A session cookie is automatically deleted when the browser is closed; a persistent cookie remains on the device until the date set by its Expires or Max-Age attribute. The distinction is based on storage duration and is independent of the purpose category. Data protection practice expects proportionate lifetimes: no cookie should be kept longer than its purpose requires.
The technical basis of the distinction is the cookie's lifetime. If the server sets no Expires (absolute date) or Max-Age (duration in seconds) attribute, the browser treats the cookie as a session cookie and deletes it when the session ends, that is, when the browser is closed. If either attribute is set, the cookie is persistent: it stays on the device until the specified moment and is sent back to the server on every visit. When both are defined, browsers give precedence to Max-Age. Duration and purpose are separate axes: a session cookie can serve marketing and a persistent cookie can be strictly necessary. Shopping carts and login state typically run on session cookies; remembering a language preference or tracking a visitor across campaigns relies on persistent ones.
Data protection practice expects proportionate lifetimes: a cookie's duration should match its purpose, and multi-year expiry dates should not be assigned on a 'longer is better' basis. The first step for a site owner is an inventory: list the name, duration and purpose of every cookie on the site and state these durations clearly in the cookie policy. Where a long-lived cookie has been assigned to a short-lived function, shorten it. Regular scanning surfaces long-lived cookies added by third-party tools that would otherwise go unnoticed.
Frequently asked questions
What is the difference between a session cookie and a persistent cookie?
The difference is lifetime. A session cookie has no expiry date and is deleted automatically when the browser is closed. A persistent cookie gets a duration through the Expires or Max-Age attribute; it stays on the device until then and is sent to the server on every visit. The distinction is independent of purpose: a session cookie can serve marketing, and a persistent cookie can be technically necessary.
How long should a cookie's lifetime be?
There is no single correct number; the yardstick is proportionality. A cookie's lifetime should not exceed what its purpose requires: a security check may be measured in minutes and a language preference in months, while tracking cookies lasting years are questionable on proportionality grounds. List the durations clearly in your cookie policy and use regular scans to audit the lifetimes assigned by third-party tools as well.
This content is for information only and is not legal advice.