Cookie duration is one of the most frequently misconfigured parts of cookie compliance. Many site owners mix up three different clocks: the lifetime of the cookie in the browser, the validity of the visitor's consent, and the retention of the collected data on the provider's servers. Each one is regulated differently. This guide explains the rules, the duration that fits each cookie category, how to configure Google Analytics 4 and your CMP, and the mistakes to avoid.
What does the law say about cookie duration?
The regulation does not set one universal maximum, but it states a clear principle: retention must be proportionate to the cookie's purpose. A cookie that no longer serves its purpose should no longer exist.
Several texts apply at the same time:
- the ePrivacy Directive (2002/58/EC), which requires consent before reading or writing non-essential information on a device;
- GDPR, in particular the storage limitation principle (Article 5(1)(e)) and the transparency obligation, which requires you to tell visitors how long each cookie lasts;
- the guidance of national supervisory authorities, which turns these principles into concrete figures. The most precise is the CNIL's 2020 guidelines and recommendation on cookies and other trackers.
Other authorities stay closer to the principle. The UK ICO, for example, does not set a fixed figure and asks for durations proportionate to the purpose. Because the CNIL figures are the strictest widely published benchmark, they have become the market standard for any site with European visitors.
The 13-month rule explained
The CNIL recommends that the lifetime of trackers placed on a user's device be limited to 13 months. Beyond that, a non-essential cookie is presumed disproportionate to its purpose, unless you can justify otherwise.
For audience measurement cookies that can run without consent (the CNIL exemption), the conditions are even more precise: tracker lifetime of 13 months at most, a lifetime that is not extended automatically on each new visit, and collected data kept for 25 months at most.
Recommendation or legal requirement?
The 13 months are a recommendation, not an article of law you can quote on its own. But the CNIL uses it as an assessment criterion during inspections. A site that sets its analytics cookies to 2 years without justification is exposed to observations or a sanction. In practice, treat 13 months as the ceiling and document any exception.
The default trap: GA4 and advertising pixels
Many tools exceed the 13 months out of the box. Google Analytics 4 sets _ga and _ga_<ID> with a default lifetime of 2 years, refreshed at every visit. Advertising platforms (Meta Pixel, Google Ads, LinkedIn Insight Tag) often use defaults of 1 to 2 years. Your CMP decides whether these cookies are set, but it does not control the lifetime chosen by the third party: you must shorten it in the tool when possible, and otherwise declare it exactly as the third party defines it. For the detail of each Google cookie, see _ga, _gid and _gat explained.
Recommended duration by cookie category
Strictly necessary cookies
No fixed limit, but the duration must stay proportionate. An authentication cookie typically expires at the end of the session, or after a reasonable period such as 30 days for a "stay signed in" option. A language preference cookie can legitimately last 1 year. These cookies do not require consent, but they must be listed in your cookie policy with their duration.
Functional cookies
The duration depends on the purpose. A shopping cart cookie can last 30 days. An interface personalisation cookie can last up to 1 year. A functional cookie that lasts a year without technical justification is questionable. The rule: the shortest duration that lets the service work.
Analytics cookies
13 months at most, without automatic extension if you rely on the consent exemption. Matomo, Adobe Analytics or GA4 all use cookies with varying lifetimes: check each one rather than trusting the defaults.
Advertising and retargeting cookies
13 months at most as well. These are the cookies most likely to exceed the recommendation, because their lifetime is set by the ad platform. Shorten what you can, and declare the rest precisely.
Session cookies
Cookies with no expiry date are deleted when the browser closes. Check that they really are session cookies: some "session" cookies are in fact persistent.
Consent validity: why around 6 months
Cookie lifetime and consent validity are two different things, and confusing them is the most common error.
- Cookie lifetime is how long the file stays on the device.
- Consent validity is how long you can consider the visitor's choice to be current without asking again.
The CNIL considers that the right duration depends on the site and its audience, and that keeping the choice for 6 months is an appropriate practice. In concrete terms, if a visitor accepted cookies on 1 January, the banner should reappear around 1 July, unless the visitor changed preferences in the meantime.
The same reasoning applies to a refusal. A visitor who clicked "Reject" must not be asked again at every page view: keep the refusal for a comparable period, then you may ask again. Re-prompting too often is a pressure tactic that authorities treat as a breach of free consent, and it feeds consent fatigue rather than valid choices. For the other conditions a valid consent must meet, see GDPR consent validity requirements.
Other authorities sometimes allow more: the Spanish AEPD, for instance, considers that consent should not last more than 24 months. If your audience is European, aligning on 6 months covers the strictest reading. You must also ask again earlier when something material changes: a new purpose, a new vendor or a substantially modified banner.
The third clock: data retention on provider servers
The 13 months concern the file on the user's device. Data collected through that cookie, for example GA4 events, has its own retention period on Google's servers or those of the analytics provider. It is governed by GDPR and by the service's terms.
In GA4, data retention for standard properties can be set to 2 months or 14 months (Admin > Data collection and modification > Data retention). Choose the shortest value compatible with your reporting needs, and document it. If you rely on the CNIL exemption, collected data must not be kept beyond 25 months. For the wider question of using GA4 lawfully, see is Google Analytics GDPR compliant?.
How to configure durations in practice
Google Analytics 4
GA4 lets you override cookie settings for a web stream: in Admin > Data streams > your stream > Configure tag settings, open Override cookie settings to set a shorter expiry. With gtag.js, the cookie_expires parameter (in seconds) sets the lifetime: 13 months is about 34128000 seconds (395 days). The cookie_update parameter set to false stops the expiry from being pushed back at each visit, which matches the CNIL condition for exempt measurement.
Your CMP
Your CMP stores the visitor's choice in a cookie or in localStorage. That consent record must have its own coherent lifetime, and the CMP must:
- re-display the banner when consent validity expires (6 months recommended);
- keep refusals as well as acceptances, so it does not re-prompt at every visit;
- invalidate stored choices when your configuration changes (new vendor, new purpose);
- log the date, banner version and duration of each choice, so you can prove it later.
A CMP like FlowConsent lets you configure consent validity and manages the banner re-display automatically, while recording the timestamp, version and duration of each consent. On the server side, the FlowConsent server SDK returns a reason such as expired or version_mismatch when a stored choice can no longer be used, and can invalidate choices made before a configuration change. To keep your consent records audit-ready, read what to store as proof of cookie consent.
Your cookie policy
Every cookie listed in your cookie policy must state its duration, either exactly or as a range per category. Omitting it is a breach of the transparency obligation. In FlowConsent, the cookie declaration is generated from your active services, with the duration of each cookie as it must be shown to visitors, and you add your own first-party cookies with the same fields.
Common mistakes
Leaving third-party defaults in place. GA4, Meta Pixel and LinkedIn use 1 to 2 year defaults. Configure each tool manually where it allows it.
Confusing cookie lifetime with consent validity. 13 months for the cookie, about 6 months for the choice: two separate parameters, configured separately.
Confusing cookie lifetime with data retention. One concerns the file on the device, the other the data on the publisher's or processor's servers.
Never renewing consent. Consent collected once and never renewed loses its value over time. The banner must reappear at expiry for visitors who accepted.
Re-asking after a refusal at every visit. A refusal must be remembered as long as an acceptance.
Applying the same duration to every cookie. Functional cookies should have the shortest sufficient duration; analytics and advertising cookies must not exceed 13 months.
Forgetting cookies set by embedded scripts. Video players, widgets and sharing buttons often set long-lived cookies of their own. Only a scan of the live site reveals them.
Not documenting durations. No duration in the cookie policy, or a list that no longer matches what the site actually sets.
Cookie duration compliance checklist
- Audit every active cookie on the site and note its real expiry (browser DevTools or a scanner). Our complete cookie audit guide details the method.
- Check that analytics and advertising cookies do not exceed 13 months, and shorten GA4 and other tools' defaults.
- If you rely on the CNIL exemption, disable the automatic extension of the analytics cookie and keep data 25 months at most.
- Set consent validity to about 6 months in the CMP, for acceptances and refusals alike.
- Make sure the banner reappears automatically when consent expires, and when your purposes or vendors change.
- Set GA4 data retention to the shortest value that meets your needs.
- Check that session cookies really expire when the browser closes.
- List the duration of every cookie, or a range per category, in the cookie policy.
- Make sure consent records include the date and the expiry of each choice.
- Document the reasons for the durations you chose in your record of processing activities.
- Re-check durations after every update of the CMP, the analytics tool or the site's scripts.
Verify what your site actually sets
The rules on cookie duration are not complicated, but they only hold if the configuration matches reality. A FlowConsent compliance verification loads your pages in a real browser, refuses consent and lists the non-essential cookies that are still set; the dated proof report shows each cookie with its domain and expiry. And any cookie observed by the scan but missing from your declaration triggers an alert you can fix in one click.
Start by scanning your site to see the real lifetime of each cookie it sets and spot those that exceed 13 months.