How often should a Shopify store re-prompt for cookie consent?
Re-prompt too often and visitors tune out the banner entirely. Re-prompt too rarely and consent goes stale while tracking keeps firing. The right interval is a legal and UX decision at once.
Consent has an expiration date, whether you set one or not
Cookie consent is not a one-time event. Privacy regulations in several jurisdictions expect consent to be refreshed periodically, and even where no fixed interval is written into law, stale consent is a real problem: the visitor who consented two years ago did not consent to the six new vendors added since. A consent record that never gets renewed quietly drifts out of sync with what the site actually does.
The practical question is not whether to re-prompt but when. Too frequent, and the banner becomes wallpaper that visitors dismiss without reading, which poisons the quality of every consent signal you collect. Too rare, and you are operating on decisions made for a different version of your site.
What the regulations actually say
There is no single global rule, which is why this question confuses everyone. Some guidance suggests refreshing consent every six to twelve months. Some regulators focus less on the calendar and more on triggers: re-prompt when the purposes change, when new vendors are added, or when the visitor clears cookies. The safest reading is that both matter: a maximum interval plus event-based re-prompts.
Document your interval and your reasoning. If a regulator ever asks why you re-prompt annually, "our documented policy sets twelve months as the maximum consent age, with immediate re-prompt on vendor changes" is an answer. "We never thought about it" is not.
The UX cost of getting it wrong
Every re-prompt is an interruption, and interruptions have a conversion cost. A full banner reappearing for a returning customer breaks their flow and trains them to click whatever dismisses it fastest, which is usually "accept all." Paradoxically, aggressive re-prompting can inflate your consent rates while degrading their meaning: more acceptances, less actual choice.
The design matters as much as the interval. A re-prompt does not have to be the full banner. A returning visitor can get a subtle notice that their preferences are due for review, with the full preference center one click away. Reserve the full banner for first visits and for moments when something actually changed.
A workable policy for a Shopify store
A sensible default: re-prompt twelve months after the last consent choice, and immediately whenever the vendor list or purposes change. Store the consent timestamp alongside the choice itself, so the interval is computed from data rather than guessed. Test that the re-prompt actually fires by simulating an expired consent record; this is the step most stores skip.
Handle the edge cases explicitly. Visitors who rejected everything should get the gentlest possible re-prompt, since they have already told you their preference twice. Visitors whose consent predates a major vendor change should be re-prompted regardless of the calendar. And anyone who clears cookies starts over as a new visitor, which your banner should already handle.
Re-prompting is also a data hygiene moment
Treat the re-prompt cycle as a chance to clean house. Each cycle, review whether every vendor still needs to be on the list, whether every purpose is still accurate, and whether the preference center still matches reality. Consent interfaces accrete vendors the way closets accrete boxes; the re-prompt interval is the scheduled moment to throw things out.
Log the re-prompts. A timestamped record showing that consent was refreshed on schedule, with the vendor list version attached, is exactly the kind of boring evidence that wins privacy arguments. Nobody celebrates it, but it is the difference between a defensible program and a hopeful one.