Data Retention Policy for Testimonials: What to Keep and For How Long

A testimonial data retention policy is a short written schedule that says which testimonial records you keep, why, for how long, who can see them, and how they are destroyed. No single U.S. law sets one number for every company. What the rules do agree on is this: keep the proof behind a testimonial for as long as you use it (and in some industries for years after), and do not keep personal details longer than you have a real business reason to.

This guide shows you how to build that schedule for a B2B team, with the federal sources behind each decision.

TL;DR

• Treat the testimonial as a file, not a quote. Keep the statement, the customer’s identity, the consent or release, the verification trail and any substantiation for claims in it.
• Tie retention to use. Keep the file while the testimonial is live and for a defined period after the last use. New Jersey licensees, for example, must keep it three years from the last use.
• Keep less personal data, for less time. The FTC says to hold personal information only while you have a legitimate business need, and to write down how it is secured and disposed of.
• Delete on purpose, and prove it. Pull published copies, destroy stored records, and log the date.
• Review the schedule every 12 to 24 months and whenever privacy rules change.

Table of Contents

• What counts as testimonial data
• Why you need a policy at all
• What to put in the policy
• How long to keep each record
• Consent withdrawal, corrections and takedowns
• Keep the disclosure records too
• Store it securely, then delete it properly
• A simple lifecycle you can adopt this quarter
• Our perspective
• Put the policy to work in Clareefai
• FAQ
• Sources

What counts as testimonial data

Most teams think of a testimonial as a quote on a landing page. Regulators think of it more broadly. The FTC’s November 2024 guidance defines a testimonial as an advertising message consumers are likely to believe reflects a customer’s opinions or experiences, and it can appear on your website, in ads or on social media. The rule at 16 CFR Part 465 goes further: it covers the statement, but also a name, signature, likeness or other identifying characteristics used in the message.

In practice, one testimonial usually generates several kinds of records:

The FTC also separates reviews from testimonials. A review is an evaluation posted on a site built at least partly to show evaluations, while a testimonial is promotional. Reviews you pay for or incentivize count as testimonials under the rule, so your policy should cover them too.

Why you need a policy at all

There are two opposite risks, and a policy handles both.

Keeping too little. If a prospect, a competitor or a regulator questions a testimonial, you need to show who said it, that they agreed, and that the claim is true. Under the FTC’s endorsement guidance, an advertiser needs adequate substantiation for claims made through endorsements, just as if the advertiser had made the claims itself. The customer’s own statement is not that evidence. If you deleted the proof the day after you published, you cannot show it.

Keeping too much. The FTC’s business guide advises keeping personal information only as long as there is a legitimate business need, because stored data creates security, fraud and identity-theft risk. A folder of old contact details, unused video outtakes and expired releases is exactly that kind of liability.

The answer is a written schedule. The same FTC guide says that where data must be kept for business or legal reasons, you should have a written policy stating what is kept, how it is secured, how long it is kept and how it is disposed of.

What to put in the policy

Keep it to two pages that a sales ops lead, a marketer and a lawyer can all read. Cover these elements.

1. Scope. Name the record types from the table above and the places they live: CRM, shared drives, video tools, email, review platforms and agency folders.
2. Purpose. For each record type, state the reason you hold it (proof of consent, substantiation, active display).
3. Owner. One named role per record type, such as customer marketing for releases and sales operations for CRM fields.
4. Retention trigger and period. Most periods should run from the last use of the testimonial, not from the date it was collected.
5. Storage and access. Who can view, edit and export, and where the master copy lives.
6. Disposal method. How you delete, what counts as proof of deletion, and who signs off.
7. Exceptions. Legal holds, open disputes and regulator requests suspend deletion.
8. Review date. When the schedule is next checked and by whom.

If you want a deeper look at the consent and audit side, our eight-check testimonial privacy policy guide walks through it from consent to audit, and the testimonial release form checklist covers what a release should say.

How long to keep each record

There is no federal number that applies to every B2B company. What exists are sector rules, enforcement orders and good practice. Here is what the sources support.

Regulated industries set the floor.

• Investment advisers. SEC Rule 204-2 requires registered advisers to keep records of advertisements, disclosures and documentation that substantiates a reasonable basis for believing a testimonial or endorsement complies with the Advisers Act. The rule’s general provision requires many records to be kept at least five years, subject to its own triggers and exceptions.
• New Jersey licensees. Under N.J. Admin. Code § 13:42-9.8, licensees who advertise with testimonials must keep the documentation for three years from the testimonial’s last use. That includes the giver’s identifying information, compensation, and a notarized statement and release.

If you sell to or work in finance, legal, health or another licensed field, check the rule for your profession first. It may override everything below.

Enforcement orders show what regulators expect. The FTC’s 2019 UrthBox order requires comprehensive records of personnel, advertising and marketing materials plus whatever is needed to show compliance with the order. These orders bind specific companies, so treat them as signals of what a good file looks like, not as law for everyone.

A practical starting schedule. For a B2B company outside a licensed profession, a defensible draft looks like this. These periods are our suggested starting points, not legal requirements, so confirm them with counsel.

Pick a single “after last use” period, such as three years (matching the New Jersey pattern) or five (matching the SEC general provision), and apply it to the core file. One period is easier to automate and defend than six.

Consent withdrawal, corrections and takedowns

Your policy has to say what happens when a customer changes their mind, leaves the company or says the quote is wrong. Three principles hold up.

Remove what is public first. In the UrthBox order, respondents had to take reasonable steps to remove publicly viewable endorsements that did not comply. Build the same reflex: when a testimonial is pulled, the live copies on your site, decks, ads, social posts and partner pages come down within a stated number of business days.

Keep the minimum record of the removal. You may need to show that the testimonial existed, what it said and when it came down. Keep that thin file for the retention period, and delete the rest of the personal data that no longer serves a purpose.

Do not retain data on the strength of silence. In the Unrollme settlement, the FTC required deletion of stored e-receipts unless the company obtained consumers’ affirmative, express consent to keep them. That case is about a different kind of data, but the lesson carries over: if you want to keep personal data beyond its original purpose, ask clearly.

For negative or disputed feedback, see our guide to handling negative testimonials within FTC rules. Be careful not to suppress honest reviews. Part 465 also prohibits certain review suppression and fake or false reviews, so “delete on request” must never become “delete everything negative.”

Keep the disclosure records too

A testimonial from a partner, an employee, a reseller or a customer who received a perk needs a disclosure of that connection. The accessiBe settlement required truthful advertising and disclosure of connections between endorsers and the company’s products that might affect how consumers weigh them. Store the relationship data in the same file as the release so that the disclosure can be checked later. The FTC also advises against asking family and friends for reviews unless they disclose their personal connection.

Marketing teams that watch how reviews and testimonials perform in search can use how online reviews affect SEO as a starting point for deciding which testimonials to monitor and refresh. Whatever you keep active, keep its disclosure record alive too.

Store it securely, then delete it properly

A schedule is only as good as the systems behind it.

Storage. Keep master copies in one governed system, with role-based access and an audit log, rather than in personal drives and email threads. Our guide to secure testimonial storage for B2B teams covers the details. NIST suggests that working with records management officers when choosing security and privacy controls for retention and deletion can strengthen compliance posture. In a B2B company, that means inviting legal or compliance into the room when you design the schedule.

Deletion. Decide in advance what “deleted” means for every location: CRM fields, file storage, video platforms, backups, agency copies. Two public benchmarks help:

• Under the Blackbaud order, when a legal obligation to retain information ends, the company must provide a sworn statement confirming deletion or destruction within 30 days. The same order requires a documented, publicly posted retention schedule for customer backup files holding covered information.
• NIST’s cloud-erasure scenario calls for requests that carry unique object identifiers and for providers to return a time-stamped, signed message attesting to the deletion steps.

You do not need that level of ceremony for every file. You do need a log entry with the record ID, the date, the person who approved it and the method. Teams building this into their product or workflow can look at privacy by design for SaaS for ideas on data minimization and evidence of completed deletion.

A simple lifecycle you can adopt this quarter

1. Inventory. List every place testimonial data lives today, including agency folders and old campaign drives.
2. Classify. Tag each item as published, unpublished, consent or substantiation.
3. Set the clock. Record the last-use date on every published item.
4. Purge the obvious. Delete unpublished drafts, duplicate exports and contact details with no purpose.
5. Write the schedule. Use the elements above and get legal sign-off.
6. Automate reminders. Flag files when their retention period ends, with a human approval step.
7. Log deletions. Keep the proof.
8. Schedule the review. The ACC’s April 2024 guide says most organizations update retention schedules every 12 to 24 months, with special attention to new or changed privacy rules. Put it on the calendar, and add a trigger for any change in your products, claims or markets.

For the verification step that feeds this lifecycle, see our step-by-step testimonial verification guide and the six-check testimonial data governance guide.

Our perspective

We see the same pattern in B2B teams: testimonials are collected in a rush, scattered across slide decks, CRM notes and inboxes, and nobody knows who agreed to what. Then a customer leaves, or legal asks for the proof behind a headline number, and the team spends days reconstructing it.

We built Clareefai around the idea that every testimonial should be verified, contextualized and stored once. When the identity check, the consent, the quote and the publishing history sit in one record, a retention policy stops being a spreadsheet exercise. The clock starts from the real last-use date, the deletion covers everything linked to the record, and role-based dashboards show who can see what. Our approach also supports GDPR-grade security, which matters when your customers operate across borders.

Our advice: start small, pick one retention period, and make deletion as routine as collection. A tidy, verifiable file also makes your best customer stories easier to use, because sales can trust them.

— ClareefAi

Put the policy to work in Clareefai

If your testimonials live in six tools, a written policy will be hard to enforce. Clareefai gives your team one place to collect, verify and publish customer testimonials, video reviews and reference requests, with analytics showing which advocates move deals. Plans are published at Clareefai pricing: Basic at $250 per month, Professional at $624 per month and Enterprise at $1,250 per month, with a free trial and no long-term contracts.

Want to see how it fits your schedule? Explore the Clareefai platform and I’ll show you how verified records, consent and publishing history stay linked from the first quote to the last deletion.

FAQ

What should a testimonial data retention policy include?

It should list the record types you hold (quote, identity data, consent, verification trail, relationship data, substantiation and use log), the reason for holding each, an owner, a retention period, storage and access rules, and the disposal method. Add exceptions for legal holds and a review date. The FTC’s guidance says to write down what is kept, how it is secured, how long and how it is disposed of.

How long should we keep customer testimonials?

There is no single federal period. Regulated sectors set their own: New Jersey licensees keep testimonial documentation for three years from last use, and SEC-registered advisers face a general five-year minimum for many records. Outside those fields, choose one period measured from the last use and confirm it with counsel.

Do we have to delete a testimonial if the customer asks?

Take it down from public channels promptly, then decide with counsel what minimal record you must keep. Deleting is not always required immediately, because you may need proof of consent and substantiation for a period. Do not keep extra personal data without a clear purpose.

Is a testimonial itself proof that a claim is true?

No. The FTC’s endorsement guidance says the endorsement is not competent and reliable scientific evidence, and that advertisers need adequate substantiation for the claims it communicates. Keep the supporting data in the testimonial file for as long as you use the quote.

How often should we review the policy?

Every 12 to 24 months is common, according to the ACC’s guide, and sooner when privacy rules, your claims or your tools change. Assign the review to a named owner.

Sources

• FTC: Consumer Reviews and Testimonials Rule Questions and Answers
• eCFR: 16 CFR Part 465
• eCFR: 16 CFR 255.2 Consumer endorsements
• FTC: Protecting Personal Information, A Guide for Business
• SEC: Books and records to be maintained by investment advisers
• N.J. Admin. Code § 13:42-9.8
• FTC: UrthBox analysis of proposed consent order
• FTC: Unrollme settlement press release
• FTC: accessiBe settlement business blog
• FTC: Soliciting and Paying for Online Reviews
• FTC: Blackbaud decision and order
• NIST SP 800-53 Rev. 5
• NIST: Erase Data Objects in a Cloud
• ACC: Creating a Data Retention Policy That Meets Privacy Requirements
• Privacy by design for SaaS
• How online reviews affect SEO

Recommended

• Secure Testimonial Storage: A Practical Guide for B2B Teams
• Marketers’ Testimonial Privacy Policy: 8 Checks From Consent to Audit
• Secure Testimonial Management: A Guide for Marketers
• Revenue Teams: 6 Testimonial Data Governance Checks to Meet FTC Rules