How Long Should a Cookie Banner Opt-Out Last? It's a Careful Balance

How Long Do Opt-Outs Last by Default?

Consent banners have to remember what visitors chose. In most cases, consent platforms store those choices in visitors' browsers, in preference cookies or similar browser storage, with an expiration date that businesses can usually configure. The default is commonly 12 months. The records are typically created by the platform's script, which affects how long some browsers keep them.

The records only exist in the browsers where the choices were made. Visitors who return on another device, in another browser, or in a private window are treated as new visitors. The same is true of visitors who clear their cookies.

How Long Do Regulators Expect Opt-Outs to Last?

California sets the clearest expectation. Its statute requires businesses to stop selling or sharing the personal information of consumers who opt out, and to "wait for at least 12 months before requesting that the consumer authorize the sale or sharing" again. In California, sharing means disclosing personal information for advertising targeted on the basis of activity across websites, so the rule reaches the advertising tools that cookie banner opt-outs usually control. Opt-out records that expire sooner make that rule harder to follow, because banners treat returning visitors as new.

Colorado's rules take a different approach. They set no waiting period, but they bar businesses from asking consumers who opted out to consent again through "interface dominating cookie banners, high frequency requests, cookie walls, pop-ups," or similar interruptions. A link to a privacy settings page is allowed instead.

Regulators have also treated a short-lived opt-out as deceptive. In 2011, the Federal Trade Commission alleged that an advertising network's opt-out "lasted for only 10 days." Its final order required an opt-out that lasted for at least five years.

European regulators suggest a shorter interval. The United Kingdom's regulator suggests six months as "a reasonable and proportionate interval for requesting consent again, particularly where a user has previously declined consent." It says this "strikes an appropriate balance between avoiding repeated consent requests and ensuring user choices remain up-to-date." France's regulator also considers six months a good practice, depending on the website and its audience.

Based on each jurisdiction's statute, rules, or published guidance, as of October 2026.

Why Do Some Browsers Delete Preference Cookies Early?

Some browsers limit how long records created by scripts can last. Safari is the most significant example. WebKit's documentation states that Safari "deletes all cookies created in JavaScript and all other script-writeable storage after 7 days of no user interaction with the website." When visitors arrive through links that carry tracking identifiers, such as ad click IDs, Safari also "caps the expiry of cookies created in JavaScript on the landing webpage to 24 hours."

The seven days count only days on which visitors use Safari, on any website. The count starts over whenever visitors click, tap, or type on the website that set the record, although scrolling does not reset it. As a result, visitors who return often tend to keep their choices, while occasional visitors may lose them.

What Happens When Preference Cookies Are Deleted?

Once preference cookies are deleted, consent banners no longer know what visitors chose. Under an opt-out model, tracking is active by default, so it may resume for visitors who previously opted out. Under an opt-in model, tracking stays off, but banners may ask for consent again, potentially before the six months that European regulators suggest. These outcomes are reasonable when visitors delete the cookies themselves, such as by clearing their browser data, and riskier when the cookies expire automatically too early.

Ultimately, the legal exposure is greater under an opt-out model. Visitors who opted out may be tracked again after a certain amount of time without having made a new choice. Banners may also prompt visitors to opt back in long before California's 12-month wait has passed. In Colorado, banners that ask those visitors to consent again may be the kind of request that the rules prohibit.

How Can Businesses Make Opt-Outs More Durable?

Three approaches can keep opt-outs in place more effectively than relying on browser storage alone:

• Store the choice with the account. For visitors who are logged in, the opt-out can be saved in the business's own systems, so that it does not depend on the browser. California's regulations already require businesses to apply opt-out signals to known consumers.
• Set preference cookies from the server. Cookies set by the website's own server, rather than by scripts, are generally not subject to Safari's seven-day or 24-hour limits. Safari still caps them at seven days when they come from a third party's server set up under the website's domain. Consent platforms typically create their cookies by script, so this may require a change in configuration.
• Honor the Global Privacy Control. Browsers send the signal with every visit, so it continues to apply after preference cookies are deleted.

I recommend that businesses confirm how long their preference cookies last in the browsers their visitors use, and what their websites do once those cookies are gone. Under an opt-out model, that includes whether tracking resumes for visitors who opted out on an earlier visit.