The essentials
- Storage limitation (Art. 5(1)(e) GDPR) applies to identifiers kept in cookies.
- The French CNIL recommends at most 13 months for audience and advertising trackers, a widely used benchmark.
- Many tools set two-year identifiers by default: that is a finding, and usually a setting.
The principle
The GDPR's storage limitation principle (Article 5(1)(e)) requires keeping personal data no longer than necessary for its purpose. A cookie carrying an identifier is such data, so its lifetime has to match its purpose.
The 13-month benchmark
The French authority CNIL, in its 2020 guidelines and recommendation on cookies, recommends that trackers used for audience measurement or advertising live no longer than 13 months, and that a visitor's choice be asked again after a reasonable period. Authorities elsewhere, including in Germany, assess lifetimes case by case under the same principle; the 13-month figure is widely used as a benchmark.
session_id_hjSessionconsent_gaWhat we flag
Seqlense GDPR measures the lifetime of every persistent cookie a page sets and flags those kept longer than 13 months (400 days). Session cookies, which disappear when the browser closes, are reported separately.
Typical findings
- Analytics or advertising identifiers set for two years by default.
- Consent-tool cookies kept far longer than the choice they record should be.
- Persistent cookies sent without the Secure flag.
Checklist
- List every persistent cookie with its lifetime, on every important page.
- For analytics and advertising identifiers, a lifetime of 13 months or less (check the tool settings: many default to two years).
- Consent choices re-asked after a reasonable period.
- Lifetimes stated in the cookie policy match what the browser actually receives.
Sources
- Article 5(1)(e) GDPR (storage limitation).
- CNIL, deliberations no. 2020-091 (guidelines) and 2020-092 (recommendation) of 17 September 2020 on cookies and other trackers.
General information, not legal advice. Have your specific situation reviewed by your DPO or counsel.