How long do cookies last?

A cookie lasts until the date the website writes on it, or until you close the browser if the site writes no date at all, and then your browser trims that date. Chrome has refused to keep any cookie for more than 400 days from the moment it was set since August 2022, and recent Firefox releases enforce the same ceiling. Safari is stricter: a cookie created by a script on the page is capped at seven days, and at one day if a known tracker sent you to the site. So when a privacy policy says a cookie lasts "2 years," that is what the site asks for, not what your browser grants. But a site can set the cookie again on every visit, restarting the clock, so a cookie for a site you use weekly can outlive all of these limits.

The limits side by side

Two things decide a cookie's lifetime: the expiry the site asks for, and the cap your browser applies. The browser wins.

A site sets expiry as an Expires date or a Max-Age in seconds; if it sends both, Max-Age wins.

Why "two years" and "400 days" are both true

The confusion comes from reading two different documents. A site's cookie policy lists the lifetime it requests. Google's own list, for example, gives its SID and HSID sign in cookies and its _ga analytics cookie a lifetime of 2 years. The browser's documentation lists the lifetime it allows. Chrome's developer announcement says that since release M104, "cookies can no longer set an expiration date more than 400 days in the future," and that a longer request is cut to "400 days from the time the cookie was set." Both are accurate: in Chrome, a cookie asked to live two years lives 400 days from its last setting.

Chrome chose 400 days as "a bit over 13 months," a figure meant to let sites "visited around once a year" keep their cookies. The limit comes from the draft revision of the cookie standard, which Mozilla and WebKit had welcomed without yet adopting. Firefox has since caught up: a report on Mozilla's bug tracker shows Firefox 143 and 144 cutting a cookie set to expire in the year 9999 down to 400 days, and in some cases refusing it with the console message that its "expiration date is over the limit." A Mozilla developer noted the check landed after Firefox 140.

The part both camps miss is renewal. The 400 days run from when the cookie was set, and a site can send the same cookie again on any visit. Google describes its NID preferences cookie as lasting "6 months from a user's last use," and its PREF cookie as "8 months from a user's last use." That is what most persistent cookies really do: they expire after a stretch of absence, not a fixed span. Keep returning and no cap ever bites. Cookies for the "remember this device" option on a two step sign in work the same way, which is why a site you visit daily rarely asks for a code while one you open twice a year often does.

What real cookies ask for

Google publishes one of the more detailed cookie lists on the web, and its range, from minutes to two years, is typical of a large site's policy.

The short lifetimes belong to session and security jobs, where an old cookie is a liability. The long ones belong to sign in, analytics and ads, where the point is recognizing you months later. That is the job cookies do inside cross site tracking. The IDE row also shows the law at work: the same ad cookie is listed at 13 months in Europe and 24 months everywhere else.

What the law says about a cookie's lifetime

No European law prints a single maximum, but two regulators have drawn limits.

France's data protection authority, the CNIL, lets a site skip the consent banner for audience measurement only under conditions, and two are about time: the tracker's lifetime must be limited to a period that allows a meaningful comparison of audiences, "comme c'est le cas d'une durée de treize mois" (such as thirteen months), and it must not be extended automatically on new visits. The data collected may be kept for 25 months at most. That second condition rules out the renewal trick for any measurement cookie running without your consent.

The UK Information Commissioner's Office takes a principle rather than a number. Its guidance on storage and access technologies says the UK rules do "not specify how long" a cookie may last, but the duration must be "proportionate in relation to your intended outcome" and "limited to what is necessary." It gives 90 days for a preferences cookie as an example of a longer duration that can be appropriate, and it rules out the extreme: setting a cookie to expire on 31/12/9999 "could not be regarded as proportionate in any circumstances." It also notes that browser storage other than cookies may have "no expiry date" at all.

Those rules decide how long a site may legitimately ask for. They do not change your browser's cap, and whether a cookie may be set at all is the separate question what clicking reject all actually prevents answers.

Where these numbers stop

• Session cookies can survive a restart. Many browsers offer to reopen your tabs where you left off, and MDN's reference notes that session cookies "will also be restored, as if the browser was never closed."
• Cookies are not the only storage. Local storage, the browser database and service worker caches sit outside the 400 day cookie cap. Safari is the exception: since March 2020 it deletes all of a site's script writable storage "after seven days of Safari use without user interaction on the site." Those are days you used Safari, not calendar days, so a laptop left closed for a month does not count down.
• Safari's seven days applies to scripts only. WebKit's announcement says "only cookies created through document.cookie are affected," which leaves out the server set cookies most sign ins use.
• Clearing beats every cap. Deleting cookies, or a private window that discards them when it closes, ends them at once, as what private browsing really throws away describes.
• Expiry does not delete what was sent. What the site or its partners recorded while the cookie lived stays on their servers under their own rules, just as your internet provider's logs follow a separate clock.
• Browsers change. These caps are each browser's current published behavior, and they have moved before.

What to do with the answer

1. Pick your own expiry if the browser's is too long. Chrome and Firefox both have a setting to delete cookies and site data whenever you close every window, with exceptions for sites you choose. Add the few sites you want to stay signed into as exceptions.
2. Turn off reopen tabs on start if you want session cookies to really end, especially on a shared computer.
3. Clear one site, not everything, when a single site misbehaves. Clearing all cookies signs you out everywhere, though passwords saved in your browser survive it.
4. Read the lifetime column in a site's cookie policy before accepting. A two year ad cookie on a site you visit once is worth refusing, and a site whose policy lists 9999 is not following UK guidance.
5. Be wary of an extension that promises to manage cookies. It needs to read every site you open, the trade off the permission that reads every page spells out.
6. Go past the cookie for what was already collected. In the UK and EU you can ask a company what it holds about you and to erase it, and how to make a data request has the wording.