How Long Should Consent Records Be Kept? Building a Retention Schedule
The television used to be the one screen that did not watch back. Now a smart TV can recognise what is on screen, a scene, a channel, a game, a home video played from a laptop, and report viewing habits to the manufacturer and its data partners. The agreement for this was technically obtained, during setup, in a hurry, probably by whoever plugged the TV in.
Streaming apps add their own collection on top: watch history, searches, device details, and advertising identifiers shared under each app's terms. This guide separates the two layers, the television and the apps, and gives the settings that return some privacy to the living room.
Wearable consent given at setup covers the device working as described then. Continuous health and location collection, sharing with apps and insurers, and research use each need clear information and, for optional sharing, a separate genuine choice.
Keep consent records for as long as the data use they authorise continues, plus the period in which a complaint or claim could reasonably be brought afterwards. A written schedule by purpose, reviewed yearly, beats both deleting too early and hoarding everything indefinitely.
The two risks pulling in opposite directions
Delete records too soon and you cannot prove a choice was ever made, which is the one thing consent records exist for. Keep them forever and the records themselves become a liability: old names, addresses, and identifiers sitting in a system nobody owns, waiting for a breach or a subject access request to make them famous.
The balance point is purpose based. A marketing consent record matters while the marketing continues and for a defensible window after the last send or the withdrawal. An account related record follows the account. Each purpose gets its own clock, and the schedule fails when one blanket period is applied to everything for administrative convenience.
Building the schedule
List every consent you collect, its purpose, the system holding the record, and the trigger that starts the deletion clock: withdrawal, account closure, last activity, or contract end. Assign each a period with a reason a regulator would accept, such as a limitation period for claims, and name an owner responsible for running the deletion, not just approving the document.
Withdrawal handling needs its own line. When someone withdraws, the record of the original consent and of the withdrawal should survive long enough to prove you honoured it, even as the underlying marketing data is suppressed or erased. Deleting the proof along with the data leaves you unable to show the withdrawal ever happened.
Making audits boring
Store the schedule where the records live, not in a policy folder nobody opens. A quarterly job or report that counts records past their deletion date turns retention from an annual panic into routine housekeeping, and the report itself becomes evidence the schedule is operated, not just written.
Review yearly and after any new product launch. New purposes sneak new consent records into old systems, and the schedule only stays true if someone maps them when they appear. Boring, current, and owned is the goal: an auditor should be able to trace any record to a line in the schedule in under a minute.
Keep reading: Consent for Wearables: Health Data Collected on the Wrist, Shared Everywhere, Auditing Consent Banners for Dark Patterns: A Practical Checklist, and Consent on Smart TVs and Streaming Apps: Viewing Data Nobody Agreed To Share cover the nearby cases in this series.
Frequently asked questions
Is keeping consent records longer always safer?
No. Over retention creates breach exposure and conflicts with storage limitation duties, and it can look worse in an audit than a shorter, reasoned period properly applied. The defensible position is a schedule with reasons, operated consistently, not maximum hoarding.
What should a consent record contain to stay useful?
Who consented, when, what they were shown, the purposes and categories agreed, and any later change or withdrawal, each timestamped. A record missing the notice version is hard to defend, because you cannot show what the person actually agreed to.
When someone withdraws, should their record be deleted?
The data use should stop and unnecessary data should go, but a minimal record of the consent and its withdrawal is normally kept for a period to prove compliance. That proof record should be restricted, minimal, and covered by its own line in the retention schedule.
Who should own the retention schedule?
A named operational owner, usually in privacy or data operations, with legal input on the periods. Schedules owned by a committee tend to be reviewed by nobody. One owner, a yearly review date, and deletion reports are what make it real.