Privacy finding
Cookies and stored identifiers live longer than the site says
Privacy Warning Severity: Medium
Part of the audit Stated retention and real lifetimes differ. Finding id: privacy.retentionVsStated.
What it costs you
A cookie or stored identifier that outlives the published period keeps recognising visitors after you said you would stop.
What to do
Shorten the lifetime to the stated period, or state the real one.
What it checks
- Cookie lasts longer than stated
- Session cookie is actually persistent
- Stored identifier never expires
How to fix it
Give the stored identifier an end date
- Store a date with the value and delete both when the period is over.
- Or list the value in the cookie list with its real lifetime.
How to check: Crawl the site again. The item no longer appears in this rule.
Set the expiry to the stated period
- Cookie set by your own code: set its expiry to the stated period.
- Cookie set by a vendor script: look for a lifetime setting in that tool. If there is none, state the real period in the cookie list.
How to check: Crawl the site again. The item no longer appears in this rule.
A real case
A study of the cookie banners of almost 30,000 websites named misleading expiration times as one of six new kinds of violation, and found at least one potential violation on 94.7% of the sites.
Thresholds
| Name | Default | Meaning |
|---|---|---|
tolerance_days | 1 | Days a cookie may outlive the stated period before it is reported. |
How to verify by hand
No outside source needed.
What this relies on
The stated period is the promise.