> How long can cookies and consent last under GDPR? The 13-month rule, 6-month consent validity, durations by category, GA4 settings and a checklist. > > Canonical: https://www.flowconsent.com/en/blog/cookie-retention-duration-gdpr-13-months [Regulation](https://www.flowconsent.com/en/blog?category=regulation) # Cookie retention under GDPR: the 13-month rule explained Published 7 July 2026 · Updated 2 October 2026 · 8 min read In short no European text sets a single maximum lifetime for every cookie. The reference everyone works with comes from the CNIL: a lifetime of **13 months** at most for analytics and advertising cookies, and a consent choice kept for about **6 months** before the banner asks again. Behind those two figures sits a principle from GDPR: every cookie, and every piece of data it collects, must be kept only as long as its purpose requires, and that duration must be shown in your cookie policy. Cookie duration is one of the most frequently misconfigured parts of cookie compliance. Many site owners mix up three different clocks: the lifetime of the cookie in the browser, the validity of the visitor's consent, and the retention of the collected data on the provider's servers. Each one is regulated differently. This guide explains the rules, the duration that fits each cookie category, how to configure Google Analytics 4 and your CMP, and the mistakes to avoid. ## What does the law say about cookie duration? The regulation does not set one universal maximum, but it states a clear principle: retention must be proportionate to the cookie's purpose. A cookie that no longer serves its purpose should no longer exist. Several texts apply at the same time: - the **ePrivacy Directive** (2002/58/EC), which requires consent before reading or writing non-essential information on a device; - **GDPR**, in particular the storage limitation principle (Article 5(1)(e)) and the transparency obligation, which requires you to tell visitors how long each cookie lasts; - the **guidance of national supervisory authorities**, which turns these principles into concrete figures. The most precise is the CNIL's 2020 guidelines and recommendation on cookies and other trackers. Other authorities stay closer to the principle. The UK ICO, for example, does not set a fixed figure and asks for durations proportionate to the purpose. Because the CNIL figures are the strictest widely published benchmark, they have become the market standard for any site with European visitors. ## The 13-month rule explained The CNIL recommends that the lifetime of trackers placed on a user's device be limited to **13 months**. Beyond that, a non-essential cookie is presumed disproportionate to its purpose, unless you can justify otherwise. For audience measurement cookies that can run without consent (the CNIL exemption), the conditions are even more precise: tracker lifetime of 13 months at most, a lifetime that is **not extended automatically** on each new visit, and collected data kept for **25 months** at most. ### Recommendation or legal requirement? The 13 months are a recommendation, not an article of law you can quote on its own. But the CNIL uses it as an assessment criterion during inspections. A site that sets its analytics cookies to 2 years without justification is exposed to observations or a sanction. In practice, treat 13 months as the ceiling and document any exception. ### The default trap: GA4 and advertising pixels Many tools exceed the 13 months out of the box. Google Analytics 4 sets `_ga` and `_ga_` with a default lifetime of **2 years**, refreshed at every visit. Advertising platforms (Meta Pixel, Google Ads, LinkedIn Insight Tag) often use defaults of 1 to 2 years. Your CMP decides _whether_ these cookies are set, but it does not control the lifetime chosen by the third party: you must shorten it in the tool when possible, and otherwise declare it exactly as the third party defines it. For the detail of each Google cookie, see [\_ga, \_gid and \_gat explained](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr). ## Recommended duration by cookie category ### Strictly necessary cookies No fixed limit, but the duration must stay proportionate. An authentication cookie typically expires at the end of the session, or after a reasonable period such as 30 days for a "stay signed in" option. A language preference cookie can legitimately last 1 year. These cookies do not require consent, but they must be listed in your cookie policy with their duration. ### Functional cookies The duration depends on the purpose. A shopping cart cookie can last 30 days. An interface personalisation cookie can last up to 1 year. A functional cookie that lasts a year without technical justification is questionable. The rule: the shortest duration that lets the service work. ### Analytics cookies 13 months at most, without automatic extension if you rely on the consent exemption. Matomo, Adobe Analytics or GA4 all use cookies with varying lifetimes: check each one rather than trusting the defaults. ### Advertising and retargeting cookies 13 months at most as well. These are the cookies most likely to exceed the recommendation, because their lifetime is set by the ad platform. Shorten what you can, and declare the rest precisely. ### Session cookies Cookies with no expiry date are deleted when the browser closes. Check that they really are session cookies: some "session" cookies are in fact persistent. ## Consent validity: why around 6 months Cookie lifetime and consent validity are two different things, and confusing them is the most common error. - **Cookie lifetime** is how long the file stays on the device. - **Consent validity** is how long you can consider the visitor's choice to be current without asking again. The CNIL considers that the right duration depends on the site and its audience, and that keeping the choice for **6 months** is an appropriate practice. In concrete terms, if a visitor accepted cookies on 1 January, the banner should reappear around 1 July, unless the visitor changed preferences in the meantime. The same reasoning applies to a **refusal**. A visitor who clicked "Reject" must not be asked again at every page view: keep the refusal for a comparable period, then you may ask again. Re-prompting too often is a pressure tactic that authorities treat as a breach of free consent, and it feeds [consent fatigue](https://www.flowconsent.com/en/blog/consent-fatigue-visitors-ignore-cookie-banner) rather than valid choices. For the other conditions a valid consent must meet, see [GDPR consent validity requirements](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements). Other authorities sometimes allow more: the Spanish AEPD, for instance, considers that consent should not last more than 24 months. If your audience is European, aligning on 6 months covers the strictest reading. You must also ask again earlier when something material changes: a new purpose, a new vendor or a substantially modified banner. ## The third clock: data retention on provider servers The 13 months concern the file on the user's device. Data collected through that cookie, for example GA4 events, has its own retention period on Google's servers or those of the analytics provider. It is governed by GDPR and by the service's terms. In GA4, data retention for standard properties can be set to **2 months or 14 months** (Admin > Data collection and modification > Data retention). Choose the shortest value compatible with your reporting needs, and document it. If you rely on the CNIL exemption, collected data must not be kept beyond 25 months. For the wider question of using GA4 lawfully, see [is Google Analytics GDPR compliant?](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant). ## How to configure durations in practice ### Google Analytics 4 GA4 lets you override cookie settings for a web stream: in Admin > Data streams > your stream > Configure tag settings, open **Override cookie settings** to set a shorter expiry. With gtag.js, the `cookie_expires` parameter (in seconds) sets the lifetime: 13 months is about `34128000` seconds (395 days). The `cookie_update` parameter set to `false` stops the expiry from being pushed back at each visit, which matches the CNIL condition for exempt measurement. ### Your CMP Your CMP stores the visitor's choice in a cookie or in localStorage. That consent record must have its own coherent lifetime, and the CMP must: - re-display the banner when consent validity expires (6 months recommended); - keep refusals as well as acceptances, so it does not re-prompt at every visit; - invalidate stored choices when your configuration changes (new vendor, new purpose); - log the date, banner version and duration of each choice, so you can prove it later. A CMP like FlowConsent lets you configure consent validity and manages the banner re-display automatically, while recording the timestamp, version and duration of each consent. On the server side, the [FlowConsent server SDK](https://www.flowconsent.com/en/doc/server-sdk) returns a reason such as `expired` or `version_mismatch` when a stored choice can no longer be used, and can invalidate choices made before a configuration change. To keep your consent records audit-ready, read [what to store as proof of cookie consent](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store). ### Your cookie policy Every cookie listed in your [cookie policy](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide) must state its duration, either exactly or as a range per category. Omitting it is a breach of the transparency obligation. In FlowConsent, the [cookie declaration](https://www.flowconsent.com/en/doc/cookie-declaration) is generated from your active services, with the duration of each cookie as it must be shown to visitors, and you add your own first-party cookies with the same fields. ## Common mistakes **Leaving third-party defaults in place.** GA4, Meta Pixel and LinkedIn use 1 to 2 year defaults. Configure each tool manually where it allows it. **Confusing cookie lifetime with consent validity.** 13 months for the cookie, about 6 months for the choice: two separate parameters, configured separately. **Confusing cookie lifetime with data retention.** One concerns the file on the device, the other the data on the publisher's or processor's servers. **Never renewing consent.** Consent collected once and never renewed loses its value over time. The banner must reappear at expiry for visitors who accepted. **Re-asking after a refusal at every visit.** A refusal must be remembered as long as an acceptance. **Applying the same duration to every cookie.** Functional cookies should have the shortest sufficient duration; analytics and advertising cookies must not exceed 13 months. **Forgetting cookies set by embedded scripts.** Video players, widgets and sharing buttons often set long-lived cookies of their own. Only a scan of the live site reveals them. **Not documenting durations.** No duration in the cookie policy, or a list that no longer matches what the site actually sets. ## Cookie duration compliance checklist 1. Audit every active cookie on the site and note its real expiry (browser DevTools or a scanner). Our [complete cookie audit guide](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) details the method. 2. Check that analytics and advertising cookies do not exceed 13 months, and shorten GA4 and other tools' defaults. 3. If you rely on the CNIL exemption, disable the automatic extension of the analytics cookie and keep data 25 months at most. 4. Set consent validity to about 6 months in the CMP, for acceptances and refusals alike. 5. Make sure the banner reappears automatically when consent expires, and when your purposes or vendors change. 6. Set GA4 data retention to the shortest value that meets your needs. 7. Check that session cookies really expire when the browser closes. 8. List the duration of every cookie, or a range per category, in the cookie policy. 9. Make sure consent records include the date and the expiry of each choice. 10. Document the reasons for the durations you chose in your record of processing activities. 11. Re-check durations after every update of the CMP, the analytics tool or the site's scripts. ## Verify what your site actually sets The rules on cookie duration are not complicated, but they only hold if the configuration matches reality. A FlowConsent [compliance verification](https://www.flowconsent.com/en/doc/compliance-verification) loads your pages in a real browser, refuses consent and lists the non-essential cookies that are still set; the dated proof report shows each cookie with its domain and expiry. And any cookie observed by the scan but missing from your declaration triggers an alert you can fix in one click. Start by [scanning your site](https://www.flowconsent.com/en/scan) to see the real lifetime of each cookie it sets and spot those that exceed 13 months. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fcookie-retention-duration-gdpr-13-months) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fcookie-retention-duration-gdpr-13-months) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What is the 13-month cookie retention rule? The French data protection authority CNIL requires that cookie consent be renewed at least every 13 months. If a user accepted cookies 13 months ago and has not revisited the consent banner since, their consent is considered expired and must be recollected. This rule aims to ensure consent remains current and reflective of the user's actual preferences. ### Does the 13-month rule apply to all cookies? The 13-month rule specifically concerns the renewal of consent. It applies to all cookies that require consent, meaning analytical and advertising cookies. Strictly necessary cookies (those essential for the website to function) do not require consent and are therefore not subject to this limit. The technical storage duration of cookies is a separate matter from the consent renewal period. ### How should I technically implement the 13-month renewal? Your CMP (Consent Management Platform) should store the date of each user's consent along with their choice. When a returning user visits your site, the CMP checks whether 13 months have passed since their last consent. If so, it re-displays the banner to collect fresh consent. Most compliant CMPs handle this automatically, but it is worth verifying that this mechanism is properly configured. ### Does the 13-month rule apply across Europe or only in France? The 13-month rule is specific to the French CNIL's guidelines. Other European data protection authorities may have different guidance: for example, some specify 6-month or 12-month renewal periods, or address other aspects of consent duration. Under GDPR, the general principle is that consent must remain freely given, specific, informed, and current. Consult the guidelines of the authority in your country of establishment. ### What are the risks of not renewing consent after 13 months? Failing to renew consent after 13 months constitutes a breach of CNIL guidelines and could result in a formal notice or financial sanction in the event of a control or complaint. More broadly, using cookies based on expired consent violates the GDPR principle of valid consent. It is therefore both a legal risk and a reputational one, particularly in the context of growing regulatory enforcement. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Regulation · 26 March 2026](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) ### [Cookie categories under GDPR: the 4 cookie consent categories explained](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) [Strictly necessary, functional, analytics, marketing cookies: which categories require consent? GDPR guide with practical examples.](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide)· [Regulation · 23 June 2026](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) ### [GDPR consent: the 7 requirements for valid consent explained](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) [GDPR consent is only valid when it is freely given, specific, informed, unambiguous, prior, demonstrable and revocable. This guide explains each requirement, when consent is needed, and the related rules on dark patterns, ad signals and laws outside the EU.](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements)· [Marketing tools · 1 July 2026](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) ### [The \_ga, \_gid and \_gat cookies explained: purpose, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [What the Google Analytics cookies \_ga, \_ga\_\, \_gid and \_gat actually do, how long they last, why they need consent in the EU and how Consent Mode v2 changes their behaviour.](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [Read the article](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)