# When should a Shopify store ask returning visitors for consent again? - BannerWarden

Source: https://bannerwarden.com/blog/2026-09-25-cookie-banner-reconsent-timing.html

[Home](../index.md) / [Blog](index.md) / What should a store do about consent for embedded videos and social widgets?


Published September 25, 2026

Consent is not a one-time event. It expires, it gets outdated when your trackers change, and sometimes the stored record simply vanishes. A Shopify store needs a reconsent schedule, not just a banner, so returning visitors are asked again at the right moments and never nagged at the wrong ones.

## Consent has a shelf life

Every major privacy framework treats consent as something that can go stale. Guidance across the EU converges on roughly six to twelve months as a reasonable maximum before re-asking, and sooner when something material changes. An accept clicked two years ago, before your current analytics stack existed, does not cover today's trackers.

The practical move is a time-based expiry on the stored consent record: after a set period, the banner shows again on the next visit. Twelve months is the common default; six is more conservative. Pick one, document why, and apply it consistently. A documented expiry is defensible; an infinite consent is not.

## Re-ask when your trackers change

Adding a new analytics tool, ad pixel, or personalization vendor changes what the visitor agreed to. The original consent covered a specific set of purposes and vendors, and the new one is not in it. Material changes to tracking should trigger reconsent for all visitors, not just new ones.

Version your consent records. When the tracker set changes, bump the version and treat stored consents on the old version as expired. This is also where a proper consent platform earns its keep over a homegrown banner: versioning and re-prompting logic is exactly the machinery that is painful to build and easy to get wrong.

## Re-ask when the stored choice is gone

Consent records live in cookies or local storage, and both get cleared: by browser privacy features, by the user, by IT policies, by Safari's expiry rules. When the record is missing, the store must treat the visitor as unknown and show the banner again. There is no shortcut around this.

Monitor the rate of missing-consent visits. A sudden spike usually means a browser change or a bug in how the record is stored, not a surge of new visitors. If Safari's storage policies are wiping records faster than your expiry, shorten the effective schedule rather than fighting the browser.

## Do not nag returning visitors

There is a line between lawful re-prompting and banner fatigue, and crossing it costs opt-in rate. Re-prompt on the triggers above, not on every visit, not after every pageview, and never as punishment for declining. A visitor who declined last week and gets asked again today learns to click whatever dismisses the banner fastest.

Design the re-prompt to be as lightweight as the first ask. Same banner, same choices, no guilt-tripping copy. Stores that respect the decline get higher opt-in rates over time than stores that optimize each individual prompt aggressively. Consent is a relationship metric, not a conversion funnel.

## Document the schedule

Write the reconsent policy down: the time-based expiry, the material-change triggers, and what counts as material. Keep it with the cookie policy and the records of processing. When a regulator or a customer asks why they were re-prompted, the answer should be a document, not a memory.

Review the schedule annually alongside the tracker audit. Trackers accumulate quietly through tag managers and app installs, and the annual review is where you catch the ones nobody remembers adding. A reconsent schedule that nobody reviews is a schedule that slowly stops matching reality.

## The simple version

Re-ask once a year, re-ask when tracking changes materially, re-ask when the stored choice is missing, and never nag. That four-line policy covers the vast majority of Shopify stores, is easy to explain to anyone who asks, and keeps the consent records fresh enough to actually mean something. Print it, file it with the cookie policy, and revisit it every year when you audit your trackers.

## Related reading

[What should a store do about consent for embedded videos and social widgets?](https://bannerwarden.com/blog/2026-09-24-embedded-video-social-widget-consent.md)[What should a Shopify cookie policy page actually cover?](https://bannerwarden.com/blog/2026-09-23-shopify-cookie-policy-page-cover.md)[How long should you keep cookie consent records?](https://bannerwarden.com/blog/how-long-to-keep-cookie-consent-records.md)

## Get a free consent audit of your website

[Free consent audit](mailto:hello@bannerwarden.com?subject=Free%20consent%20audit%20-%20bannerwarden.com)