How One Missing Attribute Decides Session Cookie vs Persistent Cookie

What is the difference between a session cookie and a persistent cookie?

The whole difference in session cookie vs persistent cookie is one attribute: a persistent cookie has an Expires date or a Max-Age in seconds, and a session cookie has neither. RFC 6265, the current cookie standard, says a cookie with neither attribute is kept until "the current session is over" (as defined by the user agent). A cookie with either attribute is kept until that time passes, or until the browser or the user deletes it first.

Set-Cookie: sid=31d4d96e407aad42; Path=/; Secure; HttpOnly
Set-Cookie: lang=en-US; Max-Age=2592000; Path=/

The first line sets a session cookie. The second sets a persistent cookie that lasts 2,592,000 seconds, which is 30 days. The name of the cookie plays no part. A cookie called session_id with a Max-Age is persistent, and a cookie called remember_me with no expiry is a session cookie.

How does a browser decide which kind of cookie it received?

A browser decides by reading the attributes in order, as set out in the storage algorithm of RFC 6265 section 5.3. If the cookie has a Max-Age, the browser sets the cookie's persistent-flag to true and uses Max-Age for the expiry. Otherwise, if it has an Expires, the flag is true and Expires sets the expiry. Otherwise the flag is false, and the expiry is set to "the latest representable date."

So inside the spec, a session cookie has the furthest possible expiry date, and only the false persistent-flag gets it removed. The same section says: "When 'the current session is over' (as defined by the user agent), the user agent MUST remove from the cookie store all cookies with the persistent-flag set to false."

Two more rules matter in practice:

• Max-Age wins over Expires. Section 4.1.2.2: "If a cookie has both the Max-Age and the Expires attribute, the Max-Age attribute has precedence and controls the expiration date of the cookie."
• Zero deletes. Under section 5.2.2, a Max-Age of 0 or less sets the expiry to "the earliest representable date and time", so the cookie is removed at once. Sending Max-Age=0 is the standard way to delete a cookie from the server.

MDN's two cookie pages disagree on whose clock an Expires date uses. The HTTP cookies guide says Expires dates are "relative to the client the cookie is being set on", so a server with a different time can cause errors. The Set-Cookie reference says the server sets Expires "with a value relative to its own internal clock", and that Firefox and Chromium-based browsers adjust for the clock difference using the Date header, while the specification "does not indicate if/how the value should be corrected by the recipient." The guide's advice holds either way: Max-Age is "less error-prone", because it counts seconds from the moment the browser receives the cookie.

When does a session actually end?

No standard says when a session ends, and that gap is why session cookies do not behave the way their name suggests. RFC 6265 leaves it to the browser with the phrase "as defined by the user agent", which appears in both the attribute section and the storage section.

MDN's two cookie pages describe the result from opposite ends. The Set-Cookie reference says a session "finishes when the client shuts down, after which the session cookie is removed", then adds a warning that browsers with a session restore feature restore session cookies too, "as if the browser was never closed." The HTTP cookies guide goes further: "The browser defines when the 'current session' ends, and some browsers use session restoring when restarting. This can cause session cookies to last indefinitely."

With session restore on, a session cookie can outlive a persistent cookie with a one-week expiry. Code that treats a session cookie as a logout guarantee relies on a browser setting it cannot see, so expire authentication on the server as well.

A session cookie also has nothing to do with a session in analytics. Google Analytics 4 stores its session state in a cookie named _ga_<container-id>, which its help center lists with a default expiration of 2 years and the description "Used to persist session state." The analytics session is a time window the tool calculates, covered in what counts as a session. The cookie that remembers it is persistent.

How long can a persistent cookie last?

A persistent cookie can last up to 400 days in Chrome and in the draft that will replace RFC 6265. RFC 6265 set no upper limit. Its successor, draft-ietf-httpbis-rfc6265bis-22 dated 1 December 2025, which the IETF datatracker shows in the RFC Editor queue, adds section 5.5: the browser "MUST limit the maximum age of the cookie", and "The limit SHOULD NOT be greater than 400 days (34560000 seconds) in the future." An Expires or Max-Age beyond the limit "MUST be reduced to the limit."

Chrome already enforces the cap. The Chrome for Developers blog states: "As of Chrome release M104 (August 2022) cookies can no longer set an expiration date more than 400 days in the future." That puts the two published numbers in conflict. Google Analytics documents 2-year defaults for _ga and _ga_<container-id>, and Chrome, also from Google, trims any such date to 400 days when the cookie is stored.

Safari sets a much shorter ceiling for one kind of cookie. WebKit's Intelligent Tracking Prevention 2.1 announcement of 21 February 2019 says: "All persistent client-side cookies, i.e. persistent cookies created through document.cookie, are capped to a seven day expiry." The same post adds: "Session cookies are not affected, they remain session cookies." Cookies set by a server's Set-Cookie header fall outside that rule. The full set of Safari rules is in how the Safari 7 day cookie limit works.

RFC 6265 also asks servers to hold back. Section 7.3 says servers "SHOULD promote user privacy by selecting reasonable cookie expiration periods based on the purpose of the cookie", and gives an example that muddles the vocabulary: "a typical session identifier might reasonably be set to expire in two weeks." A session identifier, in other words, often lives in a persistent cookie.

Do session cookies and persistent cookies need consent?

Under EU law, neither kind is exempt from consent because of its lifetime, and both are exempt only when strictly necessary for a service the user asked for. The Article 29 Working Party's Opinion 04/2012 on Cookie Consent Exemption, adopted on 7 June 2012, defines the two terms: a session cookie "is automatically deleted when the user closes his browser", and a persistent cookie "remains stored in the user's terminal device until it reaches a defined expiration date (which can be minutes, days or several years in the future)."

The opinion then treats lifetime as a signal, not a test. It says "'first party' session cookies are far more likely to be exempted from consent than 'third party' persistent cookies", and in the same paragraph that "The risk to data protection comes from the purpose(s) of processing rather than the information contained within the cookie." Its clearest example is login. Authentication cookies that last the session are exempt, but "Persistent login cookies which store an authentication token across browser sessions are not exempted", and a "remember me (uses cookies)" checkbox is named as an appropriate way to get consent for them.

National regulators add numbers. France's CNIL, in its guidance on audience measurement tools, lets such trackers skip consent only if their lifetime is limited to a period "comme c'est le cas d'une durée de treize mois" (13 months, for example), is not "prorogée automatiquement lors des nouvelles visites" (automatically extended on new visits), and the collected data is kept for at most "vingt-cinq mois" (25 months). An analytics cookie that resets its expiry on every visit fails the second condition however short its lifetime is.

For a cookie table in a privacy policy, list the lifetime of each cookie as it is actually set, "session" or a duration, next to its purpose and whether it is first-party or third-party. The same questions apply to data kept in browser storage, which the page on local storage vs cookies covers.

Frequently asked questions

How do I make a cookie a session cookie?

Leave out both the Expires and Max-Age attributes when setting it. The browser then keeps the cookie until the session ends, as the browser defines it. MDN's document.cookie page gives the same rule for script-set cookies: if neither is specified, the cookie expires at the end of the session.

Are session cookies deleted when I close a tab?

No. Closing a tab does not end the browser session. Session cookies are removed when the browser closes, unless session restore brings them back.

Which wins if a cookie has both Expires and Max-Age?

Max-Age wins. RFC 6265 section 4.1.2.2 says Max-Age "has precedence and controls the expiration date of the cookie." MDN adds that Max-Age is less error-prone, since an Expires date depends on clocks that can disagree.

How do I delete a persistent cookie?

Set the same cookie again, with the same name, domain and path, and a Max-Age of 0 or an Expires date in the past. RFC 6265 treats a Max-Age of zero or less as the earliest representable date, so the browser removes the cookie immediately.

Are session cookies more private than persistent cookies?

Session cookies are shorter-lived by design, which limits how long they can link visits. The Article 29 Working Party still judged cookies by purpose: a session cookie used for tracking needs consent, and a persistent cookie can be exempt when the user asked for what it does.

Does private browsing turn persistent cookies into session cookies?

In effect, yes. RFC 6265 section 7.2 says a browser offering to prevent persistent storage "MUST treat all received cookies as if the persistent-flag were set to false", and names private browsing as a common form of that setting. Every cookie is gone when the private session closes.

Is a session cookie the same as a session in Google Analytics?

No. The analytics session is a time window the tool calculates, and the cookie that remembers it is persistent. Google Analytics 4 stores session state in _ga_<container-id>, which its help center lists with a default expiration of 2 years.

How long can a persistent cookie last in Chrome?

Up to 400 days. Since Chrome M104 in August 2022, cookies can no longer set an expiration date more than 400 days in the future, so a longer Expires or Max-Age is cut to that limit. The rfc6265bis draft sets the same ceiling.

Do session cookies survive a browser restart?

Not by the spec, but often in practice. RFC 6265 leaves the end of the session to the browser, and browsers with session restore bring session cookies back as if the browser was never closed. MDN warns this can make them last indefinitely.

Does a remember me login cookie need consent in the EU?

Yes. The Article 29 Working Party's Opinion 04/2012 says persistent login cookies that store an authentication token across browser sessions are not exempted, and it names a "remember me (uses cookies)" checkbox as a way to get consent. Authentication cookies that last only the session are exempt.