Summary
Cookies are an essential part of how the web works, and if you want a good modern web experience, they’re necessary, at least for now. However, one annoying thing about cookies is that they can expire, which can be an inconvenience, but it’s actually a good thing! Here’s why.
Session-Based Cookies End When You Close the Browser
As the name implies “session"cookiesare designed to last for a single session. They only stick around as long as your browser is open, and if you close the browser window they go poof. These are usually used for cases where you don’t want information to persist beyond that one session.
Expiration Dates Are Set for Security Reasons
Cookies are really just text files, and if a malicious actor gets their hands on a copy if certain cookies, they can get up to all sorts of shenanigans. So it makes sense to set an expiration date on cookies to ensure that they will eventually become invalid. This is no different from forcing you to change your password at set intervals. It’s annoying, but it’s also sensible, and worth the minor inconvenience.
Compliance With Privacy Regulations
You may have heard of privacy policies such asGDPRin Europe, that mandate certain things from websites if they want to operate in those jurisdictions. GDPR is why you see a cookie policy popup whenever you visit a site for the first time, giving you control over what cookies are allowed.
There are also state-level policies such as theCalifornia Consumer Privacy Act(CCPA), which gives you the right to know what information is being stored and shared about your online activity, and gives you the right to delete that information.
Whichever specific policy is in effect, it usually limits how long a company can store information about you in cookies, which means those cookies will have an expiration date in order to comply.
Preventing Stale or Outdated Data
Some of the information stored in cookies eventually becomes out of date. These can include information about your preferences for the site, or the website itself has been updated and isn’t compatible with older cookies. In any event, setting cookies to expire prevents a situation where you have to manually delete cookies because the information in them needs to be refreshed.
Reducing Storage and Performance Overhead
Cookies are generally pretty small, but there is a limit to how many cookies a browser will store before it starts deleting them. Cookies that have expired or are over a certain age are usually automatically removed based on that browser’s cookie management policies. While storage on modern computers isn’t much of an issue when it comes to cookies, it can matter for low-end devices with browsers, and a glut of cookies can slow down how fast websites load.
Websites Need to Refresh Authentication Credentials
Websites usually keep us logged in for quite some time, but it’s not good security practise to have an authentication cookie stay valid forever. This is why, sometimes, a website will log you out and ask for your credentials again. If authentication cookies stayed valid indefinitely, it would represent a huge security risk.
Cookies May Be Deleted by User Action or Browser Settings
Finally, you have control over your cookies. You can manuallydelete cookiesusing your browser’s privacy settings, and you can control whether third-party cookies are stored at all. If you dig into the developer tools in browsers like Chrome, you can also manually set expiration times up to400 days.
While browser developers like Google have been trying tokill browser cookiesfor some time now, it seems they’ll be with us for the foreseeable future. They might not be perfect, but for the moment, cookies are the best solution we have for a web experience thatbalances convenience and privacy.
