I'm working on a website that requires cookie consent because of the GDPR. After the user agrees to storing cookies, the browser will store this data for 10 years. Using another browser, device, or clearing their cookies will reset this timer.

10 years is a completely arbitrary number that I came up with, but I was wondering if the GDPR has any specific guidelines on how often the website should ask for cookies.

  • 1
    By "the browser will store this data for 10 years" are you talking about the (potentially personal) data collected in the cookies, or do you mean you're storing the users' consent to use cookies?
    – TripeHound
    Commented Jun 6, 2019 at 14:39

4 Answers 4


Neither the GDPR or the EPrivacy Directive specify any duration. However, on 1 October 2019 the CJEU ruled in Case C‑673/17 (Verbraucherzentrale Bundesverband vs. Planet49 GmbH) that users must be informed of the duration before they consent to store cookies:

  1. Although the duration of the processing of the data is not included as part of that information, it is, however, clear from the words ‘at least’ in Article 10 of Directive 95/46 that that information is not listed exhaustively. Information on the duration of the operation of cookies must be regarded as meeting the requirement of fair data processing provided for in that article in that, in a situation such as that at issue in the main proceedings, a long, or even unlimited, duration means collecting a large amount of information on users’ surfing behaviour and how often they may visit the websites of the organiser of the promotional lottery’s advertising partners.

  2. That interpretation is borne out by Article 13(2)(a) of Regulation 2016/679, which provides that the controller must, in order to ensure fair and transparent processing, provide the data subject with information relating, inter alia, to the period for which the personal data will be stored, or if that is not possible, to the criteria used to determine that period.

So you can store the cookie forever, if you inform the user about the duration before they consent to storing cookies. As consent must be 'freely given', they can refuse if they don't accept that.


If you are storing data on the user then you need a lawful basis. The GDPR provides several, of which "consent" is only one.

You don't actually need a GDPR basis to store cookies on the user's computer. However if those cookies identify the user or store personal data then you do need a GDPR basis to do any processing on those cookies at your end. The typical situation is that you put a cookie containing a user ID on the user's computer, and back on your server there is a database which is keyed by that user ID. That way whenever the user comes back to your site you can match them to the database records. I'll assume this is the architecture you are using.

(The alternative scenario is that the cookies contain only user settings which are not tied to any data at your end, in which case you don't need to worry about the GDPR).

You need to consider each piece of processing you want to do with the user data and establish a lawful basis for it. This needs to be written up. Once you have established the lawful basis you will be able to determine how long you can keep the user data. Data minimisation is an important principle in GDPR.

Consent is actually the weakest of the lawful bases for processing, so you should try to establish one of the others first. If you do need consent for some of the processing then its important not to try to nudge the user into giving consent: pre-checked tick boxes and hidden opt-out forms don't count as consent.

  • Almost no website that I have seen in the recent months meets these requirements. Some make it practically impossible to opt out, some make it impossible. I assume that any such site processing data based on consent does so illegally.
    – gnasher729
    Commented Jun 6, 2019 at 13:44
  • 1
    @gnasher729 Yup. Most websites that depend on advertising are indeed in violation of the GDPR. Commented Jun 6, 2019 at 13:55
  • Requirements for consent to the use of cookies are based on the EPrivacy Directive. It refers to the GDPR how to obtain consent. So even if you have another lawful base for processing the personal data in the cookies, you still need consent to store the cookies itself. (There are some exceptions in particular when they are strictly necessary).
    – wimh
    Commented Jun 6, 2019 at 18:25

Cookies are tools that process Personal Data and under GDPR Processing requires a Lawful Base.

Accepting the Cookies Policy will still mean that the user may opt-out from some Cookies being used to process his/ her Personal Data... so "accept Cookies Policy and that's it" is not a valid approach.

Personal Data Processing derives from "Purpose" and "Scope" under a Lawful Base and Services are finite, so you MUST erase the information gathered by Cookies once the Service ceases if there is no Legal Obligation to maintain it (ususally there is not, in opposition to let's say invoices that must be kept for 7 years but do not derive from Cookies Processing).

10 years for Cookies really seems way too much... it is not arbitrary, it MUST derive from the "need to process", having the DAta Subject aware of it and always enabling him/ her to opt-out.

Your Cookies Policy needs to detail WHAT each Cookie does and their relevancy towards the Services being rendered.

Some Cookies may act as Service enablers, therefore you need to explain that if the user opts-out from those, he/ she may not get the service that was contracted or expected.

Other Cookies are relevant for you as a company (e.g. Google Analytics), so the user (Data Subject) may really opt-out at any time, for there is no impact in the Service towards him/ her.

Then you may have Cookies that profile the user... well, regarding those you better comeup with a good explanation on why the user will hugely benefit from them... people is getting scared by the day, and opting out from anything that "smells" like "profiling".

If you are a developer, you should really get support from someone who knows about GDPR and not try to do your best, for ... well... do not take this wrong but odds are you will not do an assertive job.

Retention Period under GDPR... (39) ensuring that the period for which the personal data are stored is limited to a strict minimum. + (45) disclose (...) the storage period + (61) + (65) Data Subject has the ‘right to be forgotten’ where the retention of such data infringes this Regulation + Article 5 (e) + Article 6 (3) (b) + several more...

  • Can you edit your answer so that there are paragraphs - this wall of text is unintelligible. Also, don't add to your answer in comments, add to your answer in the answer.
    – Dale M
    Commented Jun 6, 2019 at 1:55
  • Requirements for consent to the use of cookies are based on the EPrivacy Directive. It refers to the GDPR how to obtain consent. Other parts of the GDPR do not apply to (obtaining consent for) the cookies itself.
    – wimh
    Commented Jun 6, 2019 at 18:32
  • Cookies do not require Consent under the ePrivacy Directive (we shall see under the ePrivacy Regulation which is soon to come out)... now, under GDPR Cookies are automated processing tools and processing requires a Lawful Base... if Consent is the applicable Lawful Base then the buse of Cookies requires Consent, yet not by Consenting to the Cookies Policy (becasue it implies many distinct "purposes" and "scopes") but the Service which uses the Cookie. That is why you do not consent to the Cookies Policy (you may opt out from specific Cookies), but you Consent to the service that uses the Cooki Commented Jun 7, 2019 at 10:49

You could vary the amount of time you store the consent, but why would you? You can just keep a record that the user accepted the use of the cookie then let them opt out when they choose.

  • 2
    Is this supposed to be based on the text of the GDPR? This answer would really benefit from actually talking about the law. Commented Jun 5, 2019 at 21:51
  • It's as based on the GDPR as the other answer is.
    – Putvi
    Commented Jun 5, 2019 at 21:52
  • 2
    Is that supposed to justify an answer which doesn't refer to the GDPR in any way? At least the other answer talks about what's required by the GDPR, if in a rather difficult to read fashion. I can't distinguish this from someone's random opinion. Commented Jun 5, 2019 at 22:01
  • I can't add a time limit to it. It's just based on the specific case and therefore telling him he can vary the time is correct.
    – Putvi
    Commented Jun 5, 2019 at 22:03
  • Requirements for consent to the use of cookies are based on the EPrivacy Directive. It refers to the GDPR how to obtain consent. The GDPR does not specify any duration. So this answer is basically fine. Because the GDPR does not specify the amount of time, there is nothing to quote. Other aspects of the GDPR like data minimization do not apply because the EPrivacy Directive does not contain or refer to such a requirement.
    – wimh
    Commented Jun 6, 2019 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .