Consent Renewal: Asking Again Is a Timing Problem Before It Is a Design Problem
Every consent record expires, and every returning visitor eventually meets the banner again. Sites treat that renewal as a legal interval to set once and forget, usually twelve months because a vendor default said so. The renewal moment deserves more thought than the default gives it, because a renewal prompt that lands mid task, on a visitor whose preferences have not changed, asking questions they answered a year ago, teaches people to click anything to make it stop. That learned reflex is the opposite of consent.
The legal picture is guidance, not a single number. Several European regulators have indicated periods in the range of six to thirteen months as reasonable for re-asking, and the honest variable is not only time. It is whether anything material changed: new trackers, new purposes, a new policy. Asking again when nothing changed, purely because a calendar said so, is defensible. Asking again badly is not.
Renew on change, not just on time
The strongest renewal design triggers on substance. Deploy a new analytics or advertising tool and the affected purposes get re-asked, promptly, with the change named. Let the calendar handle the quiet case, the long returning visitor where nothing changed, and keep that interval in line with regulator guidance in your strictest market rather than the loosest.
What to stop doing: resetting the renewal clock silently when a policy page is edited, or treating a banner re-display caused by a cookie bug as a renewal. If the record was lost by your code, the visitor's re-prompt is not a compliant renewal event. It is an incident, and logging it as a fresh consent with a fresh timestamp papers over a gap in the earlier period that your records now falsely claim was covered.
Remember the shape of the last choice
A returning visitor who rejected everything a year ago should not be greeted with a renewal flow designed to wear them down: bigger accept button, reject buried a layer deeper than last time, purposes pre expanded in accept's favour. Renewal is a re-ask, not a second chance to relitigate. Present the same symmetry as the first ask, state plainly that you are asking again because time has passed or something changed, and carry the previous settings as the starting point where your platform allows it.
That last detail matters more than it looks. A granular chooser who set five toggles carefully and finds them all reset to default has been told their effort was worthless. Restoring their prior configuration as the default, editable, is the difference between a renewal that respects the relationship and one that spends it.
Log renewals as renewals
Your consent records should distinguish a first choice from a renewal and note the trigger: interval reached, new purpose added, policy change. When a regulator or a complainant asks what a visitor agreed to in a given month, the answer lives in that chain, and a single overwritten timestamp cannot reconstruct it.
Keep superseded records rather than replacing them. Storage is cheap. The inability to show what was in force at the time of a specific processing activity is the expensive outcome, and it tends to surface at the least convenient moment, attached to a deadline, in writing.
Related reading: Reject Button Parity: The Second Layer Is Where Consent Goes to Die, Consent Mode Signals: What Late Banner Firing Does to Your Data, How Long to Keep Consent Records, and What to Delete on Schedule.
Frequently asked questions
How often should consent be renewed?
There is no single universal period. Several European regulators point to roughly six to thirteen months as reasonable. Renew sooner when processing materially changes, and do not treat a re-prompt caused by a lost cookie as a renewal.
Should a renewal ask about every purpose again?
If nothing changed, the previous settings should be the starting point, editable, not reset to defaults. If a new tool or purpose was added, that change should be named and asked about directly.
Is it acceptable to make the accept button bigger on renewal?
It undermines the choice. Renewal should keep the same symmetry between accept and reject as the first ask. A flow designed to wear down a previous rejecter is visible for what it is.
What should a consent record show for a renewal?
That it was a renewal, what triggered it, the interval reached or the change involved, and the full prior record retained rather than overwritten. The chain is what proves what was in force at any given time.