United Kingdom Cookie Duration And Retention Reference
Created:
This reference explains cookie durations and retention periods in a structured format, helping readers compare requirements and manage compliance more efficiently. For broader guidance, see our AI Generated British Cookie Policy resources.
Meaning | Common Examples | Consent Treatment | Example Retention Wording | Retention Notes |
|---|---|---|---|---|
Session cookie | ||||
A cookie that is normally deleted when the browser session ends. | Shopping basket, page navigation, temporary login state, load balancing. | Depends on purpose | These cookies expire when you close your browser. | Browsers may restore sessions, so avoid promising immediate deletion in all cases. |
A temporary cookie needed to deliver a service requested by the user. | Checkout session, secure area login, form progress, payment flow. | Usually not required | These essential cookies last only for your current visit and are deleted after the session ends. | The PECR consent exemption applies only where the cookie is strictly necessary for the user-requested service. |
A temporary cookie used to measure activity during a single visit. | Visit counters, session analytics IDs, heatmap session IDs. | Usually required | These analytics cookies expire at the end of your browsing session. | Short duration does not remove the need for consent if the purpose is analytics or tracking. |
A temporary cookie used for ad delivery or ad measurement during one session. | Ad impression caps, click IDs, temporary campaign attribution cookies. | Usually required | These advertising cookies are deleted when your browser session ends. | Advertising cookies generally require prior consent, even where the expiry is short. |
A temporary cookie used to protect a user session or transaction. | CSRF token, authentication nonce, transaction security token. | Usually not required | These security cookies expire when your session ends or shortly after completion of the transaction. | Keep the period no longer than needed for security and fraud prevention. |
Persistent cookie | ||||
A cookie stored after the browser closes until its expiry or deletion. | Remember-me login, language preference, analytics identifier, advertising ID. | Depends on purpose | These cookies remain on your device until they expire or you delete them. | State the expiry period and whether the cookie is renewed on repeat visits. |
A stored cookie that remembers user choices between visits. | Language, region, font size, accessibility settings, cookie banner choice. | Depends on purpose | We keep preference cookies for up to 12 months unless you change your settings or delete them sooner. | Consent may not be needed where the preference is essential to provide a requested setting. |
A cookie that stores whether the user accepted or rejected cookie choices. | Consent banner status, category choices, last consent update timestamp. | Usually not required | We store your cookie choices for up to 6 to 12 months so we do not ask you again on every visit. | Duration should match the period after which the site asks users to refresh choices. |
A cookie that keeps a user signed in after the browser closes. | Remember-me token, trusted device cookie, account continuity cookie. | Depends on purpose | If you select remember me, this cookie remains for up to 30 days or until you sign out. | Make optional persistent login clear use shorter retention for higher-risk accounts. |
A stored identifier used to recognise visits over time for measurement. | Google Analytics client ID, Matomo visitor ID, product analytics ID. | Usually required | Analytics cookies remain for up to 13 months unless you withdraw consent or delete them earlier. | Disclose the actual tool expiry analytics providers often allow expiry settings to be configured. |
A stored identifier used to target, personalise or measure advertising over time. | Retargeting ID, ad network identifier, conversion tracking cookie. | Usually required | Advertising cookies remain for the period shown in our cookie list unless you withdraw consent or delete them sooner. | Longer advertising retention needs clear disclosure and prior consent before cookies are set. |
Short-term persistent cookie | ||||
A persistent cookie with a short expiry, commonly minutes to a few weeks. | Recent search, basket recovery, A/B test allocation, fraud signal. | Depends on purpose | These cookies remain for a short period, usually between 30 minutes and 30 days. | Use exact durations where known purpose still determines consent status. |
A cookie that preserves basket contents for a limited time after the visit. | Basket ID, checkout recovery token, saved cart cookie. | Depends on purpose | Basket cookies remain for up to 7 days so you can return to your basket. | Likely exempt where needed for a requested basket service marketing recovery uses may require consent. |
A cookie that keeps a user in the same test variant for a short period. | Experiment ID, variant allocation, feature flag cookie. | Depends on purpose | Testing cookies remain for up to 30 days to keep the site experience consistent. | Consent is more likely needed where testing involves analytics, profiling or non-essential personalisation. |
A cookie used briefly to detect abuse, bots or suspicious transactions. | Rate-limit cookie, device risk token, bot detection cookie. | Usually not required | Security cookies remain for up to 24 hours to help protect the service from fraud and abuse. | The exemption is stronger where the cookie is necessary for security of the requested service. |
A cookie used to complete or secure a payment journey for a limited period. | Payment session ID, 3D Secure state, checkout token. | Usually not required | Payment cookies expire when the payment is completed or within a short period after checkout. | Limit retention to the payment process and reconciliation needs. |
A cookie that maintains a support chat or recent chat history for a short period. | Chat session ID, unread message indicator, support widget state. | Depends on purpose | Chat cookies remain for up to 24 hours so your support conversation can continue. | Third-party chat tools may set additional analytics or marketing cookies needing consent. |
A cookie set by a social plugin for recent interaction or sharing features. | Share button state, embedded social widget cookie, social login helper. | Usually required | Social media cookies may remain for several days depending on the provider. | Check provider documentation social plugins can involve tracking across other sites. |
A cookie that records a recent campaign source for attribution. | UTM source cookie, affiliate click ID, referral campaign token. | Usually required | Attribution cookies remain for up to 30 days to measure campaign performance. | Marketing and affiliate attribution generally needs consent before cookies are set. |
Long-term persistent cookie | ||||
A persistent cookie with a long expiry, commonly many months or years. | Long-lived preference, analytics ID, advertising ID, device recognition. | Depends on purpose | These cookies may remain for several months or years, as stated in our cookie table. | Longer retention should be proportionate, accurate and easy for users to find. |
A long-lived identifier used to recognise returning visitors for analytics. | GA4 _ga cookie, web analytics visitor ID, returning user cookie. | Usually required | Analytics identifiers may remain for up to 2 years, unless configured for a shorter period. | Google states GA4 cookies can have a default expiration of 2 years confirm your actual settings. |
A long-lived cookie used for retargeting, profiling or ad measurement. | Ad network ID, retargeting cookie, cross-site conversion ID. | Usually required | Advertising cookies may remain for up to 12 months or the provider's stated expiry period. | Clearly identify third-party providers and avoid setting these cookies before consent. |
A long-lived cookie that remembers choices across many visits. | Language, region, dark mode, saved accessibility preferences. | Depends on purpose | Preference cookies remain for up to 12 months so we can remember your selected settings. | If not strictly necessary, preference cookies should be covered by the user's choices. |
A cookie that recognises a trusted device for later sign-ins. | Trusted device token, MFA remembered device cookie, login risk cookie. | Depends on purpose | Trusted device cookies remain for up to 90 days unless you remove the device or clear cookies. | Retention should reflect account risk, security controls and user choice. |
A cookie used to recognise devices for fraud prevention over time. | Device fingerprint support cookie, fraud risk token, abuse prevention ID. | Depends on purpose | Fraud prevention cookies may remain for up to 12 months to help identify suspicious activity. | Long retention may be justified for security, but explain purpose and avoid repurposing for marketing. |
A long-lived cookie set by a social media service or embedded plugin. | Social login cookie, embedded feed tracker, share plugin identifier. | Usually required | Social media cookies may remain for the provider's stated period after you interact with embedded content. | Refer to provider cookie notices and block non-essential social cookies until consent is given. |
A cookie used to attribute purchases or leads to an affiliate over time. | Affiliate referral ID, publisher click ID, commission tracking cookie. | Usually required | Affiliate cookies remain for up to 30 to 90 days to attribute qualifying purchases. | Affiliate tracking is usually marketing measurement and should be set only after consent. |
Persistent cookie | ||||
A cookie whose expiry is extended when the user returns or interacts. | Rolling analytics ID, renewed preference cookie, refreshed login token. | Depends on purpose | This cookie expires after 12 months, but the expiry may be renewed each time you visit. | Rolling expiry should be disclosed because practical retention may exceed the nominal period. |
A cookie stored by a domain other than the website being visited. | Analytics provider cookie, ad network cookie, social plugin cookie, video embed cookie. | Usually required | Third-party cookies remain for the period set by the relevant provider, as listed in our cookie table. | Audit third-party expiry periods regularly they can change without website code changes. |
A cookie set by an embedded video service to remember playback or track usage. | Video player preferences, watch history ID, embedded player analytics cookie. | Usually required | Video cookies may remain after playback according to the video provider's stated expiry period. | Use privacy-enhanced embed modes where available and disclose third-party retention. |
Short-term persistent cookie | ||||
A cookie used briefly to limit repeated requests or prevent abuse. | Rate-limit token, bot challenge status, request counter. | Usually not required | Rate-limiting cookies expire within a few minutes or hours after use. | Limit to security and service availability do not combine with marketing identifiers. |
Session cookie | ||||
A temporary cookie that keeps requests routed to the same server. | Server affinity cookie, load balancer session ID, routing token. | Usually not required | Load-balancing cookies expire at the end of your session or after a short routing period. | Generally treated as essential where needed for reliable delivery of the requested service. |
Persistent cookie | ||||
A stored cookie that adapts the service to a device or previous settings. | Responsive layout preference, saved location, preferred branch or store. | Depends on purpose | Personalisation cookies remain for up to 6 months so we can remember your chosen settings. | Consent is usually needed if personalisation involves profiling beyond a requested setting. |
Long-term persistent cookie | ||||
A cookie identifier linked to records showing when consent was given or refused. | Consent receipt ID, preference version ID, consent log reference. | Usually not required | We keep a cookie consent record for up to 12 months to remember and evidence your choices. | Store only what is needed to evidence choices and refresh consent after material changes. |
Persistent cookie | ||||
A cookie that stores a chosen location or region between visits. | Country selector, postcode area, nearest store preference, currency choice. | Depends on purpose | Location preference cookies remain for up to 6 months unless you change or delete them. | Approximate user-chosen preferences are lower risk than tracking precise location for profiling. |
Session cookie | ||||
A temporary cookie that keeps form progress during a visit. | Multi-step form ID, application progress token, validation state cookie. | Usually not required | Form cookies expire when your session ends or when you submit the form. | Avoid storing sensitive form content in cookies unless necessary and secure. |
Short-term persistent cookie | ||||
A temporary persistent cookie used to complete password reset or verification. | Password reset state, email verification token, account recovery session. | Usually not required | Account recovery cookies expire shortly after the reset or verification process ends. | Use very short expiry periods because these cookies relate to account security. |
Long-term persistent cookie | ||||
A cookie that remembers whether a user has seen or completed a survey. | Survey suppression cookie, feedback prompt history, poll completion cookie. | Depends on purpose | Survey cookies remain for up to 6 months so we do not show the same prompt repeatedly. | Consent may be required if linked to analytics, profiling or third-party research tools. |
Persistent cookie | ||||
A cookie that recognises a returning support user or ticket context. | Support user ID, helpdesk widget ID, ticket continuity token. | Depends on purpose | Support cookies remain for up to 30 days to help continue previous support interactions. | If the support widget also performs analytics or marketing, separate those cookies for consent. |
Short-term persistent cookie | ||||
A cookie used briefly to tailor content during recent visits. | Recently viewed items, recommended article state, temporary segment ID. | Usually required | Content personalisation cookies remain for up to 14 days unless you withdraw consent sooner. | Personalisation based on observed behaviour is unlikely to be strictly necessary. |
Persistent cookie | ||||
A cookie that stores recent search terms or filters between visits. | Saved search filters, recent search terms, product comparison state. | Depends on purpose | Search preference cookies remain for up to 30 days so you can resume recent searches. | Use consent where search history is used for profiling or marketing recommendations. |
Long-term persistent cookie | ||||
A cookie that remembers accessibility settings across visits. | Contrast mode, text size, reduced motion, screen-reader preference. | Usually not required | Accessibility cookies remain for up to 12 months to remember your chosen display settings. | More likely exempt where the user actively chooses the setting and it is needed to provide it. |
How Should UK Cookie Policies Explain Cookie Duration?
UK cookie policies should distinguish between session cookies, which expire when the browser session ends, and persistent cookies, which remain until a stated expiry date or deletion. For persistent cookies, the policy should give meaningful retention information such as hours, days, months, or years, rather than vague wording.
Does Cookie Duration Decide Whether Consent Is Needed?
Duration alone does not decide consent. Under the UK PECR rules and ICO guidance, consent is usually required for non-essential cookies such as analytics, advertising, profiling, social media and many personalisation cookies, even if they are short-lived. Cookies that are strictly necessary for a user-requested service, such as basket, login session or security cookies, are usually exempt from consent.
What Retention Periods Are Most Important To Disclose?
- Session cookies: explain that they are deleted when the browser is closed, unless the browser restores sessions.
- Short-term persistent cookies: state the exact period where possible, such as 30 minutes, 24 hours, 7 days or 90 days.
- Long-term persistent cookies: justify longer periods, especially for advertising, analytics identifiers, preference storage and fraud prevention.
- Third-party cookies: check the third party\'s published duration, because their expiry may differ from your own settings.
What Should UK Website Operators Check Before Publishing A Cookie Policy?
Run a cookie audit, identify each cookie\'s purpose, provider and expiry, and align the expiry wording with the actual technical setting. If a cookie is renewed on repeat visits, say so. If analytics or marketing cookies are used, present them through a consent mechanism before setting them unless a valid exemption applies.
Want to Generate Your own Cookie Policy?
Docaro AI can help you write your own Cookie Policy for use in the United Kingdom in minutes.
FAQs
UK cookie rules do not set a single maximum lifespan for all cookies. Under PECR and UK GDPR, retention must be necessary, proportionate and clearly explained, with non-essential cookies requiring valid consent before use.
Show All FAQs
You Might Also Be Interested In
United Kingdom guide to website features and cookie policy disclosures, helping clarify compliance needs and user transparency.
Explore UK cookie categories for clearer cookie policies, better consent management, and improved compliance with privacy rules.
Explore the United Kingdom Cookie Policy Clause Library for practical clause examples to support clear, compliant cookie policy drafting.
Do you need a cookie policy in the United Kingdom? Use this guide to understand UK cookie compliance and website obligations.
United Kingdom guide to organisation types and key cookie policy considerations for clearer compliance planning.
Learn about cookie user rights and controls in United Kingdom, including consent choices, withdrawals, and privacy compliance essentials.
Understand cookie consent requirements in the United Kingdom with a clear flowchart for UK website compliance.