Privacy
Tracking cookies do not outstay the consent behind them
privacy.long-lived-cookies
Why this matters
A tracking cookie carries the permission it was set under, and permission does not last forever. Regulators across Europe have converged on around thirteen months as the point at which a site should ask again, on the reasoning that somebody who agreed to be measured last year has not agreed to be measured indefinitely. Several popular analytics tools still default to a two-year lifetime, so this is usually a setting nobody chose rather than a decision. Browsers now cap what they will store at a little over a year regardless, which hides the difference between a long setting and an absurd one.
Who fixes it
You can, usually
Roughly how long
20 minutes
Care needed
Low risk to change
How to fix it
Most tools expose this as a setting. In Google Analytics 4 it is Admin → Data Settings → Data Retention, and the cookie lifetime itself is the `cookie_expires` parameter on the config tag — set it to 34128000 seconds for thirteen months. Consent tools usually have their own re-ask interval, which should be set to match.
How we score it
Failing this check takes up to 8 points off your privacy score. It is a fact about your site rather than a measurement, so it reads the same on every scan until you change something.
Does your site pass this one?
This check runs on every scan, along with the other 106. Free, no account, and you see the evidence for each result.
Check my siteOther privacy checks
- Cookies the site sets are explained somewhere on itAnyone whose site stores cookies has to tell visitors what is stored, who by and how long it lasts, in language an ordinary person can follow. It is a standing obligation rather than a one-off, and it applies to cookies that needed permission and to the ones that did not. A site with tracking on it and nothing anywhere explaining that tracking is the clearest version of getting this wrong, and it is also the easiest to put right.
- Every company your site shares visitors with is one you know aboutA cookie stored against another company's domain means that company saw the visit — the address of the page, the browser, the address it came from — and can recognise the same person on any other site it is embedded in. Under UK data protection law the site owner is responsible for that sharing and has to tell people it happens, whether or not the cookie itself needed consent. Most owners are unaware of half the list, because the companies arrive attached to a plugin or an embedded video rather than by decision.
- Nothing is stored on a visitor's device before they agree to itUK law treats putting anything on a visitor's device — a cookie, or a record kept in the browser's own storage — as something that needs permission first, unless it is genuinely required to deliver what the visitor asked for. Analytics does not count as required, however anonymous it is, and the Information Commissioner's Office has said so repeatedly. This is one of the few things a website audit finds where the risk is a regulator rather than a lost sale.