How do I fix “Tracking cookies last longer than 13 months”?

Set your analytics cookie expiry to 13 months or less (in Google Analytics: Admin → Data streams → Configure tag settings → Override cookie settings). Check the cookie settings of your advertising pixels and consent tool. Don’t extend a cookie’s expiry every time the visitor comes back.

How long can tracking cookies last? 13 months

Tracking cookies last longer than 13 months

Short answer: There’s no single EU-wide number, but 13 months is the usual reference. France’s CNIL limits audience-measurement cookies to 13 months, not extended on each visit, and the GDPR says data must not be kept longer than needed. Google Analytics and many ad pixels set two-year cookies by default, so they need changing.

Consent & tracking · Low riskLast reviewed 27 September 2026Automated checks and general information, not legal advice.

How long can analytics and advertising cookies last?

After consent, tracking cookies were set to last more than 13 months, often two years, so they keep identifying the visitor long after the choice was made.

France’s CNIL uses 13 months as the maximum lifetime for audience-measurement cookies, and the GDPR says data must not be kept longer than needed. Shorter cookie lifetimes also mean consent is asked again at sensible intervals.

Check it yourself in two minutes

Open your site in a private window and accept cookies.
Open DevTools → Application → Cookies.
Check the “Expires” column for _ga, _gcl_au, _fbp and similar cookies. Anything more than 13 months away is worth shortening.

How to fix it

Set your analytics cookie expiry to 13 months or less (in Google Analytics: Admin → Data streams → Configure tag settings → Override cookie settings).
Check the cookie settings of your advertising pixels and consent tool.
Don’t extend a cookie’s expiry every time the visitor comes back.

How untick detects it

After a fresh visitor accepts cookies, we read the expiry date of every known analytics and advertising cookie. Anything set to last more than 13 months is listed with how long it lasts. Session cookies and your own site cookies aren’t judged.

Every finding comes with screenshots, the evidence we collected and a fix for your setup. How a scan works.

Questions people ask

How do I shorten the Google Analytics cookie?

In Google Analytics 4: Admin → Data streams → your stream → Configure tag settings → Override cookie settings, and set the expiry to 13 months or less. With Google Tag Manager, set cookie_expires in the Google tag’s configuration.

Is this a legal requirement or a recommendation?

For audience measurement, the 13-month limit is part of CNIL’s conditions for the consent exemption. For consented cookies it’s good practice under the GDPR’s storage limitation rule, which is why we rate it low.