Skip to main content

Consent Validity

A consent choice is valid for a fixed period. The default is six months and can be configured from 1 to 24 months in the banner settings.

Validity period​

The period starts when the visitor accepts all services, rejects all services, or confirms a customized selection. Biskoui records:

  • decidedAt: when the choice was submitted;
  • expiresAt: when the choice expires.

A new explicit choice starts a new period. Loading the website or restoring the choice does not extend it. Acceptance and rejection use the same period.

Storage​

The same expiresAt applies to every stored copy:

  • internal consent in localStorage;
  • parent-domain cookies in cross-subdomain mode;
  • the optional biskoui_consent_v1 public cookie.

Cookies use an Expires attribute matching expiresAt. Because localStorage has no native expiry, the SDK checks its consent metadata.

Expired, missing, malformed, and unsupported consent does not grant permission. The SDK removes expired consent and its associated identifier, denies optional services, and displays the banner again.

Backends must also deny a service unless biskoui_consent_v1 is valid, unexpired, and contains that service's stable name.

Early removal​

Browser settings, private browsing, storage restrictions, or clearing site data can remove consent before expiresAt. The validity period is a maximum lifetime, not guaranteed storage duration.

Configuration changes​

The consent record includes a fingerprint of the service configuration. If the fingerprint changes, Biskoui stops applying the saved choice and displays the banner again.

The customize screen preserves the previous selection, but no optional service is allowed until the visitor confirms a new choice. Newly added services are not preselected.