Consent Renewal: How Long a Yes Lasts Before You Have to Ask Again
A visitor complains that your site tracked them without consent. The regulator asks for the record. You open the CMP dashboard and find a log entry that says a user accepted, with no timestamp, no record of what the banner showed, and no way to tie the entry to the complaint. That log entry is worthless, and the banner that produced it was theater. Consent records are the part of compliance that only matters when something goes wrong, which is exactly when they have to be complete.
The GDPR is blunt about this. Article 7 requires the controller to be able to demonstrate that consent was given, and Recital 42 ties valid consent to a record of what the person was told. A banner that collects consent and keeps no usable record has done half the job.
There is no single global expiry for consent, but the practical range is 6 to 13 months. The CNIL requires consent choices to be kept for at least 6 months so returning visitors are not re-prompted every session, and caps cookie lifespan at 13 months. Most CMPs default to 12 months. A consent record older than the period your policy states is not evidence, it is an antique.
The numbers that actually exist
France is the clearest. CNIL guidance says consent choices must be kept for at least 6 months, and a cookie cannot live longer than 13 months from when it is set, after which it has to expire or be reset, not silently renewed. The ePrivacy Directive sets the consent requirement, and GDPR sets the standard, but neither sets a number of months. That leaves the number to the regulator in each country and to the site itself.
Most CMPs settle on 12 months as the default renewal interval, which sits inside the CNIL window and is easy to explain. The danger is not the number. It is the site that never picked one. A consent string collected three years ago, under a different banner, a different vendor list, and a different privacy policy, is still being passed to vendors as if the visitor answered yesterday. No regulator accepts that, because the visitor answered a different question in a different world.
What should trigger a re-prompt besides the calendar
The calendar is the floor, not the whole policy. A vendor list change that adds a vendor or a purpose should re-prompt the affected visitors. A material change to the privacy policy should do the same. A CMP migration almost always does, because the consent is tied to the platform that collected it. And a consent record that cannot be traced to a banner version, a vendor list version, and a timestamp is not a record worth keeping, whatever its age.
The re-prompt itself is a design decision. Show the banner again to visitors whose stored consent predates the change, with the new information visible. Do not re-prompt the whole audience for a minor change, because it trains people to click without reading and the accept rate drops. Target the re-prompt, log it, and keep the old records as evidence for the period they covered.
Running renewal as a routine, not a project
Put the renewal interval in the privacy policy and in the CMP configuration, and make them match. Then check quarterly: how many stored consent records are older than the interval, how many visitors were re-prompted, and whether the re-prompt rate matches the number of records expiring. If the numbers do not line up, the renewal job is not running.
The record to keep is simple: the date consent was given, the banner version, the vendor list version, and the date it expires or was renewed. That is the whole audit trail, and it is the difference between a consent program and a pile of strings. A pile of strings is what most sites have. A program is what survives a regulator asking for the record behind a single visitor.
Keep reading: TCF Vendor Lists: Why 900 Vendors on Your Banner Is a Liability, Consent Records: How Long to Keep Proof, and What to Keep, and The Best OneTrust Alternatives for 2026 cover the nearby cases in this series.
Frequently asked questions
How long does cookie consent last?
It depends on the jurisdiction and your policy. The CNIL requires at least 6 months of retention and caps cookie life at 13 months. Most CMPs default to 12 months, which is a sensible middle ground.
Does consent expire if the visitor never returns?
Yes, on the same schedule. The expiry is about the age of the record, not about visits. A consent given two years ago is stale whether the visitor came back fifty times or never.
Do I need to re-prompt after a vendor list change?
Yes, for the visitors affected by the change. Adding a vendor or a purpose means the original consent never covered it, so fresh consent is needed for the new processing.
What happens to old consent records when consent is renewed?
Keep them. They are the evidence for processing that happened while they were current. Retire them for future use, but do not delete the audit trail for the period they covered.