How long should cookies live?
Consent-based cookies should expire within 13 months. Set Max-Age on your own cookies and the expiry option on analytics and ad tags.
Step by step, with screenshots: What are cookies on a website? First-party, third-party, session and persistent →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
Or run only this check with the free Cookie scanner (GDPR consent).
What it is
Cookie lifetime is how long a browser keeps a cookie before deleting it, set by the cookie's Expires date or Max-Age in seconds. Without either, the cookie is a session cookie and disappears when the browser closes.
Many tracking cookies are set for two years or more, far longer than any analytics or advertising use needs. France's CNIL and Spain's AEPD recommend at most 13 months for consent-based cookies. Browsers already trim lifetimes: Chrome caps any cookie at 400 days, and Safari limits cookies set by scripts to 7 days.
OK looks like this: tracking cookies expire within 13 months and your own cookies have a lifetime that matches their purpose. getReport lists the cookies on the page that live longer than 13 months.
What a passing site looks like
- Cookie lifetime: passesinfo onlyeffort S
Questions people ask
Do cookies expire?
Yes. Each cookie has an expiry set by the site, either a date (Expires) or a number of seconds (Max-Age); when it passes, the browser deletes it. Cookies without either are session cookies and are deleted when the browser closes. Visitors can also delete cookies at any time.
What is a cookie expiration date?
It is the moment after which the browser deletes a cookie, sent by the server in the Expires attribute, for example Expires=Wed, 21 Oct 2026 07:28:00 GMT. You can see it for each cookie in the browser's developer tools under Application or Storage. It should match how long you really need the data.
How long can a browser cookie last?
In Chrome, at most 400 days, even if the site asks for longer. Safari deletes cookies set by JavaScript after 7 days, or sooner in some tracking cases. Other browsers vary. For consent-based cookies, 13 months is the maximum EU regulators such as the CNIL recommend.
What is the difference between Expires and Max-Age?
Expires sets an absolute date and time when the cookie ends; Max-Age sets a number of seconds from now. If both are present, Max-Age wins. Max-Age avoids problems with a wrong clock on the visitor's device, so it is the better choice for new code.