Help us improve
Share bugs, ideas, or general feedback.
Audits cookie lifetimes against CNIL 13-month maximum, Safari ITP caps, third-party phase-out, and classifies session vs persistent cookies for compliance.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeHow this skill is triggered — by the user, by Claude, or both
Slash command
/privacy-skills-complete:cookie-lifetime-auditThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Cookie lifetime is a critical compliance factor often overlooked in consent implementations. The CNIL recommends a maximum cookie lifetime of 13 months from the point of collection, after which consent must be renewed. The CJEU in Planet49 (Case C-673/17) established that cookie duration must be disclosed to users before consent is obtained. Additionally, browser-enforced restrictions — Safari'...
Audits cookie lifetimes against CNIL 13-month maximum, Safari ITP caps, third-party phase-out, and classifies session vs persistent cookies for compliance.
Audits website cookies and trackers via automated scanning, categorization, lifecycle documentation, and Planet49 compliance analysis. For privacy/compliance reviews.
Guides CNIL-compliant cookie consent implementation: equal prominence accept/reject buttons, no cookie walls, 6-month reconsent intervals, essential cookies exemption per Deliberation 2020-091. For EU sites avoiding fines.
Share bugs, ideas, or general feedback.
Cookie lifetime is a critical compliance factor often overlooked in consent implementations. The CNIL recommends a maximum cookie lifetime of 13 months from the point of collection, after which consent must be renewed. The CJEU in Planet49 (Case C-673/17) established that cookie duration must be disclosed to users before consent is obtained. Additionally, browser-enforced restrictions — Safari's Intelligent Tracking Prevention (ITP), Firefox's Enhanced Tracking Protection (ETP), and Chrome's third-party cookie deprecation — impose technical limits on cookie lifetimes that may conflict with server-set durations. A cookie lifetime audit identifies cookies exceeding regulatory or technical limits and ensures accurate duration disclosure.
| Type | Duration | Behavior | Consent Implications |
|---|---|---|---|
| Session cookie | No Expires or Max-Age attribute | Deleted when browser closes | Still requires consent if non-essential under ePrivacy Art. 5(3) |
| Persistent cookie | Has Expires or Max-Age | Survives browser restart | Requires consent; duration must be disclosed (Planet49) |
| Server-refreshed | Reset on each visit via Set-Cookie | Effectively indefinite if user visits regularly | Duration is from last visit, not first set — must disclose rolling nature |
| Category | Duration Range | Examples | Regulatory Concern |
|---|---|---|---|
| Short-lived | < 24 hours | Session IDs, CSRF tokens | Low — typically strictly necessary |
| Medium-lived | 24 hours - 30 days | A/B test assignments, session replay | Medium — review necessity |
| Long-lived | 30 days - 13 months | Analytics IDs, preference cookies | High — must justify duration |
| Excessive | > 13 months | Legacy tracking cookies, _ga (2 years) | Very high — CNIL non-compliant duration |
CNIL's Recommendation on Cookies (1 October 2020, following Deliberation 2020-091 of 17 September 2020) states:
"The duration of validity of the consent of the user to the deposit of trackers should not exceed thirteen months. At the end of this period, the consent of the user should be collected again."
This 13-month maximum applies to:
Cookies Exceeding CNIL 13-Month Limit:
| Cookie | Default Duration | Set By | CNIL Compliant | Remediation |
|---|---|---|---|---|
| _ga | 2 years (730 days) | Google Analytics | No — exceeds 13 months | Set cookie_expires to 34128000 (395 days / ~13 months) |
| _ga_XXXXXXX | 2 years | GA4 | No — exceeds 13 months | Set cookie_expires to 34128000 |
| IDE | 13 months | DoubleClick | Borderline compliant | Monitor — at the limit |
| fr | 90 days | Meta/Facebook | Yes | No action needed |
| _gcl_au | 90 days | Google Ads | Yes | No action needed |
| hjSessionUser* | 1 year | Hotjar | Yes — under 13 months | No action needed |
| NID | 6 months | Google Search | Yes | No action needed |
Override default GA4 cookie duration to comply with CNIL:
gtag.js implementation:
gtag('config', 'G-PINNACLE123', {
'cookie_expires': 34128000, // 395 days (~13 months) in seconds
'cookie_update': true, // Refresh cookie on each visit
'cookie_domain': '.pinnacle-ecommerce.com',
'cookie_flags': 'SameSite=Lax;Secure'
});
GTM implementation: In the GA4 Configuration tag, set the field:
cookie_expires34128000Safari imposes strict cookie lifetime caps:
| Cookie Type | ITP Rule | Effective Lifetime |
|---|---|---|
| Client-side JavaScript cookie (document.cookie) | Capped at 7 days | 7 days maximum |
| Client-side JS cookie with link decoration (e.g., ?gclid=) | Capped at 24 hours | 24 hours |
| Server-set cookie (Set-Cookie header), first-party | No cap | As set by server |
| Server-set cookie, classified as tracking | Capped at 7 days | 7 days |
| Third-party cookie | Blocked entirely | 0 (cannot be set) |
| LocalStorage | Capped at 7 days | 7 days |
Impact on Pinnacle E-Commerce Ltd:
_ga cookie set via JavaScript: Effective lifetime is 7 days on Safari, not 2 years_ga via Set-Cookie header: Full configured lifetime applies_gcl_au cookie capped at 24 hours on Safari| Setting | Default (Standard) | Strict |
|---|---|---|
| Third-party tracking cookies | Blocked | Blocked |
| Cross-site tracking cookies | Blocked | Blocked |
| First-party tracking cookies | Allowed | Limited to 7 days (if tracker classified) |
| Fingerprinting scripts | Blocked | Blocked |
| Cryptomining scripts | Blocked | Blocked |
As of 2025, Chrome has moved toward a user-choice model for third-party cookies rather than full deprecation:
| Phase | Status | Impact |
|---|---|---|
| Privacy Sandbox APIs available | Active | Topics API, Attribution Reporting API available |
| Third-party cookie user controls | Active | Users can block third-party cookies in settings |
| IP Protection (Gnatcatcher) | In development | May affect IP-based tracking |
For each cookie on pinnacle-ecommerce.com, record:
| Cookie Name | Domain | Set By | Declared Duration | Actual Max-Age/Expires | Refreshed on Visit | Category |
|---|---|---|---|---|---|---|
| _ga | .pinnacle-ecommerce.com | JavaScript | 2 years | Max-Age=63072000 | Yes | Analytics |
| _ga_PINNACLE | .pinnacle-ecommerce.com | JavaScript | 2 years | Max-Age=63072000 | Yes | Analytics |
| _gid | .pinnacle-ecommerce.com | JavaScript | 24 hours | Max-Age=86400 | Yes | Analytics |
| _fbp | .pinnacle-ecommerce.com | JavaScript | 90 days | Max-Age=7776000 | No | Advertising |
| _fbc | .pinnacle-ecommerce.com | JavaScript | 90 days | Max-Age=7776000 | No | Advertising |
| _gcl_au | .pinnacle-ecommerce.com | JavaScript | 90 days | Max-Age=7776000 | No | Advertising |
| session_id | .pinnacle-ecommerce.com | Server | Session | No Max-Age | N/A | Necessary |
| csrf_token | .pinnacle-ecommerce.com | Server | Session | No Max-Age | N/A | Necessary |
| locale | .pinnacle-ecommerce.com | Server | 1 year | Max-Age=31536000 | No | Functionality |
| consent_state | .pinnacle-ecommerce.com | JavaScript | 6 months | Max-Age=15768000 | No | Necessary |
| Cookie | Server-Set Duration | CNIL 13-Month Limit | Safari ITP Limit | Compliant | Action Required |
|---|---|---|---|---|---|
| _ga | 2 years | Exceeds | 7 days (JS) | No | Reduce to 13 months; move to server-side |
| _ga_PINNACLE | 2 years | Exceeds | 7 days (JS) | No | Reduce to 13 months; move to server-side |
| _gid | 24 hours | Within | 7 days (JS) | Yes | None |
| _fbp | 90 days | Within | 7 days (JS) | Partial | Move to server-side for Safari |
| locale | 1 year | Within | No cap (server) | Yes | None |
| consent_state | 6 months | Within | 7 days (JS) | Partial | Move to server-side; aligns with CNIL 6-month reconsent |
Compare actual cookie lifetimes with durations stated in the cookie policy:
| Cookie | Policy States | Actual Duration | Accurate |
|---|---|---|---|
| _ga | "up to 2 years" | 2 years | Yes — but update to reflect 13-month override |
| _fbp | "3 months" | 90 days | Yes |
| locale | "12 months" | 1 year | Yes |
| _gid | "24 hours" | 24 hours | Yes |
For Pinnacle E-Commerce Ltd:
cookie_expires: 34128000)_ga, _fbp cookies to bypass Safari ITP 7-day cap