The GDPR has no hard limits on cookie duration. In fact, the GDPR does not mention cookies or similar technologies at all, aside from listing cookie identifiers as an example for “online identifiers” which is one kind of identifying data.
Per the GDPR, you (the Controller) must limit the collection of personal data to the minimum that is necessary to achieve the purpose for which the data is processed. Keeping data for over two decades is unnecessarily long, aside from the problem that cookies are stored on the user's device and devices just aren't used that long.
More interesting are the requirements that the ePrivacy Directive (ePD) places on you. Again, ePD does not explicitly restrict for how long cookies may be valid. The ePD considers cookies “information stored in the terminal equipment of a subscriber or user”. You can access information on the user's device only if:
- there are technical reasons that make storage access strictly necessary for showing the website, or
An example for a strictly necessary cookie is a cookie that remembers the contents of a shopping cart, or a cookie that stores whether a site should be shown in dark mode. In the other case, the requirement to provide information and to obtain consent is the cause of all of these cookie banners.
The ePD has additional requirements that relate to marketing. For example, you may only process “traffic data” for marketing purposes
- for the duration that is necessary for the marketing, and
- if the user has given consent
Traffic data very likely includes data on which pages the user has visited.
For you, the combined requirements of GDPR and ePD seem to be:
- you may only read or write this cookie if the user has given their consent
- you may only store the cookie for as long as actually necessary
- there is no hard limit of 12 months anywhere in the laws, but that sounds like a reasonable duration
- multiple decades are unrealistically long