How Long Do Cookies Last? Expiry and Consent Rules

It depends on the type, and the range is enormous.

A session cookie lasts until you close the browser. A persistent cookie lasts exactly as long as its Expires date or Max-Age value says, which can be anything from seconds to years. Most tracking and analytics cookies are set somewhere between 30 days and two years, and browsers increasingly cut those numbers down regardless of what the site asked for.

Then there’s a second clock most people never notice. How long the cookie survives and how long your permission to use it survives are two different things, governed by two different rules. Sites get this wrong constantly.

Cookie type	How long it lasts	Set by
Session cookie	Until the browser or tab closes. No expiry is written	No `Expires` or `Max-Age` attribute
Persistent cookie	Until the date in `Expires`, or the seconds in `Max-Age`	The site that sets it
First-party analytics	Commonly 13 to 24 months	The site, subject to browser caps
Third-party advertising	Commonly 30 days to 2 years, if allowed at all	The third party
Consent record cookie	Commonly 6 to 13 months	Your CMP

Expires vs Max-Age

Both set the lifetime of a persistent cookie, and they work differently.

Expires takes an absolute date. Max-Age takes a number of seconds from now. If both are present, Max-Age wins in every modern browser.

Set-Cookie: prefs=dark; Max-Age=2592000; Path=/; Secure; SameSite=Lax
Set-Cookie: prefs=dark; Expires=Wed, 11 Nov 2026 09:00:00 GMT; Path=/; Secure

Max-Age is usually the safer choice, because Expires relies on the user’s device clock being right and plenty aren’t. To delete a cookie, set Max-Age=0 or an Expires date in the past. There’s no delete method; expiring it is the delete method.

Leave both off and you get a session cookie.

What shortens a cookie’s life without you asking

The expiry you set is a ceiling, not a guarantee.

Safari is the most aggressive. Its Intelligent Tracking Protection caps script-written cookies at seven days, and in some cases 24 hours, no matter what expiry the site requested. Firefox applies its own Total Cookie Protection partitioning. Chrome enforces a 400-day upper bound on cookie lifetimes, so a two-year cookie quietly becomes a 400-day one.

Users clear cookies too, and browser interfaces bundle cookies with other site data, so “clear cookies” usually takes local storage and IndexedDB with it. We cover that in understanding local storage, session storage and cookies.

This is the second clock, and it isn’t the same as the cookie’s expiry date.

A cookie can be valid for 13 months while your permission to use it ran out at six. Setting your consent cookie to 13 months doesn’t extend consent to 13 months. It just means you stopped asking.

France is the clearest. CNIL limits tracker lifetime to 13 months as a condition of the audience-measurement exemption, and separately caps the retention of data collected through technical cookies at 25 months. On consent itself, CNIL treats six months as good practice for the interval before asking again, and says a refusal should be respected for a period rather than re-prompted on every visit.

The UK doesn’t set a number. The ICO’s position is that consent should be refreshed at appropriate intervals, judged on the nature of the processing, and its April 2026 guidance on storage and access technologies requires a clear, free and easy way to object, with storage stopping immediately when someone does. More on that in our write-up of the ICO’s updated guidance.

The EU is in flux. The Digital Omnibus proposed moving cookie rules into the GDPR under new Articles 88a and 88b, including a six-month bar on re-prompting anyone who refused. The Council removed those provisions from its negotiating text on 18 June 2026 and they may or may not return. Treat the direction as informative and the mechanics as unconfirmed. Nothing has changed in law yet.

The practical answer: six months. It’s CNIL’s stated good practice, it’s the figure the EU proposal reached for, and it’s defensible in any jurisdiction that expects periodic refresh. If you need one number for your CMP, that’s the one, with 13 months as the outer limit for the tracker itself.

Types of cookies

Session cookies:

Purpose: Temporary cookies that expire when the user closes the browser.Use: Store session-specific information, such as user login details, to facilitate seamless navigation during a single session.

Persistent cookies:

Purpose: Remain on the user’s device for a specified duration or until manually deleted.Use: Retain user preferences and settings across multiple sessions, providing a personalized experience over time.

First-party cookies:

Source: Issued by the website the user is currently visiting.Use: Collect data for site functionality, customization, and analytics directly related to the visited domain. Often referred to as necessary cookies.

Third-party cookies:

Source: Issued by domains other than the one the user is currently visiting.Use: Often used for advertising, tracking user behavior across websites, and delivering targeted content.

Secure cookies:

Purpose: Transmitted over encrypted, secure connections (HTTPS).Use: Enhance security by preventing unauthorized access to sensitive data stored in the cookie.

HttpOnly Cookies:

Purpose: Restricts access to the cookie through client-side scripts, enhancing security.Use: Mitigate the risk of cross-site scripting (XSS) attacks by preventing malicious scripts from accessing cookie data.

SameSite Cookies:

Purpose: Defines when cookies should be sent in cross-site requests.Use: Mitigate cross-site request forgery (CSRF) risks by controlling how cookies are shared between different websites.

Ensuring compliance with regulations

The principle of data minimization requires websites to only collect and store data that is necessary and proportionate to their legitimate purposes. To ensure compliance with privacy regulations, cookies should cease to function and automatically get deleted from the user’s browser once their purpose is fulfilled and a certain time frame has passed. The cookie expiration date also serves the purpose of removing old, useless data that unnecessarily burdens the user’s browser. For websites, the expiration date plays a role in logging out inactive users after a set period of time.

Protecting user data and privacy

Expiration dates ensure that data on users is not stored indefinitely. It helps websites remove unnecessary or outdated personal information about users, reducing the risk of data breaches and unauthorized access. Expiration dates ensure cookie formation for a short period or deleting them immediately if users opt out of specific cookie categories, honoring user rights and doing away with data retention unnecessarily for longer than required. Even if hackers get access to cookies, the shorter span of cookie data renders it outdated, alleviating the potential for misuse.

User preferences and settings

Most websites with cookie consent banners allow users to pick their choices for different cookie categories. These categories include essential, functional, performance, and advertising, for which users, as per their convenience of data sharing, provide explicit consent. If the user rejects non-essential cookies right off the bat, the cookie might not be set at all. Again, this is often a requirement of data privacy regulations like GDPR. Some websites offer more granular controls for cookie settings – for example, users can choose their choice of cookie lifespan.User-initiated actions typically take precedence over website-specific settings. For example, privacy-conscious users manually clear cookies from their browser settings or use third-party extensions to delete cookies periodically. It also depends on the browser settings, which allow users to delete cookies after a session ends or after a defined period. Certain browsers, like Mozilla’s Firefox and Apple’s Safari, also allow users to block third-party tracking cookies by default. This is known as Intelligent Tracking Protection. Google Chrome browser is also set to depreciate third-party cookies in 2024.

Cookie policies are an informative guide to how websites intend to use data and for how long they store it. Consent banners are displayed on websites to inform users about the use of cookies. They obtain their explicit consent for different categories of cookies.A detailed outline of personal data usage in cookie policies empowers users to make informed decisions regarding their consent. Based on the jurisdiction-specific regulations, websites set their expiration period for cookie categories opted for by users. Usually, websites set them to expire anything between hours or days to last as long as months or even years.

Set the shortest expiry that still does the job. That’s the data minimisation principle in practice, and it’s the first thing a regulator looks at.

Run two clocks, not one. The cookie’s technical lifetime and your consent’s validity are separate, and your CMP needs to manage both. Six months on consent, 13 months as the ceiling on the tracker.

Log refusals, not just acceptances. If you only store positive consent, you can’t tell a fresh visitor from someone who said no last week, so you re-prompt them. That was heading for a GDPR violation under the proposed Article 88a and it’s already contrary to CNIL’s guidance.

Expect the browser to overrule you. If your measurement plan assumes a two-year cookie, it’s already wrong on Safari and Chrome.

Then check what you actually set. Most teams find at least one cookie with an expiry nobody chose. Syrenis’s website audit inventories what’s really on your site, and cookie management enforces the durations you decide on.

How long is cookie consent valid?

There’s no single legal figure. CNIL treats six months as good practice before asking again, and caps consent-exempt trackers at 13 months. The ICO expects periodic refresh without setting a number. Six months is the defensible default, and it’s independent of how long the cookie itself lasts.

How long do cookies last by default?

If a site sets no Expires or Max-Age, the cookie is a session cookie and dies when the browser closes. There’s no universal default beyond that. Everything else is whatever the site chose, capped by the browser.

What’s the maximum a cookie can last?

Chrome enforces a 400-day upper limit. Safari’s tracking protection cuts script-written cookies to seven days or less. So the practical maximum is well under what most sites request.

Do cookies expire if you don’t use the site?

Not on their own. A persistent cookie sits there until its expiry date regardless of whether you visit. Safari is the exception, since it evicts script-written storage after a period of inactivity.

What’s the difference between Max-Age and Expires?

Max-Age counts seconds from now. Expires names an absolute date. Max-Age takes precedence when both are set, and it’s more reliable because it doesn’t depend on the user’s device clock.

How Long Do Cookies Last?

How long each type of cookie lasts