Storing proof of consent for 7 years — best practice?

Both. Our ledger is the primary evidence store (immutable, timestamped). Export to S3 for your own long-tail retention. Don't rely solely on S3 — auditors want an immutable ledger.