Privacy finding
A cookie's lifetime starts again on every visit
Privacy Warning Severity: Medium
Part of the audit Stated retention and real lifetimes differ. Finding id: privacy.cookieLifetimeRenewed.
What it costs you
The lifetime in the cookie list is the time since the last visit, not since the first. A regular visitor is recognised for as long as they keep coming.
What to do
Set the expiry once, or say in the cookie list that the period starts again on each visit.
What it checks
- Lifetime renewed on every visit
How to fix it
Set the expiry once or state that it renews
- Cookie set by your own code: write it only when it does not exist yet, so the expiry is not pushed forward.
- Cookie set by a vendor script: look for a setting that stops the renewal. If there is none, state in the cookie list that the period starts again on each visit.
How to check: Run the scripted second visit again: the remaining lifetime is shorter by the days between the visits.
A real case
A study of the cookie banners of almost 30,000 websites named misleading expiration times as one of six new kinds of violation, and found at least one potential violation on 94.7% of the sites.
Thresholds
| Name | Default | Meaning |
|---|---|---|
min_days_between | 2 | Days between the two visits needed before the lifetimes are compared. |
tolerance_days | 1 | The second lifetime may be this many days shorter than the first and still count as renewed. |
How to verify by hand
No outside source needed.
What this relies on
The stated period is the promise.