The banner your returning visitors have seen 40 times

Ask a regular visitor what they think of your cookie banner and the answer is rarely "informative." It's "again?" Consent fatigue is what happens when people see so many consent prompts, on your site and every other, that they stop reading and start reflexively clicking whatever makes the box go away. In your numbers it shows up as fast, thoughtless clicks and, worse, as returning visitors who resent the site. The fix is mostly about not asking when you don't need to.

This is the optimization side of re-consent. For the legal rules on how long consent lasts and when you're required to ask again, see consent expiry and re-consent best practices.

How long consent should last

There's no fixed legal expiry. GDPR doesn't put a number on it. What regulators offer is guidance: France's CNIL recommends storing a visitor's consent choice for around six months before asking again, and capping cookie lifespans at roughly 13 months. Germany's guidance lands in a similar six-to-twelve-month range. The practical takeaway: somewhere between six and twelve months is a defensible window to remember a choice. Re-prompting a returning visitor every session, or every week, is both bad UX and unnecessary.

If your banner reappears far more often than that, it's usually not by design. It's a bug.

Fatigue also has a compliance cost that's easy to miss. When people are worn down and click "accept" reflexively just to clear the box, that consent is weaker, arguably not the freely given, informed choice the law wants. A visitor who's been asked five times this week isn't reading the sixth prompt. So aggressive re-prompting annoys people and quietly degrades the quality of the very consent you're collecting.

The technical reasons visitors see the banner too often

Most over-prompting traces to how the consent choice is stored and read. The usual suspects:

Consent stored with too short a lifetime. If the cookie or localStorage entry that records the choice expires in days, the banner comes back in days. Set the storage lifetime to match your re-consent policy.
Cookie scoped to the wrong domain. A consent cookie set on www.example.com won't be read on shop.example.com. Visitors crossing subdomains get re-asked. Scope the consent cookie to the parent domain if you want it shared, and see cross-domain consent sharing for spanning separate domains.
Single-page apps re-showing on route changes. In a SPA, if the banner logic runs on every route change without checking existing consent, it can flash the banner repeatedly within one visit. Read stored consent once on load and don't re-trigger. See consent in single-page apps.
Clearing consent on logout or cache purges. Wiping all storage on logout takes the consent record with it. Preserve the consent entry across those events.

Before you touch copy or design to fight fatigue, confirm you're not accidentally re-prompting people who already answered. That's the highest-value fix and it costs nothing in consent rate.

When you should re-prompt (and when you shouldn't)

Some re-consent is legitimate and required. Ask again when:

Your processing purposes change, or you add a new category of tracking.
You add new vendors or data recipients the visitor didn't agree to.
Your storage window (six to twelve months) has genuinely elapsed.
There's a material change to your cookie or privacy policy.

Don't ask again just because the visitor came back, cleared an unrelated cookie, or moved to another page. And when you do have to re-prompt after a policy change, say why: "We've updated how we use cookies, please review your choices" respects the visitor's time far more than a silent reappearance of the same banner.

Make the "change my mind" path easy instead

The flip side of not nagging people is giving them an easy way to revisit their choice when they want to. A persistent, small preferences link or floating button lets someone change consent on their terms without you re-prompting everyone to reach the few who want to adjust. It's the pattern regulators like (withdrawing consent should be as easy as giving it), and it removes the excuse for aggressive re-prompting. See the floating preferences pattern.

Respect signals that mean "stop asking"

If a visitor's browser sends a Global Privacy Control signal, honor it as the opt-out it is and don't badger them with a banner that ignores it. Re-asking someone who has already expressed a preference at the browser level is the definition of fatigue, and in several US states ignoring GPC is a compliance problem on top of a UX one.

Don't stack your interruptions

Fatigue compounds. A visitor who lands on your homepage and gets a cookie banner, a newsletter popup, and an app-install interstitial in the first five seconds will dismiss all three without reading any of them, and your consent prompt is collateral damage. If you run other modals, sequence them so the consent banner has the stage first and the rest wait until the visitor has actually engaged with the page. One clear ask beats three competing ones, and it protects the quality of the consent you collect.

The short version

Consent fatigue is mostly self-inflicted. Store the choice for a sensible window, scope it correctly, read it once, and stop re-prompting people who already decided. Ask again only when the law or a real change in your processing calls for it, and make the voluntary "change my settings" path easy so you're never tempted to nag. CookieBeam remembers a visitor's choice for a configurable window, respects GPC, and gives every banner a built-in preferences link, so returning visitors get your content instead of the same question they answered last month.