Six Months and Ask Again: Consent Renewal Under the CNIL's Rule

Your consent management platform stores a visitor's choice for twelve months, because that is the default. The French regulator says six months is good practice. The visitor who refused in January and gets asked again in April is being worn down, and the visitor who accepted in January and is never asked again is consenting to a site that has changed.

What the regulators actually say

Neither the ePrivacy Directive nor the GDPR sets a duration for consent. The guidance that exists clusters around six months. The CNIL, in its recommendation of 17 September 2020, says keeping the choice, consent and refusal alike, for six months constitutes good practice, and it frames the period as assessable case by case, not as a hard legal limit. The Italian Garante says the banner should not be shown again unless the processing changes significantly, the site cannot know whether a cookie was already stored, or at least six months have elapsed. The UK ICO, in guidance updated in April 2026, says after a refusal, six months is a suitable timeframe to request fresh consent. Spain's AEPD puts the ceiling on consent at 24 months.

Two things in the CNIL position matter for banner design. First, refusal and acceptance are treated the same way: a refusal stored for six months is respected for six months, and a site should not re-ask during a browsing session, because re-asking wears the visitor down into accepting. Second, the six months is about the choice, not the cookie. A consent cookie can live longer than the consent it records, and the tracker itself has its own ceiling: the CNIL caps tracker lifespan at 13 months, and raw analytics data at 25 months. A cookie that lasts 13 months does not extend consent to 13 months. It just means you stopped asking.

Why the libraries default to a year

The consent libraries default to something else: 182 days in vanilla-cookieconsent, 120 days in Klaro, 365 days in tarteaucitron and c15t. The libraries are not regulators, and their defaults are convenience, not guidance. A site that ships the default without thinking about it is making a legal decision by accident, and the accident usually runs in the direction of asking too rarely for acceptances and too often for refusals, because the same duration applies to both and the refusal is the one that gets re-prompted when the cookie is deleted. Safari deletes a JavaScript-set consent cookie after seven days without interaction, which means a refusal can evaporate in a week and the banner comes back, and the visitor who said no gets asked again, and again.

The practical answer is six months, for acceptance and refusal alike, with the decision timestamp stored inside the record so the re-ask is based on the date the choice was made, not on the date the cookie was last written. Log refusals, not just acceptances, because if you only store positive consent, you cannot tell a fresh visitor from someone who said no last week, and you re-prompt them. For the records themselves, see Consent Records: How Long to Keep Them and What They Prove, and for the reappearing banner, Why the Consent Banner Reappears: Cookie Expiry and Domain.

When to ask sooner than six months

Six months is the default, not the rule. Ask sooner when the processing changes in a way the visitor would be surprised by: a new purpose, a new vendor, a longer retention period, data going to a new country. Rewording a sentence does not need a fresh round of consent. Adding a vendor does. The test is the visitor's surprise: if someone who agreed last month would be surprised by the change, ask again, and record the new choice with a new timestamp.

Frequently asked questions

How long does cookie consent last?

There is no statutory number. The CNIL calls six months good practice for remembering a choice, the Garante and the ICO converge on six months, and Spain's AEPD puts the ceiling at 24 months. Six months is the defensible default.

Does the six-month rule apply to refusals too?

Yes. The CNIL treats consent and refusal the same way, and says a site should not re-ask during a browsing session. A refusal stored for six months is respected for six months.

Does a 13-month consent cookie extend consent to 13 months?

No. The 13-month ceiling is for the tracker itself. The consent it records is a separate question, and a cookie that lasts 13 months just means you stopped asking.

When should we ask for consent again sooner than six months?

When the processing changes in a way the visitor would be surprised by: a new purpose, a new vendor, longer retention, or data going to a new country. Rewording a sentence does not need a fresh round.