The question of how long cookie consent lasts sits at the intersection of GDPR's general consent rules and the specific technical reality of browser cookies. Unlike a signed document with an expiry date, cookie consent is recorded in a cookie — which can be deleted by the user, expire naturally, or be superseded by changes to your site's cookie setup. Managing consent duration correctly means understanding all the mechanisms through which consent can become stale.
What GDPR Actually Says About Consent Duration
GDPR is silent on specific timeframes. The relevant text — Article 7(3) and Recital 32 — deals with the conditions of valid consent, not its duration. The principle that emerges is that consent must remain valid for the processing it covers: if the processing changes, the consent may no longer be valid for the new processing.
The EDPB's operational guidance fills the gap. Guidelines 05/2020 state:
"In order for consent to be 'informed', the controller must ensure that the data subject is aware of and understands the processing for which consent is sought. [...] As time passes, [...] new technologies may emerge, and it may no longer be reasonable to rely on old consent."
From this, the EDPB extrapolates that consent should be renewed "at appropriate intervals." The EDPB does not define "appropriate" with a specific number, but its accompanying commentary and the guidance of national DPAs has consistently converged on 12 months as the outer bound.
The 12-Month Standard in Practice
Most EU supervisory authorities have adopted 12 months as their working standard for analytics and advertising cookie consent renewal:
| Authority | Recommended Renewal Period |
|---|---|
| EDPB (EU-wide) | Not specified — "appropriate intervals," broadly accepted as ~12 months |
| CNIL (France) | 6–13 months (13 months for the consent record cookie; 6 months for advertising-related purposes) |
| ICO (UK) | Does not specify — "periodically" — notes that 12 months is reasonable |
| Datatilsynet (Denmark) | Consent records valid for up to 12 months |
| Garante (Italy) | Not specified — consistent with EDPB's 12-month practice |
| AP (Netherlands) | Not specified — 12 months considered reasonable |
The CNIL's two-tier standard is worth noting: the cookie that records the consent decision itself (necessary to avoid re-showing the banner on every page) can persist for up to 13 months. The consent to analytics or advertising purposes, however, should be re-verified at 6 months according to CNIL's most conservative guidance. Most practitioners treat 12 months as a pragmatic middle ground that satisfies all of these requirements simultaneously.
What Triggers Re-Consent Before 12 Months
Time alone is not the only trigger for re-consent. Certain changes to your data processing require you to re-present the consent banner immediately — regardless of whether 12 months has elapsed since the user's last consent.
Changes that require immediate re-consent:
New third-party processors: If you add a new analytics provider, advertising pixel, or data sharing arrangement that was not listed in the banner when the user originally consented, the user has not consented to processing by that new party. You must re-present the banner naming the new processor. Example: a user consented to Google Analytics only; you then add the Meta Pixel. That user has not consented to Meta processing their data.
Changed processing purposes: If data previously collected for analytics begins to be used for profiling or targeted advertising — even if the same cookies are involved — this is a new purpose requiring fresh consent. GDPR Article 5(1)(b) prohibits processing for purposes incompatible with those for which consent was originally obtained.
New data transfers outside the EU/EEA: If a processor you use begins transferring data to a country without an adequacy decision, and this was not disclosed in the original consent, re-consent is required (along with a transfer impact assessment and appropriate safeguards).
Extended data retention: If you change data retention from 6 months to 3 years, the scope of processing has changed in a way that users who consented to the original shorter retention could not have anticipated.
Changes that do not typically require re-consent:
- Updating your CMP provider while keeping cookie purposes and processors identical
- Cosmetic or technical updates to the consent banner
- Updating Google Analytics from one version to another with the same data scope
- Changes to your server infrastructure that do not affect what data is processed or by whom
Consent Duration vs. Data Retention: A Critical Distinction
Consent duration and data retention are related but distinct concepts that are frequently confused.
Consent duration is how long the user's consent to data collection remains valid. After 12 months, you must re-obtain consent to continue collecting new analytics data.
Data retention is how long you keep the data you already collected. A 12-month consent period does not mean you must delete all data after 12 months — it means you must re-consent to continue collecting. Data already collected under valid consent can be retained for the period disclosed in your privacy policy (e.g., "Google Analytics data retained for 26 months") even if you do not re-obtain consent.
The practical interaction: if a user's consent expires and they do not re-consent, you must stop collecting new analytics data from that user, but you are not automatically required to delete historical data already collected under their previous valid consent. You are required to delete data if the user exercises their Article 17 right to erasure.
Record-Keeping for Consent Duration
GDPR Article 7(1) requires you to demonstrate that consent was obtained. In the context of consent duration, this means your records must show:
- When consent was given (timestamp)
- What version of the banner and privacy/cookie policy was displayed
- Which purposes the user accepted and rejected
- Whether consent has been renewed and when
This information is typically stored by your CMP. The consent record cookie on the user's device stores the timestamp and version; your CMP's backend logs the event with a pseudonymous user ID.
Retain these logs for at least 3 years from the date of consent. In enforcement proceedings, supervisory authorities routinely request consent audit logs covering the period under investigation. If you cannot demonstrate that consent was valid at the time of processing, the presumption runs against you.
Practical Implementation: Configuring Re-Consent in Your CMP
| Task | Implementation Detail |
|---|---|
| Set consent expiry to 12 months | Configure your CMP's consent lifetime setting to 365 days |
| Version your consent banner | Increment the version number whenever you change cookie purposes or processors |
| Trigger version-based re-consent | Configure CMP to re-present banner if stored version < current version |
| Test re-consent | Delete your consent cookie in browser dev tools; verify banner re-appears |
| Export consent logs | Schedule quarterly exports of consent logs to external storage for the 3-year retention period |
| Update cookie policy on change | Any material change to cookies or processors must be reflected in the policy before re-consent is presented |
| Notify existing users of material changes | Consider an in-site notification or email alert for significant processing changes, in addition to re-presenting the banner |
What Happens When You Ignore Consent Duration
The consequences of treating consent as permanent:
Ongoing unlawful processing: Any analytics or advertising data collected after consent has expired — and before re-consent is obtained — is processed without a valid legal basis under Article 6. Each day of unlawful processing is a continued breach.
Invalid consent in enforcement proceedings: If a supervisory authority audits your site and finds that consent records are years old, have never been renewed, and have not been updated to reflect new processors, they will treat the consent as invalid and the processing as unlawful from the point of expiry.
Compounding liability from data aggregation: Analytics data collected unlawfully continues to be processed (aggregated, compared to new data, used to make decisions) — the breach compounds over time.
Configure your Cookie Consent Banner correctly from the start — including consent duration, re-consent triggers, and version management — using our free Cookie Consent Banner Generator to get the right settings for your site's cookie stack.