Consent Renewal Prompts: When to Re-Ask and When to Leave People Alone
Every consent program eventually faces the renewal question. Records age, notices change, and a choice made two years ago under a different tracker list is weak evidence for what the site does today. At the same time, sites that re-ask every month teach visitors that the banner is noise, and click-through without reading is exactly what regulators criticize.
This guide sets out the triggers that genuinely justify a renewal prompt, the timing rules that keep records defensible, and how to design the prompt so a returning visitor understands they are revisiting a choice, not starting from zero.
Material change is the strongest trigger
A new category of processing, a new vendor with a different purpose, or a rewritten privacy notice all change what the original consent covered. Consent is specific: agreement to analytics and functional cookies says nothing about a newly added advertising pixel. When the processing changes materially, the old record no longer matches reality, and re-asking is not optional polish, it is what makes the new processing lawful to run. Log the change that triggered the renewal alongside the new receipts, so an auditor can see why the prompt appeared when it did.
Time-based renewal and the stale record problem
Even with no changes, consent ages. Several regulators treat six to twelve months as a reasonable working life for a consent record, after which the assumption that the visitor still agrees gets hard to defend. Pick one interval, write it into your consent policy, and apply it uniformly. The common failure is selective renewal: re-asking only visitors who previously declined, in the hope of converting them. That asymmetry is visible in the data and reads as pressure, not record hygiene. Renewal should follow the calendar and the change log, never the answer someone gave last time.
Design the prompt as a revisit, not a reset
A returning visitor should see that the site remembers their earlier choice. Show the current settings as the starting point, highlight what is new or changed, and let them confirm or adjust in one step. Hiding the previous choice behind a fresh all-or-nothing banner discards useful information and frustrates people who already made a considered decision. Keep the reject path exactly as easy as the accept path in the renewal flow; a renewal prompt that is harder to decline than the original banner undermines the validity of every acceptance it collects.
Link the new receipt to the old one
Renewal creates a chain, and the chain is the evidence. Store the new receipt with a reference to the receipt it replaces, the trigger that caused the renewal, and the notice version shown. If a complaint covers a period spanning the renewal, you need to show which choice governed which months. Deleting the old receipt at renewal destroys that timeline. Retain superseded receipts for the same margin you apply to withdrawn consent, and mark them superseded rather than erasing them.
Related reading
These earlier guides cover connected questions in more depth: Auditing the Banner Itself: Dark Patterns That Void the Consent You Collected, Consent After Checkout: The Tracking Nobody Audits on Account and Confirmation Pages, and Consent Drift: How Quiet Site Changes Break the Banner You Audited Last Quarter.
Frequently asked questions
Does renewing consent reset our analytics data?
No. Renewal affects the permission record, not the data already collected under the earlier consent. Tools keep their history; what changes is the receipt that justifies ongoing collection from that point forward.
What if a visitor ignores the renewal prompt?
Their previous choice should continue to govern until it expires under your stated interval. Ignoring a prompt is not consent to anything new, so do not enable the new categories for visitors who have not answered.
Should renewal prompts appear on every page until answered?
No. Show the prompt once per session at most, and respect dismissal for a reasonable period. A banner that follows someone around the site until they accept is a pressure pattern, whatever the legal text says.
Do logged-in customers need renewal prompts too?
Yes, if their consent record is stale or the processing changed. Account holders are easier to handle well: you can surface the renewal inside account settings and email a notice, but the recorded choice still needs the same receipt fields.