The Cookie Banner and the Back Button: What Happens to Consent When the Shopper Leaves

A shopper lands on your site, consents to analytics, browses, and buys. Then they hit the back button, and the banner appears again, asking for consent they already gave. The consent is gone, because the site stored it in a session that ended when the page changed, and the shopper has to decide again, for a decision they already made.

The back button is the consent problem nobody tests, because it is not a page load, it is a navigation, and navigations behave differently from loads. A consent stored in session storage survives a page load, but not a back-button navigation that restores the page from the browser's back-forward cache. A consent stored in a cookie survives both, because the cookie is read on every navigation, including a back-button navigation. The storage mechanism is the whole problem, and it is the one most sites get wrong.

Where consent lives, and why it matters

Consent should live in a cookie, with a lifetime that matches the regulation. The CNIL's guidelines set a maximum cookie lifetime of 13 months, which means a consent cookie should expire after 13 months, and the banner should ask again when it does. A consent stored in local storage survives longer, but it is not sent to the server, which means the server cannot read it, and the server is where the consent decision has to be enforced. A consent stored in session storage survives the shortest time, and it is the one that breaks on the back button.

The GDPR adds a requirement that the storage mechanism must support: proof. Article 7 requires the controller to demonstrate that consent was obtained, and the proof is a record with a timestamp. A consent stored only in the browser, with no server-side record, cannot be demonstrated, because the browser is the user's device, not the controller's system. The record must be stored server-side, with the timestamp, and the timestamp must be accurate, because a clock skew between the server and the client can make the proof argue with itself.

The back button test

Test it the way a shopper does. Land on the site, consent, navigate to a product page, hit the back button, and look at the banner. If the banner appears again, the consent is stored in the wrong place, and the fix is to move it to a cookie. If the banner does not appear, and the consent state is correct, the storage is right. Then test it again after a withdrawal: withdraw consent, hit the back button, and confirm the banner asks again, because a withdrawn consent should be treated as no consent, and the banner should reappear.

The withdrawal case is the one that matters most, because a shopper who withdraws consent and then hits the back button should not be tracked, and a site that restores the old consent state from the back-forward cache will track them anyway. The fix is to listen for the pageshow event, which fires on a back-button navigation, and re-check the consent state when it fires, rather than trusting the cached page.

Renewal, and the 13-month clock

Consent expires, and the renewal timing is a decision, not a default. The CNIL's 13-month maximum is the ceiling, and most sites renew at 6 or 12 months, which is a reasonable interval. The renewal should be a fresh ask, not a silent extension, because a consent that is silently extended is not a consent that was freely given. When the cookie expires, the banner should appear again, and the shopper should decide again.

The back button is a navigation, and navigations restore state. Store consent in a cookie, record it server-side with an accurate timestamp, and re-check it on pageshow. The shopper will not have to decide twice, and the site will not track someone who said no.

Keep reading: After Withdrawal, When May the Banner Ask Again?, Consent timestamps and clock skew: when your proof of consent argues with itself, Consent Renewal: Asking Again Is a Timing Problem Before It Is a Design Problem.

Frequently asked questions

Why does the cookie banner reappear when I hit the back button?

Because the consent was stored in session storage, which does not survive a back-button navigation that restores the page from the back-forward cache. Consent should live in a cookie, which is read on every navigation.

How long should a consent cookie last?

The CNIL sets a maximum of 13 months. Most sites renew at 6 or 12 months, with a fresh ask when the cookie expires, not a silent extension.

What does GDPR Article 7 require for consent proof?

The controller must demonstrate that consent was obtained, with a record of who consented, when, to what, and how. The record must be stored server-side with an accurate timestamp.

What happens to consent when a shopper withdraws it and hits back?

The site should treat it as no consent and show the banner again. Listen for the pageshow event on back-button navigation and re-check the consent state, rather than trusting the cached page.