Privacy finding
The consent choice is remembered longer than the site says
Privacy Warning Severity: Medium
Part of the audit Stated retention and real lifetimes differ. Finding id: privacy.consentRememberedTooLong.
What it costs you
The visitor is asked again later than the site says, so a choice made long ago keeps counting.
What to do
Set the lifetime of the stored choice to the stated period, or state the real one.
What it checks
- Consent remembered longer than stated
How to fix it
Check that the tool asks again after the stated period
- Look in the consent tool for the setting that says how long a choice is kept, and compare it with the stated [stated days] days.
- Read the stored value in the browser's storage panel: it usually holds the date of the choice.
How to check: Set the device clock past the stated period in a test browser and reload: the banner returns.
Set the lifetime to the stated period
- Open the consent tool's setting for how long a choice is kept and set it to [stated days] days.
- Or change the stated period in the banner and the policy to the real one.
How to check: Make a choice in a private window and read the expiry of [name]. Then run this rule again.
A real case
A study of the cookie banners of almost 30,000 websites named misleading expiration times as one of six new kinds of violation, and found at least one potential violation on 94.7% of the sites.
Thresholds
| Name | Default | Meaning |
|---|---|---|
tolerance_days | 1 | Days the stored choice may outlive the stated period before it is reported. |
How to verify by hand
The consent platform's setting for how long a choice is kept.
What this relies on
The stated period is the promise.