Skip to main content
Cookie Gate
Category: Cookie Types

Cookie Duration

Also known as: Cookie Lifetime, Cookie Expiry, Cookie Expiration Period
Simply put

Cookie duration refers to how long a cookie remains stored on a user's browser or device after it is set, before it expires and is deleted. This period can range from a very short time to a much longer one, depending on how the cookie is configured. In affiliate marketing specifically, cookie duration often refers to the window during which an affiliate can be credited with a referral after a user clicks their link.

Formal definition

Cookie duration is the interval, defined at the time a cookie is created, during which the cookie persists on the user's device before automatic expiry and deletion. For persistent cookies, this is set through an explicit expiry date (Expires attribute) or a relative lifetime (Max-Age attribute); session cookies, by contrast, generally persist only until the browser session ends and carry no fixed expiry. Reported durations for persistent cookies can vary widely, from minutes to years. The term also has a domain-specific meaning in affiliate marketing, where it denotes the attribution window, commonly described as ranging from around 1 to 30 days, during which a referred visitor's action can be credited to the affiliate who set the cookie. Note that this evidence packet describes only the technical and commercial meaning of cookie duration; it does not address the consent, disclosure, or storage-limitation obligations that may apply to cookie lifetimes under the ePrivacy Directive, the GDPR, or other regimes, and practitioners should assess those requirements separately, as guidance on acceptable cookie lifespans varies by jurisdiction.

Why it matters

Cookie duration determines how long tracking, preferences, or attribution data persist on a user's device, which has direct consequences for both user privacy and business operations. A cookie configured to last minutes behaves very differently from one set to persist for months or years, and the choice of lifetime shapes how long a website can recognise a returning visitor or retain information about them. Because longer-lived cookies extend the period during which data associated with a device remains accessible, duration is often scrutinised in privacy assessments, even though this evidence digest addresses only the technical and commercial meaning of the term.

In the EU and UK, the storage-limitation principle under the GDPR and the disclosure and consent requirements under the ePrivacy Directive and its national implementations may bear on how long cookies should be permitted to last, but guidance on acceptable cookie lifespans varies by jurisdiction and this definition does not resolve those questions. Practitioners should treat cookie duration as a configuration decision that intersects with, but is not governed by, this technical description alone, and should assess consent, disclosure, and retention obligations separately for each applicable regime.

In affiliate marketing, cookie duration carries a distinct commercial significance: it defines the attribution window during which an affiliate can be credited with a referred visitor's action after a click. A shorter window narrows the period in which a sale can be attributed to the referring affiliate, while a longer window extends it, so duration directly affects how commissions are earned and allocated.

Who it's relevant to

Web developers and engineers
Developers configure cookie lifetimes through the Expires and Max-Age attributes and decide whether a cookie should be a session cookie or a persistent one. Understanding how duration is set and when a cookie expires is essential to implementing cookies that behave as intended, though developers should coordinate with legal and compliance colleagues on acceptable lifespans.
Privacy and data protection professionals
Because cookie duration determines how long device-stored data persists, it is frequently examined in privacy reviews. This definition covers only the technical and commercial meaning, so professionals should separately assess whether a given duration aligns with disclosure, consent, and storage-limitation obligations, which may differ by jurisdiction.
Affiliate marketers and program managers
For those running or participating in affiliate programs, cookie duration defines the attribution window, commonly described as around 1 to 30 days, during which a referred visitor's action can be credited to the affiliate who set the cookie. Duration therefore directly affects how and whether commissions are earned.
Compliance and legal teams
Legal and compliance staff evaluate whether cookie lifetimes are consistent with applicable requirements under regimes such as the ePrivacy Directive, the GDPR, and other frameworks. Since guidance on acceptable cookie lifespans varies by jurisdiction and is not addressed in this definition, these teams should assess each requirement independently.

Inside Cookie Duration

Cookie Lifespan / Expiry
The period during which a cookie remains stored on a user's device before it expires or is deleted. This is typically defined by an expiration date or a maximum age value set when the cookie is placed, and it determines how long the associated information persists between browsing sessions.
Session vs. Persistent Cookies
Session cookies are generally deleted when the browser is closed and exist only for the duration of a single browsing session, whereas persistent cookies remain on the device for a defined period or until manually deleted. Duration is the key characteristic distinguishing these two categories.
First-Party vs. Third-Party Duration
Both first-party cookies (set by the visited site) and third-party cookies (set by other domains, such as advertising or analytics providers) carry their own durations. Browser policies and privacy settings may limit or shorten the effective lifespan of third-party cookies independently of the value set by the issuer.
Consent Duration / Re-consent Interval
The period for which a given consent decision is treated as valid before the user is asked again. This is a distinct concept from a cookie's technical expiry: in most EU jurisdictions, guidance from data protection authorities suggests that consent should be refreshed periodically, though there is no single universally fixed interval and practice varies.
Relationship to Similar Technologies
Local storage, pixels, SDKs, and fingerprinting techniques do not necessarily follow the same expiry mechanics as cookies; some persist until explicitly cleared and lack a built-in expiration. Where these technologies access or store information on a device, the same consent rules that apply to cookies generally apply, even though their duration behaves differently.
Duration Disclosure Obligations
Information about cookie duration is commonly disclosed to users as part of the transparency requirements associated with informed consent, typically within a cookie policy or consent management interface. The precise disclosure expectations depend on the applicable legal regime and relevant regulatory guidance.

Common questions

Answers to the questions practitioners most commonly ask about Cookie Duration.

Does setting a short cookie duration mean I don't need consent for that cookie?
No. Duration and consent are separate concepts. Under the ePrivacy Directive and its national implementations in the EU, the requirement for prior consent generally depends on the purpose of the cookie (for example analytics or advertising) rather than how long it lasts. A non-essential cookie typically requires consent regardless of whether it expires in minutes or persists for a year. Shortening the lifespan may reduce certain privacy risks and support data minimisation, but it does not by itself remove a consent obligation. Note that requirements differ under US state frameworks, which often rely on opt-out mechanisms.
Does a cookie's expiry date determine how long my consent record remains valid?
Not directly. The technical expiry of a cookie and the validity of the consent that permitted it are distinct. A consent may need to be refreshed based on data protection authority guidance or organisational policy, independent of when the underlying cookie technically expires. In practice, some organisations align a stored consent's lifespan with a re-prompt interval, but there is no single duration mandated across all EU jurisdictions, and guidance on how frequently consent should be renewed continues to evolve. This entry does not resolve the specific interval any given authority may expect.
How is cookie duration typically classified?
Cookies are commonly categorised by duration as session cookies, which are generally deleted when the browser session ends, and persistent cookies, which remain on the device until a set expiry date or until manually removed. This is a technical distinction and does not by itself determine consent obligations, which generally turn on purpose. Similar technologies such as local storage, pixels, and SDKs may retain data on different timelines and can fall within the same rules even though they are not literally cookies.
Where can I find and verify a cookie's actual duration?
The expiry of an HTTP cookie is typically defined by its Max-Age or Expires attribute, which can be inspected using browser developer tools under the storage or application section. Relying solely on a third party's stated duration can be unreliable, so many teams verify durations directly and record them in a cookie audit or register. Be aware that some technologies, such as local storage or certain scripts, may not expire in the same way and can persist until explicitly cleared, so a cookie-only inspection may not capture the full retention picture.
Should I disclose cookie duration in my cookie notice or banner?
In most EU jurisdictions, information provided to users is expected to be sufficient for consent to be considered informed, and disclosing the duration or retention period of cookies is a common practice supported by various data protection authority guidance. Many CMPs surface duration alongside each cookie's purpose and provider. Whether a specific level of detail is strictly required can vary by jurisdiction and by the interpretation of the relevant authority, so this should be confirmed against the guidance applicable to your context.
How should third-party cookie durations be handled when I don't control them?
Durations set by third parties are defined by those providers and may change without notice, so many organisations document the stated duration at the time of audit and review it periodically. Because you generally remain responsible for what is placed on users' devices through your site, relying on third-party representations without verification carries risk. A tool or CMP can help detect and log these cookies, but it supports rather than replaces the legal judgment needed to assess your obligations, which vary between the EU, the UK, and individual US states.

Common misconceptions

Setting a long cookie duration means consent lasts for the same length of time.
A cookie's technical expiry and the validity period of a user's consent are separate concepts. Even where a cookie is set to persist for a long time, guidance in many EU jurisdictions suggests that consent should be refreshed periodically. There is no single universally fixed re-consent interval, and expectations differ by jurisdiction and evolving regulatory guidance.
Short-lived or session cookies never require consent because they expire quickly.
Duration alone does not determine whether consent is required. Under EU law, the need for consent generally depends on the purpose of the cookie rather than how long it lasts; strictly necessary cookies may be exempt regardless of duration, while analytics or advertising cookies typically require prior consent even if they are session-based.
The duration a website sets for a cookie is the duration it will actually have.
Browser policies, privacy settings, and user actions can shorten or override the intended lifespan, particularly for third-party cookies. The value set by the issuer represents an intended maximum, not a guarantee of persistence on the device.

Best practices

Document the intended duration of each cookie and similar technology, and distinguish clearly between session and persistent cookies in your records and disclosures.
Disclose cookie durations to users in accessible language within your cookie policy or consent interface, in line with transparency expectations under the applicable regime.
Treat consent validity and cookie expiry as separate parameters, and configure a re-consent interval informed by guidance from the relevant data protection authorities rather than tying it automatically to the cookie's lifespan.
Avoid setting durations longer than necessary for the stated purpose, and periodically review whether the retention period remains justified.
Account for browser-imposed limits on third-party cookie lifespans when relying on those cookies, and confirm behaviour through testing rather than assuming the configured value will apply.
Apply consistent duration and consent handling to non-cookie technologies such as local storage, pixels, and SDKs where they access or store information on a device, recognising their expiry mechanics may differ.