Cookie Lifetime Audit

Auditing Cookie Lifetimes

Overview

Cookie lifetime is a critical compliance factor often overlooked in consent implementations. The CNIL recommends a maximum cookie lifetime of 13 months from the point of collection, after which consent must be renewed. The CJEU in Planet49 (Case C-673/17) established that cookie duration must be disclosed to users before consent is obtained. Additionally, browser-enforced restrictions — Safari's Intelligent Tracking Prevention (ITP), Firefox's Enhanced Tracking Protection (ETP), and Chrome's third-party cookie deprecation — impose technical limits on cookie lifetimes that may conflict with server-set durations. A cookie lifetime audit identifies cookies exceeding regulatory or technical limits and ensures accurate duration disclosure.

Cookie Duration Classification

Session vs. Persistent Cookies

Duration Categories

CNIL 13-Month Recommendation

Regulatory Basis

CNIL's Recommendation on Cookies (1 October 2020, following Deliberation 2020-091 of 17 September 2020) states:

"The duration of validity of the consent of the user to the deposit of trackers should not exceed thirteen months. At the end of this period, the consent of the user should be collected again."

This 13-month maximum applies to:

• The consent cookie itself (the cookie that records the user's consent choice)
• Non-essential tracking cookies (the cookies enabled by consent)

Impact on Common Cookies

Cookies Exceeding CNIL 13-Month Limit:

GA4 Cookie Lifetime Configuration for Pinnacle E-Commerce Ltd

Override default GA4 cookie duration to comply with CNIL:

gtag.js implementation:

javascriptCopy code
gtag('config', 'G-PINNACLE123', {
  'cookie_expires': 34128000,     // 395 days (~13 months) in seconds
  'cookie_update': true,           // Refresh cookie on each visit
  'cookie_domain': '.pinnacle-ecommerce.com',
  'cookie_flags': 'SameSite=Lax;Secure'
});

GTM implementation: In the GA4 Configuration tag, set the field:

• Field name: cookie_expires
• Value: 34128000

Browser-Enforced Lifetime Restrictions

Safari Intelligent Tracking Prevention (ITP)

Safari imposes strict cookie lifetime caps:

Impact on Pinnacle E-Commerce Ltd:

• GA4 _ga cookie set via JavaScript: Effective lifetime is 7 days on Safari, not 2 years
• Server-side tagging (via data.pinnacle-ecommerce.com) sets _ga via Set-Cookie header: Full configured lifetime applies
• Google Ads click IDs in URL parameters: _gcl_au cookie capped at 24 hours on Safari

Firefox Enhanced Tracking Protection (ETP)

Chrome Third-Party Cookie Changes

As of 2025, Chrome has moved toward a user-choice model for third-party cookies rather than full deprecation:

Cookie Lifetime Audit Process

Step 1: Extract Current Cookie Lifetimes

For each cookie on pinnacle-ecommerce.com, record:

Step 2: Compare Against Limits

Step 3: Verify Disclosure Accuracy

Compare actual cookie lifetimes with durations stated in the cookie policy:

Step 4: Generate Remediation Plan

For Pinnacle E-Commerce Ltd:

1. Immediate: Override GA4 cookie duration to 13 months (cookie_expires: 34128000)
2. Short-term: Implement server-side tagging for _ga, _fbp cookies to bypass Safari ITP 7-day cap
3. Medium-term: Implement automatic consent recollection at 6 months (CNIL reconsent cycle)
4. Ongoing: Add cookie lifetime checks to CI/CD pipeline — flag any new cookie with duration > 13 months

Key Legal and Technical References

• CNIL Deliberation No. 2020-091 (17 September 2020) — 13-month maximum cookie lifetime recommendation
• CNIL Recommendation on Cookies (1 October 2020) — Practical implementation of lifetime limits
• CJEU Case C-673/17 (Planet49), para. 81 — Cookie duration must be disclosed before consent
• ePrivacy Directive 2002/58/EC, Article 5(3) — Consent required for non-essential cookie storage
• Apple WebKit ITP Documentation — Safari cookie lifetime restrictions
• Mozilla ETP Documentation — Firefox tracking protection policies
• Google Privacy Sandbox Timeline — Chrome third-party cookie deprecation status
• GDPR Article 5(1)(e) — Storage limitation principle applicable to cookie-stored personal data