1

I am working on a task that requires to set cookie expiry date to Jan 2038. This cookie is used for showing personalized content to end user e.g. If user is on Home page and he clicks on Business Insurance page and then browse back to Home Page, he should see marquee specific to Business Insurance.

I came across an article which states that persistent cookies should not last more than 12 months!

In my case - apart from tracking ‘specific’ pages visited by user I am not storing any personal data here. So does this rule applies to me? Am I free to extend expiry date till 2038 or restrict it for 12 months?

Improve this question
1
  • 1
    The article you link to, explains: "According to the ePrivacy Directive, they should not last longer than 12 months". The text of the ePrivacy Directive is here. In particular recital 25 and Art. 5(3) are about cookies. I can't find anything specifying 12 months. Related question: How often does a website have to ask for cookie consent?.
    – wimh
    Aug 27, 2019 at 16:32

1 Answer 1

Reset to default
1

The GDPR has no hard limits on cookie duration. In fact, the GDPR does not mention cookies or similar technologies at all, aside from listing cookie identifiers as an example for “online identifiers” which is one kind of identifying data.

Per the GDPR, you (the Controller) must limit the collection of personal data to the minimum that is necessary to achieve the purpose for which the data is processed. Keeping data for over two decades is unnecessarily long, aside from the problem that cookies are stored on the user's device and devices just aren't used that long.

More interesting are the requirements that the ePrivacy Directive (ePD) places on you. Again, ePD does not explicitly restrict for how long cookies may be valid. The ePD considers cookies “information stored in the terminal equipment of a subscriber or user”. You can access information on the user's device only if:

  • there are technical reasons that make storage access strictly necessary for showing the website, or
  • the user is provided with clear and comprehensive information about your use of cookies (compare GDPR Art 13), and the user can refuse the cookies. This generally means that you must obtain consent prior to setting or accessing cookies.

An example for a strictly necessary cookie is a cookie that remembers the contents of a shopping cart, or a cookie that stores whether a site should be shown in dark mode. In the other case, the requirement to provide information and to obtain consent is the cause of all of these cookie banners.

The ePD has additional requirements that relate to marketing. For example, you may only process “traffic data” for marketing purposes

  • for the duration that is necessary for the marketing, and
  • if the user has given consent

Traffic data very likely includes data on which pages the user has visited.

For you, the combined requirements of GDPR and ePD seem to be:

  • you may only read or write this cookie if the user has given their consent
  • you must provide clear information about your use of cookies and what data you store
  • you may only store the cookie for as long as actually necessary
    • there is no hard limit of 12 months anywhere in the laws, but that sounds like a reasonable duration
    • multiple decades are unrealistically long
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .