Cookie duration explained, from session cookies to browser caps

How long a cookie lasts depends on its type and on the browser. A session cookie has no expiry date and disappears when the browser session ends. A persistent cookie lasts until the date in its Expires or Max-Age attribute, but browsers cut that short: Chrome caps every cookie at 400 days, and Safari caps cookies set by JavaScript at 7 days. The law adds its own limit, because the GDPR allows personal data to be kept only as long as its purpose needs.

That single expiry setting decides whether a visitor stays signed in, how long an abandoned basket survives and when a privacy-conscious browser deletes tracking data. Website owners who ignore the limits get inaccurate analytics, broken sessions and cookie policies that state lifespans the browser never honours.

Session cookies and persistent cookies

Session cookies exist only in temporary memory while the user navigates your website. Web browsers automatically delete them the moment the user closes the window or quits the application. They carry no Expires or Max-Age attribute, as MDN's guide to HTTP cookies describes. They handle immediate, essential tasks like keeping a user authenticated as they move between pages or remembering the items added to an e-commerce basket.

Because they disappear so quickly, regulators generally view session cookies as low-risk for user privacy.

Persistent cookies work differently. They stay on the device until they reach a specific expiration date coded by the developer, or until the user manually clears their browser cache.

A persistent cookie might remember a language preference for your next visit, or it might track your browsing behaviour across multiple websites for targeted advertising. You can spot them in the Set-Cookie HTTP response header, which carries a Max-Age or Expires attribute. Without these limits, a persistent cookie could theoretically track a user forever. That is why both regulators and browsers now limit how long they last.

Privacy law limits duration through storage limitation

The cookie categories on your site dictate how long you can legally store them. The ePrivacy Directive, the General Data Protection Regulation (GDPR), and the CCPA work together to enforce the principle of data minimisation.

Article 5(1)(e) of the GDPR requires that personal data be kept for no longer than is necessary for the purposes of processing. This means you cannot set a Google Analytics cookie to expire in 2099 just to capture returning visitor data indefinitely. Most European Data Protection Authorities (DPAs) interpret this storage limitation strictly. They require website owners to set proportionate lifespans based on the specific function of each tracker.

An excessive duration breaches that storage-limitation principle, whatever the visitor agreed to.

The CNIL, France's data protection authority, gives some of the clearest figures. For audience-measurement cookies that run without consent, it sets a 13-month maximum lifespan, not extended on later visits, and a 25-month maximum for keeping the data collected.

The 13 months is a cookie lifespan, not a consent-renewal rule. The CNIL enforces actively: in 2025 alone it issued 83 sanctions and 143 compliance orders, and companies such as Criteo and Doctissimo have been fined over consent failures. This storage limitation principle is mirrored in global frameworks, including Brazil's LGPD.

If a user rejects tracking, you must respect that choice. The CNIL treats keeping a visitor's choice, including a refusal, for about six months as good practice before asking again.

Browsers enforce shorter cookie lifespans

Even where the law would allow a longer lifespan, browsers override it. Apple and Google now enforce hard technical limits on how long trackers can survive on a user device.

Apple's Safari uses Intelligent Tracking Prevention (ITP) to block cross-site tracking. Since February 2019, ITP caps cookies created with JavaScript's document.cookie at 7 days, and since Safari 13.1 in 2020 it deletes all script-writeable storage, such as localStorage, after 7 days of Safari use without interaction with your site. If Safari detects tracking parameters in the URL - a technique known as link decoration - it slashes that duration to just 24 hours. This severely impacts affiliate marketers and analytics platforms that rely on long-term browser memory to attribute conversions.

Since Safari 16.4, server-side cookies are capped at 7 days too when they come from a third-party server behind a CNAME, or from a server whose IP address differs from your site's.

Google Chrome takes a broader but slightly more generous approach. Since Chrome 104 (August 2022), Chrome caps the lifespan of every cookie at 400 days, a limit taken from the draft update of the cookie standard (RFC 6265bis).

If a developer tries to set an expiration date further in the future, Chrome rewrites it to 400 days from the moment it was set. When Chrome announced the cap, Mozilla and WebKit had given the 400-day limit positive feedback but not implemented it, so check Firefox's current behaviour before relying on a cap there. Microsoft Edge is built on Chromium and follows Chrome's cookie engine. These browser-level interventions prove that relying solely on client-side storage for long-term user identification is no longer a viable technical strategy.

Shorter lifespans change your analytics

Shortened lifespans cause major headaches for marketers relying on Google Analytics 4 or similar platforms. When a Safari user returns to your site after eight days, they appear as a completely new visitor.

This artificial fragmentation inflates your unique user counts and destroys your ability to track multi-touch attribution over long sales cycles. Some developers attempt to bypass these limits by using complex server-side tracking setups or storing identifiers in LocalStorage. Browser engines close these routes too: Safari deletes localStorage and other script-writeable storage after 7 days without interaction, whatever the tracker.

You must ensure your consent management platform clearly communicates these retention periods to your visitors. Your cookie policy should state the same lifespans the banner shows.

How to set expiry dates you can justify

Auditing your data retention settings requires a systematic approach. You should review every tracker currently active on your domain and justify its lifespan. If a tracker processes personal data, tie its duration directly to the business purpose you declared when collecting consent. Pay special attention to third-party marketing tags, as these frequently attempt to set excessively long retention periods by default.

Functional cookies that remember language preferences or regional settings can generally last for several months, as users expect this convenience. Marketing trackers should have much shorter lifespans, typically between 3 and 6 months.

Reviewing your technical configuration is just as critical. Check your cookie definitions for Max-Age attributes and ensure they match your publicly stated privacy policy. Run regular scans to catch third-party scripts that inject trackers with infinite lifespans. If you operate in Europe, ask for consent again after a fixed period: regulators' guidance ranges from about six months for a stored choice to 12 or 13 months as an outer limit.

Short answers about cookie duration

See the real lifespan of every cookie your site sets

If you are struggling to map the lifespans of third-party cookies on your site, start with a scan. Kukie.io lists the cookies it finds with their duration and a suggested category, ready for your cookie policy.

Start free