How long should I keep subscriber data?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Different types of subscriber data have different answers, and the law you're operating under matters. Here's a practical breakdown.
Active subscriber data (email address, preferences, engagement history): keep it as long as the subscription is active. Someone who opens your emails regularly and hasn't asked to leave is a current subscriber. You have a clear reason to hold that data.
After an unsubscribe: this is where people often get it wrong. You should keep the email address and the fact of unsubscription in your suppression list indefinitely. Deleting it is the mistake. If you delete the record and someone later re-adds the address to your list (manually or through a data import), you'll email them again. Suppression records protect you from that. What you can and should delete: detailed profile data, behavioral analytics, anything beyond the minimum needed to honor the opt-out.
Inactive subscribers who never unsubscribed: this is the gray zone. Under GDPR, you need ongoing consent or a legitimate basis to hold data. Most practitioners treat 12-24 months of inactivity as a trigger to re-permission or remove. Under CAN-SPAM, there's no equivalent rule. But holding stale data you're not sending to is low risk.
Consent records themselves: keep these for as long as you might need to prove consent ever happened. Typically 3-5 years or the length of any statute of limitations in your jurisdiction.
If you're on GDPR or similar laws, a documented retention policy is not optional. If you're unsure what your retention schedule should look like, that's a good thing to work through before a regulator asks.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
