A session cookie has no expiry date and is deleted when you close your browser. A persistent cookie has an expiry date and stays on your device until that date, or until you delete it.
That's the whole technical difference. Whether either one needs consent under GDPR depends on what the cookie is used for, not how long it lasts. A session cookie used for analytics needs consent. A persistent cookie that remembers a visitor's cookie choice does not.
Table of contents
- Session vs persistent cookies at a glance
- What is a session cookie?
- What is a persistent cookie?
- Examples of each
- Do session and persistent cookies need consent under GDPR?
- Are session cookies safer than persistent cookies?
- What about third-party cookies?
- How to manage cookies on your site
- FAQ
Session vs persistent cookies at a glance
| Session cookie | Persistent cookie | |
|---|---|---|
| Expiry | None set | Set with Expires or Max-Age
|
| Deleted when | The browser session ends | The expiry date passes, or the user clears cookies |
| Stored | In browser memory | On disk |
| Typical uses | Logins, shopping carts, multi-step forms | "Remember me", language settings, analytics, advertising |
| Common examples |
PHPSESSID, JSESSIONID
|
Google Analytics _ga, consent cookies |
| Needs consent? | Only if not strictly necessary | Only if not strictly necessary |
What is a session cookie?
A session cookie is a cookie set without an Expires or Max-Age attribute. The browser keeps it only for the current session and discards it when the session ends.
A server sets one like this:
Set-Cookie: sessionid=a3fWa; Secure; HttpOnly; SameSite=LaxSites use session cookies to remember things during a single visit: that you're logged in, what's in your cart, or what you typed on step one of a form.
When does a session cookie actually expire?
In principle, when you close the browser. In practice, many browsers restore your previous session on restart if you've turned on "Continue where you left off" or a similar setting, and that can bring session cookies back too. So don't rely on a session cookie to log someone out. Expire the session on the server as well.
What is a persistent cookie?
A persistent cookie has an expiry date or a maximum age, so it survives browser restarts:
Set-Cookie: lang=en; Max-Age=31536000; Secure; SameSite=LaxSites use persistent cookies to remember you between visits: keeping you signed in, saving your language, counting returning visitors, or showing ads based on past browsing.
How long can a persistent cookie last?
As long as the site sets, within browser limits. Chrome caps cookie lifetimes at 400 days. Safari limits cookies set by JavaScript to 7 days under its Intelligent Tracking Prevention. Regulators add their own limits: France's CNIL, for example, recommends that tracking cookies last no more than 13 months.
Examples of each
Session cookies:
- A login session ID that keeps you signed in as you move between pages
- A shopping cart that holds items until you check out
- A load-balancing cookie that routes you to the same server
Persistent cookies:
- A "remember me" cookie that keeps you signed in for 30 days
- A cookie that stores your language or currency
- Analytics cookies like Google Analytics'
_ga, which lasts two years by default - Advertising cookies that track you across sites
- The cookie that stores your consent choice, so the banner doesn't reappear on every page
Do session and persistent cookies need consent under GDPR?
Both follow the same rule. Under the EU ePrivacy Directive (Article 5(3)), you need consent before storing any cookie on a user's device unless it is strictly necessary to provide a service the user asked for. GDPR then sets the standard for what valid consent looks like.
So the question is never "session or persistent?" It's "is this cookie strictly necessary?"
| Cookie purpose | Session or persistent | Consent needed? |
|---|---|---|
| Login and authentication | Usually session | No |
| Shopping cart | Usually session | No |
| Security, such as fraud prevention | Either | No |
| Load balancing | Usually session | No |
| Storing the user's consent choice | Persistent | No |
| "Remember me" login | Persistent | Usually yes, as the user can sign in without it. Some regulators accept it when the user ticks the box |
| Analytics | Either | Yes, in most EU countries. A few allow narrow exemptions for first-party audience measurement |
| Advertising and cross-site tracking | Usually persistent | Yes |
EU regulators set out which cookies are exempt in the Article 29 Working Party's Opinion 04/2012 on the cookie consent exemption. Lifetime matters too: an exempt cookie should last no longer than its purpose needs.
If you're not sure which cookies your site sets, run it through our free cookie checker. It lists each cookie with its lifetime and category.
Are session cookies safer than persistent cookies?
For privacy, usually yes. Session cookies can't build a profile across visits. For security, it depends on how they're set. Session cookies carry login sessions, so a stolen one can let an attacker take over an account. Protect every sensitive cookie with:
-
Secure, so it's only sent over HTTPS -
HttpOnly, so scripts can't read it -
SameSite=LaxorStrict, to limit cross-site requests - Short lifetimes and server-side expiry
What about third-party cookies?
Session and persistent describe how long a cookie lasts. First-party and third-party describe who sets it. A third-party cookie is set by a domain other than the one you're visiting, usually for advertising, and is almost always persistent. Safari and Firefox block most third-party cookies by default. Google dropped its plan to phase them out of Chrome in 2025. Read more in our guide to third-party cookies.
How to manage cookies on your site
- Audit every cookie your site sets, including ones added by scripts like chat widgets and analytics.
- Categorize each one as strictly necessary, preferences, analytics or marketing.
- Set sensible lifetimes. Use session cookies where you can, and don't give persistent cookies more time than they need.
- Block non-essential cookies until consent. A compliant cookie banner should load analytics and marketing scripts only after the visitor agrees.
- List them in your cookie policy with name, purpose, provider and lifetime.
ComplyDog's free cookie consent banner does steps 1, 2 and 4 for you.
FAQ
What is the main difference between session and persistent cookies?
A session cookie is deleted when the browser closes. A persistent cookie stays until its expiry date.
Are session cookies stored on my computer?
They're kept in browser memory rather than written to disk, which is why they disappear when the browser closes.
How do I know if a cookie is session or persistent?
Open your browser's developer tools, go to Application (Chrome) or Storage (Firefox), and check the Expires column. "Session" means it's a session cookie. A date means it's persistent.
Do I need consent for session cookies?
Only if they aren't strictly necessary. A login cookie doesn't need consent. A session cookie used for analytics does.
Can persistent cookies be deleted?
Yes. Users can clear them in their browser settings at any time, even before they expire.
