Google Analytics cookies

Which cookies Google Analytics 4 sets

Two, on a plain installation. Google’s cookie usage page for Google Analytics 4 properties lists _ga, with a default expiration of 2 years, described as used to distinguish users, and a second cookie that carries the container ID of your data stream in its name, written _ga_CONTAINER-ID in the documentation, also 2 years, described as used to persist session state. Both are first-party cookies, set from your own domain by the JavaScript tag rather than from a Google domain.

The count changes when other Google tags share the page. Google states that when a property is linked to a Google Ads account, its tags set additional cookies, and its advertising and measurement cookie reference gives their lifetimes: _gcl_au at 90 days for conversion linking, and _gac with the property identifier at 90 days. The same reference still lists the older analytics names, _gid at 24 hours and _gat at 1 minute, which belong to the earlier library rather than to a plain Google Analytics 4 install. What lands in a browser on your site is therefore a question about your tag setup, not about Google Analytics in the abstract, and the way to answer it is to open the storage panel in a browser and read the list.

One line on the same page is easy to miss: Google states that these libraries do not require you to set cookies to transmit data to Google Analytics. Cookies are how the same browser is recognised again, not how the request gets through.

What the values are for

Google describes purposes rather than formats. The first cookie separates one browser from another, which is what turns a stream of requests into a count of users. The second holds session state for one property, which is how a visit is continued rather than started again on the next page.

Where they are set matters as much as what is in them. By default the tag uses automatic cookie domain configuration and writes the cookie at the highest level of domain possible, so a visit to a blog subdomain and a visit to the main site belong to the same visitor; on localhost the domain is set to none instead. The names can be changed with a cookie_prefix parameter, and Google warns that changing them after visitors have arrived makes those visitors appear as new, because the context in the old cookies is lost.

How long they last, and how that is changed

The default is two years, and it rolls forward. Google states that on each page load the expiration is updated to the current time plus the configured lifetime, so a visitor who returns within the window keeps the same cookie and stays the same person in your reports. The behaviour is controlled by cookie_update, which defaults to true; set it to false and the expiry is measured from the first visit instead, after which returning visitors start counting as new.

The lifetime itself is cookie_expires, in seconds, and Google states that a value of zero turns it into a session cookie that ends with the browser session. The same two settings exist in the interface for people who would rather not touch tags: Admin, Data collection and modification, Data streams, the web stream, Google tag, Configure tag settings, Show all, Override cookie settings, where the expiration runs from immediately to 25 months and the update option is a choice between expiry relative to the most recent visit and expiry relative to the first. Google notes that settings configured in the tag or in Google Tag Manager override the ones set in the interface, which is the usual reason a change in Admin appears to do nothing.

Browsers cap the rest. Google’s own page states the limits it works within: a maximum of 400 days in Chrome and 7 days in Safari for first-party cookies where the visitor does not return. A two-year setting is an intention, not a measurement.

Cookies, consent and the banner

The consent question is not about the word cookie. The European Data Protection Board’s guidelines on the technical scope of Article 5(3) of the ePrivacy Directive, in the version adopted on 7 October 2024, state that the article does not apply exclusively to cookies but also to similar technologies, so moving an identifier from a cookie into local storage moves it sideways rather than out of scope. Separately, data protection law applies to personal data, and an IP address can be personal data.

Google’s mechanism for carrying a visitor’s choice to its tags is consent mode, and the parameter that governs analytics cookies is analytics_storage. Google states that when visitors deny consent, instead of storing cookies, tags send pings to Google, and that the resulting gaps are filled with conversion modelling and behavioral modelling. Those cookieless pings are not invisible afterwards: Google states that where consent mode is implemented, they appear in the BigQuery export along with customer-provided data such as user_id. Behavioral modelling has thresholds of its own, among them at least 1,000 events a day with analytics_storage denied for 7 days and at least 1,000 daily users with it granted on 7 of the previous 28 days.

Whether your site needs a banner depends on the rules that apply to you, on how the tool is configured and on everything else your pages load. This page is not legal advice; the guide on Google Analytics and the GDPR sets out who has said what, with dates.

How tools without cookies count visitors

The alternative is to recognise the browser without keeping anything in it, and the common method is a hash that expires on a schedule. Plausible states that it uses no cookies, browser cache or local storage, and that it builds a daily identifier by hashing a daily salt with the site domain, the IP address and the user agent, with the salt rotated and deleted every 24 hours and raw addresses never stored. Simple Analytics goes further in its documentation: no cookies and no similar technologies, including local storage and IP hashing, with a repeat visit detected from the referrer hostname instead.

The trade is visible in the reports. A daily hash cannot tell you that the same person came back next week, so returning-visitor and cross-day metrics either disappear or change meaning. That is the point for some sites and a loss for others.

One caution before you treat the label as a promise: cookieless does not always mean nothing is stored, since an identifier can sit in local storage instead. The cookieless tools page states the condition it applies, 23 of the 44 tools in the table meet it, and the privacy-friendly page sets out what each vendor claims and what was checked.

Questions and answers

How long does the _ga cookie last?

Two years by default, and the clock restarts on each page load unless that is switched off. Google’s documentation lists 2 years as the default expiration for both _ga and the per-property session cookie, and states that expiry is recalculated on every page view while cookie_update is true. Browsers shorten this in practice: Google names a cap of 400 days in Chrome and 7 days in Safari for a first-party cookie when the visitor does not come back.

Are Google Analytics cookies first-party or third-party?

First-party. The tag writes them from your own domain, on the highest level of domain it can detect, so rules aimed at third-party cookies do not remove them, although the browser lifetime caps above still apply. It also means they are yours to configure: domain, name prefix, lifetime and update behaviour are all settings on your side, and Google’s advertising and measurement cookie reference marks these cookies as set from the partner domain.

Can Google Analytics 4 run without cookies?

Partly, and Google documents the mechanics rather than recommending it. Its page states that the libraries do not require cookies to transmit data, and under consent mode with analytics_storage denied the tags send pings instead of writing cookies, with user and session figures then modelled. What you lose is the recognition that cookies provide, so counts of users and returning visitors become estimates produced under the conditions Google publishes.

Does shortening the cookie lifetime change my numbers?

Yes, in one direction. A shorter lifetime means a browser is recognised for less time, so the same person is counted as a new visitor more often and returning-visitor figures fall while user counts rise. Setting the lifetime to zero makes the cookie last only for the browser session. The change is not retroactive, which leaves a step in any chart that crosses the date you made it.

Which cookies does my site actually set?

Read them rather than assume. Open the site in a fresh browser profile, accept nothing, look at the cookie list in the developer tools, then accept the banner and look again: the difference is what your consent tool is really controlling. Tag managers, embedded video, maps, fonts, chat widgets and payment scripts each add their own entries, and analytics is usually a small part of the list.