Cookie Lifespans: The 6-Month Choice Renewal vs 13-Month Tracker Rule Explained

Executive Technical Brief & Market Reality

Standard martech implementations systematically violate French and European privacy law by confusing three distinct operational clocks. Google Analytics 4 (GA4), Meta Pixel, and major Customer Data Platforms (CDPs) ship with default client-side lifespans set to 730 days (24 months). Furthermore, these vendors configure sliding-window expirations that refresh the cookie's expiration timestamp on every pageview.

Under Commission Nationale de l'Informatique et des Libertés (CNIL) Deliberation No. 2020-091 and Deliberation No. 2020-092, this default behavior constitutes a regulatory infraction under Article 82 of the French Data Protection Act ↗ (transposing Article 5(3) of the ePrivacy Directive ↗ 2002/58/EC). The CNIL establishes three distinct temporal boundaries:

• The 6-Month Rule (Consent Choice Retention): The user's decision—whether accepting or refusing tracking—must be remembered for a benchmark duration of 6 months. Prompting a user with a consent banner every session or every 30 days constitutes consent harassment and invalidates consent freely given under GDPR Article 4(11) and Article 7.
• The 13-Month Rule (Terminal Tracker Lifespan): The lifespan of tracking cookies, including audience measurement identifiers exempt from consent, cannot exceed 13 months from the initial deposit. Crucially, this duration must not be extended automatically upon subsequent visits.
• The 25-Month Rule (Raw Telemetry Retention): Raw analytics event logs, IP addresses, and pseudonymous visitor IDs stored in processing databases must have a hard retention limit of 25 months before mandatory deletion or irreversible anonymization.

Architectural & Technical Deep Dive

Enforcing compliance requires decoupling the consent recording mechanism from the analytical identifiers. In web architecture, two separate domains of storage must be calibrated: the Consent Management Platform (CMP) local state and the vendor tracking scripts.

1. Neutralizing GA4 Sliding Expiration via gtag.js

By default, GA4 sets the _ga and _ga_<container-id> cookies with a 2-year duration (63072000 seconds) and enables cookie_update: true. This sliding window extends the cookie lifespan by 2 years on every single hit, directly violating CNIL requirements. To enforce the 13-month (34,186,667 seconds) static limit, engineering teams must override these parameters directly in the initialization call:

// Compliant GA4 Initialization under CNIL 13-Month Rule
gtag('config', 'G-XXXXXXXXXX', {
  cookie_expires: 34186667, // 13 months in seconds
  cookie_update: false,     // Strictly prevents automatic expiration extension on return visits
  cookie_flags: 'SameSite=Lax;Secure'
});

2. Hardening CMP Response Headers (The 6-Month Consent Record)

Consent status storage must not rely on unmanaged client-side localStorage if cross-subdomain governance is required. Instead, write an explicit HTTP response header with an absolute expiration date. The Max-Age for the consent cookie must reflect exactly 180 days (15,552,000 seconds):

HTTP/2 200 OK
Set-Cookie: cnil_consent_status=granted; Max-Age=15552000; Path=/; Domain=.example.com; Secure; HttpOnly; SameSite=Lax

3. The Safari ITP Divergence

While the CNIL enforces an upper ceiling of 13 months, Apple's Intelligent Tracking Prevention (ITP) in Safari imposes a client-side lower ceiling. Cookies written via JavaScript (document.cookie) are capped at 7 days. If a user arrives via an ad link containing query parameters (e.g., gclid, fbclid), ITP 2.1+ truncates that lifespan to 24 hours.

Engineering teams running server-side tagging (e.g., via a Server-Side GTM container deployed on a first-party subdomain) bypass the 7-day browser cap. However, circumventing Safari's ITP via server-side Set-Cookie headers while ignoring the CNIL 13-month cap exposes organizations to significant GDPR/ePrivacy liability under CJEU case law (C-673/17 Planet49).

Regulatory & Legal Risk Matrix

The table below provides a forensic analysis of the regulatory limits established by European data protection authorities compared against default vendor behavior and corresponding enforcement mechanics.