How Long a Yes Lasts: The Six-Month Consent Clock
Ask five consent teams how long a yes lasts and you get five numbers: six months, a year, two years, until the visitor clears cookies, forever. Only one of those numbers comes from a regulator. The rest come from library defaults nobody changed and browser behavior nobody measured.
The law does not hand you a number. Neither the ePrivacy Directive nor the GDPR sets a duration, and the ICO says so directly. What exists is guidance, and it is more consistent than most teams realize.
What the regulators actually say
The CNIL's recommendation of September 17, 2020 calls keeping the choice, consent and refusal alike, for six months good practice. The Garante's cookie guidelines of June 10, 2021 say the banner should not be shown again unless processing changes significantly, the site cannot tell whether a cookie was already stored, or at least six months have elapsed since the banner was last presented. The ICO's storage guidance, updated April 29, 2026, recommends six months as a suitable timeframe to request fresh consent after a refusal.
Spain's AEPD is the outlier at the top: its cookie guide says good practice is for consent to stay valid for no more than 24 months. The Digital Omnibus proposal would write the six-month floor into law, with Article 88a(4)(c) saying a controller shall not make a new request for the same purpose for at least six months after a refusal. Read together, the range is six to twenty-four months, and six is the number three regulators agree on.
What the libraries ship
The CMP libraries default to something else. Vanilla-cookieconsent ships at 182 days. Klaro's code says 120 days, but its sample config sets 365, so copied configs usually say 365. Tarteaucitron and c15t both default to 365. A team that installs a library and never touches the expiry has chosen a year by accident, and the consent record carries no note explaining why.
The same mismatch shows up in the analytics identifiers. Google Analytics 4 and Meta Pixel ship with 730-day defaults for client-side identifiers. The CNIL caps tracking cookies at 13 months, not extended on later visits, and raw analytics data at 25 months. Your consent record and your analytics cookies are on different clocks, and the shorter one is the one a regulator will measure.
The browser has its own say
Chrome caps every cookie at 400 days, a limit in place since version 104 in August 2022. Safari goes further: a consent cookie written by JavaScript is deleted after seven days without a click, tap, or keypress on your site, whatever expiry you gave it. A visitor who returns after eight days on Safari sees the banner again, and no policy setting changes that.
The setup that survives scrutiny is dull on purpose: six months for accept and reject alike, a re-ask only when processing changes or the period lapses, and a line in the record saying six months was chosen because three regulators converge on it. When the banner reappears, the answer is in the record, not in a support ticket.
Keep reading: When Your CMP Changes Its Tracker List: Who Has to Consent Again, White Label Cookie Consent: What It Is and How to Choose a Platform, The AI Chatbot on Your Site: The Widget That Tracks Before It Asks cover the nearby cases in this series.
Frequently asked questions
Is there a legal maximum for how long cookie consent lasts?
No single statute sets one. The GDPR and ePrivacy Directive require data to be kept only as long as necessary, and regulators fill in the number: six months from the CNIL, Garante, and ICO, with Spain's AEPD allowing up to 24 months.
Do CMP libraries default to the regulator guidance?
No. Vanilla-cookieconsent defaults to 182 days, Klaro to 120 in code, and tarteaucitron and c15t to 365. Most sites run a year because nobody changed the default, not because anyone chose it.
Why does Safari show the banner again after a week?
Safari deletes a JavaScript-set cookie after seven days without interaction on your site. That is the browser's tracking prevention, not a CMP failure, and no expiry setting overrides it.
Should a refusal last as long as an acceptance?
Yes. Use the same duration for both. The CNIL frames the six-month guidance as applying to consent and refusal alike, and a short refusal window next to a long acceptance window reads as pressure to accept.