When the Banner Reappears After Consent: Cookie Expiry and Domain Scope
A consent banner that returns every visit has a cookie problem, not a visitor problem. Expiry, domain scope, and subdomain mismatches are the usual causes.
A visitor accepts the cookie banner on Monday and sees it again on Tuesday, and again on Wednesday. She has not cleared her cookies. The banner is back because the consent cookie expired, or was set on the wrong domain, or was overwritten by a second banner on a subdomain. She will accept it again, because she has no choice, and she will think a little less of the store each time.
A banner that reappears is a consent tool telling the visitor that her choice did not count. The causes are boring and mechanical, which is good news, because boring mechanical causes have boring mechanical fixes.
Expiry: the choice that times out
Consent cookies have a lifetime, and many tools set it far shorter than the visitor expects. A consent cookie that expires after thirty days means the banner returns monthly, and a visitor who shops weekly sees it four times a year. Some tools set the lifetime to the session, which means the banner returns on every visit, and the visitor reasonably concludes the store is broken.
The right lifetime is a policy decision, not a technical default. A year is a common choice for a consent record, and it matches how long most stores keep the consent proof. Whatever the lifetime, it should be documented, and the banner should not return before it. Check the cookie's expiry in the browser after accepting, and compare it to the policy. If they disagree, the tool's default is winning over the policy.
Domain scope: the choice that does not travel
A consent cookie set on www.example.com does not apply to example.com, and one set on example.com does not automatically apply to shop.example.com unless the domain attribute is set to cover subdomains. A store with a blog on one subdomain and a shop on another can show the banner on both, and the visitor who accepted on the blog gets asked again in the shop.
The fix is to set the consent cookie on the parent domain with a domain attribute that covers the subdomains the store uses, and to test the banner on every subdomain after any change to the cookie settings. A single consent tool should mean a single consent record, and a visitor should never be asked twice for the same choice on the same store.
The second banner problem
Some stores run two consent tools at once, usually because a theme ships one and an app installs another. Each tool sets its own cookie, and each one shows its own banner, so the visitor accepts twice and the store records two different consent states. The audit will find two records for the same visitor, and neither of them is reliable.
Remove one of them. A store needs one consent tool, one banner, and one record per visitor. If the theme's banner and the app's banner cannot be reconciled, keep the one that writes the record the store can actually prove, and delete the other.
Related reading: Auditing Consent After a Theme Update: Banners That Silently Reset, Consent for Age Verification and Identity Tools: Data Collected Before a Choice, Auditing Consent When Checkout Moves to a Third Party Page.
Frequently asked questions
Why does the consent banner keep coming back?
The usual causes are a consent cookie that expired too soon, a cookie set on the wrong domain so it does not apply to the subdomain the visitor is on, or two consent tools running at once and each showing its own banner. Check the cookie expiry and domain in the browser after accepting.
How long should a consent cookie last?
A year is a common choice, and it matches how long most stores keep the consent proof. A thirty-day lifetime means the banner returns monthly, and a session lifetime means it returns on every visit. The lifetime should be documented and should match the policy.
Does a consent cookie set on www apply to the bare domain?
No. A cookie set on www.example.com does not apply to example.com, and a cookie on example.com does not automatically cover shop.example.com unless the domain attribute is set to cover subdomains. Set the consent cookie on the parent domain and test every subdomain.
What happens if a store runs two consent tools?
Each tool sets its own cookie and shows its own banner, so the visitor accepts twice and the store records two different consent states. Keep one tool, one banner, and one record per visitor, and delete the other.