A cookie lasts exactly as long as whoever set it asked for, until something shortens it. The attribute that decides this is written by the server or the script at the moment the cookie is created, and there is no separate setting anywhere in your site that controls it. That surprises people, because it means the answer to how long your cookies last is not a policy you wrote, it is a list of numbers chosen by every tag you happen to be running.
Session, persistent, and what the attributes do
A cookie with no expiry attribute is a session cookie and the browser drops it when the browsing session ends. A cookie with either an Expires date or a Max-Age in seconds is persistent and survives a restart until that moment arrives. Both are set in the same header, and the choice between them is made per cookie by the code that writes it, which is why one tag on your site can be holding something for two years while another forgets it in an hour.
Why the number you asked for is not always the number you get
Browsers have been capping lifetimes for years, and they do it differently depending on how the cookie was set. Values written by a script in the page are treated more suspiciously than values written by the server in a response header, and cookies that look like cross-site identifiers are shortened or partitioned. The practical consequence is that a stated two year lifetime in a vendor's documentation may be days in a real visitor's browser, so an audit should record what the browser kept rather than what the vendor promised.
The lifetime a regulator will ask about
The question is rarely how long the cookie lives. It is how long the thing behind it lives: the profile, the identifier, the log. A short cookie feeding a long retained profile is not a short retention, and saying so in a cookie table is a common way to be accidentally wrong. When you write the table, write the lifetime of the cookie and the retention of what it feeds as two separate columns, because they are two separate answers.
How long to keep the consent itself
This is the one most banners get wrong, because the consent record is not a cookie. If you have to be able to show that a particular visitor agreed on a particular day against a particular version of the banner text, then the record has to outlive the cookie by a wide margin and be readable after the banner has been rebuilt twice. Pick a retention window deliberately, write it down, and make sure the store you keep it in is one you can still query when somebody asks.
Questions people ask about how long are cookies good for
What is the maximum a cookie can last?
There is no single figure any more. The header lets you ask for years; browsers cap what they will actually honour, and the cap depends on how the cookie was set and whether it looks like a cross-site identifier.
Does deleting a cookie delete the data behind it?
No, and this is the important distinction. Clearing the browser removes the key; whatever was collected under it is still wherever it was sent.
Do I have to re-ask for consent after a period of time?
There is no universal renewal interval. What forces a fresh ask is a material change to what you do, and in practice most sites also re-ask when the banner's categories change, because the old consent was given against different words.