stamped, and the enforcement follows the most recent one\.

## Why an audit trail matters

A single latest\-state record tells you what a visitor currently consents to\. An audit trail tells you the story\. Regulators and internal reviewers often ask for the timeline: when consent was given, changed, or withdrawn, and which version of the banner was shown at each step, without the trail, you can prove the current state but not how you got there\.

> **Warning:** If a visitor disputes a consent claim and you can only show a current boolean, you have not demonstrated consent. You need the timestamp, the mechanism, and the banner version that were in effect when the choice was made.

## Retention depends on your lawful basis and product policy\. OptinStack keeps synced consent records for twelve \(12\) months on standard plans, with automatic deletion after the window\. export records, or use Enterprise Consent Forwarding if you need a longer archive you control\. Confirm legal retention with counsel for your markets\.

Retention is a balance\. You keep records long enough to prove consent for the period you processed the data, but not indefinitely, because holding personal data beyond its purpose violates the data minimisation principle\. The exact window depends on your jurisdiction and your data retention policy, but the safe approach is to tie consent record retention to the lifetime of the processing it justified, then delete\.

Consent records create evidence designed to support accountability and audit workflows, but do not by themselves prove legal compliance\. Capture the timestamp, the choice, the mechanism, and the banner version, keep the full history, and export them when an audit asks\. Done well, the record is the thing that makes your consent trustworthy both to visitors and to regulators\.