# Consent Expiry: The 6-Month Rule Your Banner Ignores

Source: https://consentfence.com/blog/2026-11-15-consent-expiry-six-month-rule.html

*Ask your CMP how long it remembers a visitor's consent choice and you will get one of three answers: a year, thirteen months, or "we never asked." None of them is the number the regulators actually point to. The French CNIL treats six months as good practice for keeping a consent or refusal choice, the UK ICO recommends six months before asking again after a refusal, and the Italian Garante says the banner should not reappear for at least six months. The consent you collected in January is not the consent you are relying on in December, and the banner that never re-asks is not respecting a choice. It is forgetting that choices expire.*

## Three clocks, one number

Consent has three clocks running at once, and most sites only track one of them. The first is the choice itself: how long you keep the visitor's answer before asking again. The CNIL's recommendation of September 17, 2020 calls keeping the choice, consent and refusal alike, for six months good practice, and says the right period depends on the site and its audience. The ICO's storage and access technologies guidance, updated in April 2026, recommends six months as a suitable timeframe to request fresh consent after a refusal. The second clock is the tracker: CNIL caps the lifespan of tracking cookies at 13 months, and the 13-month figure is about the cookie, not the consent. The third clock is the data: CNIL caps retention of data collected through technical cookies at 25 months. A consent cookie set to 13 months does not extend consent to 13 months. It just means you stopped asking.

The CMP defaults make the confusion worse. Vanilla-cookieconsent defaults to 182 days. Klaro's code defaults to 120. Tarteaucitron and c15t default to 365. None of these is a legal rule; they are library defaults, and the library does not know your audience. A site with mostly French visitors that defaults to 365 days is keeping choices twice as long as the CNIL's good practice, and a site that never re-asks is keeping them forever. The fix is a setting, not a project: set the consent duration to six months, for accept and reject alike, and re-ask when something material changes, a new cookie, a new purpose, a new vendor, or an updated policy, regardless of the clock.

## Refusal expires too

The mistake most sites make is treating refusal as permanent and consent as temporary. They re-ask the people who said yes and never re-ask the people who said no, which is backwards: a refusal deserves the same six-month clock as an acceptance, and the CNIL says so explicitly, consent and refusal alike. The Digital Omnibus proposal reached for the same number, a six-month bar on re-prompting anyone who refused, though the Council removed those provisions from its negotiating text in June 2026 and they may or may not return. The direction is clear even if the law is not settled: six months, both directions, then ask again. [Global Privacy Control has the same asymmetry problem](https://consentfence.com/blog/2026-11-12-global-privacy-control-signal-banner.md): the signal your banner cannot ignore, and the banner that treats it as a suggestion instead of an instruction. [The consent wall is the extreme version](https://consentfence.com/blog/2026-11-14-consent-wall-blocking-access-breaks-law.md): blocking access until consent breaks the law, and a banner that never lets the choice expire is the quiet version of the same failure.

## Check your CMP setting today

Open your CMP, find the consent duration setting, and read the number. If it is 365 days, change it to 180. If it is session-only, change it to 180, because re-prompting on every visit is consent harassment and it invalidates the consent under GDPR Article 4(11) and Article 7. If you cannot find the setting, ask your CMP vendor where it is, because a consent duration you cannot see is a consent duration you cannot defend. The check takes five minutes and it is the check a regulator runs first, because the duration is the easiest thing to verify and the hardest thing to explain away.

Document the choice. Write down why six months, for your audience, and keep the note with the consent records. The regulator who asks about your duration is asking whether you thought about it, and a note that says "CNIL good practice, six months, both directions" is an answer. A default of 365 days with no note is not.

## Frequently asked questions

### How long does cookie consent last?

There is no single legal figure, but the guidance clusters on six months. The CNIL treats keeping a choice, consent or refusal, for six months as good practice. The ICO recommends six months before asking again after a refusal. Spain's AEPD puts the ceiling at 24 months. Six months is the defensible default.

### What is the difference between the 6-month and 13-month figures?

Six months is how long you keep the visitor's consent choice before asking again. Thirteen months is the maximum lifespan of the tracking cookie itself under CNIL guidance. Setting your consent cookie to 13 months does not extend consent to 13 months; it just means you stopped asking.

### Does a refusal expire the same way consent does?

Yes. The CNIL treats consent and refusal alike: keep the choice for six months, then ask again. A refusal is not permanent, and a banner that never re-asks someone who refused is keeping a choice past its life, the same as one that never re-asks someone who accepted.

### When should I re-ask for consent before the six months are up?

Immediately, whenever something material changes: a new cookie, a new purpose, a new third-party vendor, or an updated privacy policy. The six-month clock is the maximum interval, not a reason to wait when the processing has changed.