# Does shortening the session timeout reduce what we store about visitors?

Asked by viggo_a on 2025-01-15. Tags: privacy, sessions, retention.

I am tuning data minimization as part of our privacy engineering work and have
three questions.

1. What exactly does the session timeout control?
2. If I shorten it from the default, does less data get stored, or does the same
   data get cut into more sessions?
3. I read there are grace windows for late-arriving events. What do those mean
   for my minimization assumptions

Suspect the timeout is the wrong lever but want to confirm before I write the
internal recommendation.

## 1 answer

### Answer from Jens Bakken (2025-01-15)

Your suspicion is correct, it is the wrong lever. In order:

1. The session inactivity timeout controls sessionization, meaning where one
   session ends and the next begins. Default is 30 minutes of inactivity,
   configurable from 1 minute to 24 hours, with an optional midnight
   expiration policy if you want sessions to never cross a calendar day.

2. Shortening it changes session boundaries, not volume. The same events get
   grouped into more, shorter sessions. Nothing is stored less; nothing is
   deleted sooner.

3. The grace windows reinforce that: late events have a 24-hour grace period,
   and sessions can reopen up to 48 hours. Those exist for data correctness,
   so a delayed event still lands in the right session, and they do not extend
   retention either.

The actual minimization levers for your recommendation are elsewhere: plan
retention windows (profiles, sessions, and events kept 1, 30, or 60 days
depending on plan), the 90-day analytics retention, the automatic deletion of
profiles inactive for 90 days, and the anonymity scope setting (Application,
Workspace, or Organization), which bounds how widely an anonymous identity is
shared across your properties. Tune those, leave the timeout at whatever makes
your analytics sensible.