Your Consent Expired Months Ago. Your Banner Never Came Back.

Consent is treated like a one time signature. The visitor clicks, the cookie is set, the banner retires, and the organisation moves on. Meanwhile the vendor list grows, a new analytics tool arrives, the purposes paragraph is rewritten twice, and the consent underneath all of it dates from a different version of the site.

Regulators do not share the one and done view. Consent under GDPR must be informed and specific, and guidance across Europe treats old consent as decaying: the longer it sits, the less it describes what is actually happening. Several regulators name renewal windows outright. Your banner's silence is not stability. It is drift with a timestamp.

Set an expiry and honour it

Give the consent record a lifetime, 12 months at the outside and 6 months for sites whose tracking stack changes fast, and re prompt when it lapses. The re prompt should be the same quality as the first ask: clear purposes, a real reject route, no pre ticked anything. A renewal that is harder to refuse than the original was is not a renewal. It is a dark pattern with a calendar.

Store the version consented to alongside the timestamp: purposes text version, vendor list version, banner version. When any of them changes materially, that is a second trigger for re asking, independent of the clock. Consent to a stack that no longer exists is a historical document, not a permission.

Material change is the test teams skip

New vendor in a sensitive category, a new purpose such as cross context behavioural advertising, data flowing to a new region, a sale or sharing relationship that did not exist at consent time: each one moves you outside what the visitor agreed to. Minor copy edits do not. The discipline is keeping a change log for the consent surface with the same seriousness you keep one for the product.

This is also where consent mode and tag management earn scrutiny. Tags added through a manager inherit whatever consent state the manager believes exists. If nobody told the consent system about the new tag's purpose, the tag fires on old permission for a new behaviour. The banner did its job. The plumbing undid it.

Re asking without wrecking the experience

Renewal prompts fail when they arrive like the first visit all over again: full screen, mid task, identical for a loyal daily visitor and a stranger. Time the re ask to a natural boundary, the start of a session rather than the middle of checkout, keep it compact, and pre fill nothing. Show what changed in a line or two. People accept renewal when the reason is visible.

Measure refusal honestly after renewal. A spike in rejections is information: visitors tolerated the old stack and decline the new one, or the renewal design is coercive in a way the numbers are reporting. Either way the answer is to fix the stack or the design, not to lengthen the expiry until the question goes away.

Keep the record you would want to defend

For each consent: who, when, what version, what they chose, purpose by purpose. Retention of the record should outlive the consent itself, because the question, when it comes from a regulator or a data subject, will be about a period in the past. If your platform overwrites consent state in place with no history, you do not have records. You have a current opinion.

Test retrieval once. Pick an old consent, any old consent, and produce its full record within an hour. Teams that run this drill discover their gaps while the stakes are a drill. Teams that skip it discover them in correspondence they did not choose.

Frequently asked questions

How long does cookie consent last?

There is no single statutory number, but regulator guidance commonly points to renewal within 6 to 12 months, and sooner after material changes to purposes or vendors. Consent stored indefinitely, or for several years by default, is hard to defend as still informed and specific to the current tracking stack.

What counts as a material change requiring new consent?

A new purpose, a new vendor in a sensitive category, new sale or sharing of personal data, or data flowing somewhere it did not before. Changes that alter what happens to the visitor's data. Cosmetic wording updates that do not change processing do not need a re ask, but they should still be version logged.

Should returning visitors see the banner again after expiry?

Yes. Expiry without a re prompt means processing continues on lapsed consent. The renewal should appear at a natural point, explain briefly what changed, and offer accept and reject with equal ease. Anything less converts a legal renewal into a retention trick, which is precisely what regulators look for.

What consent records should we keep?

Timestamp, consent version covering purposes and vendor list, the choices made per purpose, and the banner version shown. Keep them beyond the consent's own lifetime. You will be asked about historical processing, and a system that only stores current state cannot answer for the past.