This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung
Data protection
How long can a cookie remain set?
Each cookie has an expiration date. Some apply only to the session and disappear with the closing of the browser, others remain for months or years. For cookies that require consent — Analysis, advertising, range measurement — regulators and courts have established an upper limit: After about 13 months, the consent should be renewed, and a cookie that is valid longer speaks against it. The privacy check area reads the expiration date of each cookie set when the page is viewed and reports runtimes above this value.
What is measured
During the measurement, the checking area reads all the cookies that the page sets in a fresh browser — before each interaction with the banner and again after clicking Reject. For each cookie, the remaining term is calculated in days. Cookies that are recognized as essential — Session, shopping cart, the consent store itself — remain out of consideration: the upper limit does not apply to them because they do not need consent. All other cookies with a duration of more than 395 days, i.e. a good 13 months, give a result with name and duration in months. The result does not change the point value; it stands as a separate reference in the report, so that issued seals retain their meaning.
Why 13 months
The figure comes from the practice of the French supervisory authority CNIL and was picked up by other authorities and in the European Data Protection Board: Consent is a decision at the moment; Those who gave it years ago no longer have it in mind today. Therefore, the query should be repeated after 13 months at the latest, and the cookie that documents the consent or follows from it should no longer apply. A two-year analysis cookie is technically the default of many tools – and therefore a common finding that no one has set intentionally. The correction is usually a setting in the analysis or consent tool.
- Check the setting for the cookie runtime in the analysis tool and set it to a maximum of 13 months.
- Set the Consent tool so that it requests consent again after 13 months at the latest.
- Leave essential cookies such as session or consent memory untouched – the limit does not apply to them.
- Check again after a tool change; New presets often bring long runtimes.
