Scan rule · RSC-PRV-014
Tracking cookie with a very long lifetime
Privacy (GDPR)Severity: Low
Measures the lifetime of tracking cookies and reports anything beyond one year.
Why this matters
Consent does not last indefinitely. German supervisory authorities expect it to be obtained again at reasonable intervals. A cookie with a multi-year lifetime undermines that in practice — consent given in 2024 would still carry in 2028.
The rule is deliberately `low` and only applies to tracking cookies. The exact threshold is a judgement, not a calculation; we state the measured lifetime and leave the assessment to the reader. Functional cookies (language, cart, the consent decision itself) are not flagged.
Scan tier
Browser runtime
How to fix it
Limit the lifetime to a period after which consent is obtained again.