Skip to main content
Cookie Gate

Industry Report

Cookie Lifespans by Category, and Where They Cross the Line

Why persistence is one of the clearest indicators of privacy risk in any audit, from session cookies to advertising identifiers that last two years or more.
13 months
Typical median duration for analytics cookies, a platform default most organizations never adjust.
12-24 months
Common lifespan range for advertising identifiers, the longest-lived category by a wide margin.
2+ years
Common maximum declared for marketing and advertising cookies.
31%
Average share of third-party cookies not disclosed in the site's cookie policy.

State of Cookie Compliance

Get the persistence benchmarks

A 21-page industry report on cookie types, persistence, and undisclosed third-party tracking. Grounded in GDPR, ePrivacy, and ICO/CNIL guidance.
  • Median and maximum durations by category
  • The GDPR storage-limitation exposure explained
  • A four-level maturity model + six remediation steps
State of Cookie Compliance
REPORT

Download the report

Grounded in GDPR, ePrivacy, and ICO/CNIL guidance.

Verifying you're human...

Your cookies persist far longer than you can justify, and nobody set that deliberately

Major platforms ship with multi-month expiry defaults that get baked into tag manager configurations site operators never revisit. A cookie that expires when the tab closes carries fundamentally different legal weight than one that tracks a user for two years. Without a live scan, privacy teams are working from assumption rather than evidence about what is actually storing data on user devices, and for how long.

Median and maximum durations by category, from session cookies to two years and beyond
Why the 13-month analytics default is so common and so rarely adjusted
How advertising identifiers concentrate the longest persistence, at 12 to 24 months
Where long lifespans create storage-limitation exposure under GDPR Article 5(1)(e) and Recital 39
How purpose-specific consent breaks when a cookie outlives the context it was accepted in
Why orphaned trackers from lapsed vendors keep firing, and how scheduled scans catch them

Cite real benchmark percentages to leadership

Bring duration figures drawn from actual enterprise scans to retention reviews, instead of vague best-practice advice.

Anchor every finding to a specific provision

Map persistence risk directly to named GDPR articles, ePrivacy Directive provisions, and ICO, CNIL, and EDPB guidance.

Name the failure patterns and their legal basis

Explain prior-consent firing, consent-string mismatch, and undisclosed vendors in terms a regulator would recognize.

Act on a ranked remediation plan

Place your program against a four-level maturity model and work through six risk-ranked remediation steps immediately.

Automated scans of real sites

Based on automated cookie scans of a sample of enterprise and mid-market sites across retail, financial services, healthcare, media, and SaaS.

Standards-informed framework

Classification framework informed by IAB Europe TCF purposes and UK ICO and French CNIL guidance on cookie categories.

Conservative methodology

Each site scanned three times over two weeks, with the most expansive result used as the baseline, read as a floor not a ceiling of real activity.

Grounded in regulation

Cites GDPR Articles 5, 6, 7, 13, 28, and 30, Recitals 32 and 39, the ePrivacy Directive Article 5(3), Article 29 Working Party Opinion 04/2012, and EDPB Guidelines 2/2023.

Published October 2026 by Cookie Gate.

The report focuses on cookie and consent requirements under EU and EEA law. It does not address the laws of the UK, US, Canada, or Brazil except where noted.

See what your cookies are actually storing, and for how long

Get the persistence benchmarks grounded in GDPR, ePrivacy, and ICO/CNIL guidance.