> According to the ePrivacy Directive, they should not last longer than 12 months

The quote you keep referencing is false. The ePD says nothing about this.