_ga Cookie: What It Is, Who Sets It, and Consent Rules

What the _ga Cookie Does on Your Site

The _ga cookie is a first-party analytics cookie that Google Analytics 4 sets to tell one visitor apart from another. The _ga cookie stores a random client ID and the time of the first visit. Google Analytics 4 sends the client ID with every page view and event, which lets your reports count users instead of page loads. Google describes the _ga cookie as "Used to distinguish users" in the Google Analytics help article "Google Analytics cookie usage on websites".

The _ga cookie works with the _ga_<container-id> cookie. The _ga cookie identifies the browser for every Google Analytics 4 property on the site, and the _ga_<container-id> cookie keeps the session state of a single property.

The value of the _ga cookie looks like GA1.1.1234567890.1712345678. The table explains each part.

Who Sets the _ga Cookie

Google Analytics 4 sets the _ga cookie through the Google tag (gtag.js) that you add to your site directly or through Google Tag Manager. Plugins and apps add the same Google tag, for example Site Kit by Google on WordPress and the Google and YouTube app on Shopify. A site then sets the _ga cookie without any code edit.

The Google tag writes the _ga cookie with JavaScript in the browser, so the _ga cookie belongs to your domain and counts as a first-party cookie. Google still receives the client ID with every measurement request to google-analytics.com.

Read how Google LLC handles the data in the Google Analytics 4 privacy policy, and sign the Google Ads Data Processing Terms, which cover Google Analytics before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.

Does the _ga Cookie Need Consent?

Yes, the _ga cookie needs consent in the EU, needs consent in the UK unless the statistics exception covers your setup, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Google Analytics 4, such as Google signals and the data sharing settings of the account.

The ePrivacy Directive requires consent before a site sets the _ga cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous. The CNIL in France exempts audience measurement cookies from consent only for tools set up to its conditions. The conditions include statistics that stay with the site and a cookie lifetime of 13 months at most. Google Analytics 4 does not meet those conditions in its default setup.

The UK Privacy and Electronic Communications Regulations (PECR) exempt analytics cookies that produce aggregate statistics to improve the site. The exemption comes from the Data (Use and Access) Act 2025 and took effect on 5 February 2026. The exemption needs clear information for visitors and a simple and free way to object, according to the ICO guidance on the exceptions. The exemption allows no tracking or profiling of individual visitors. The vendor needs to act as your processor, and recordings of individual visitors and advertising purposes stay outside the exemption. Google Analytics 4 meets those conditions only when Google acts as your processor and uses the data for nothing else. Turn off Google signals and the data sharing settings that let Google use the data for its own purposes before you rely on the exemption. Check your setup against the ICO guidance.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the _ga cookie. Visitors get no right to opt out of the _ga cookie while Google Analytics 4 acts as your service provider. The service provider role needs a contract that limits the use of the data to the service for your site. Turn on Google signals or link Google Ads for ads personalization, and the data from the _ga cookie becomes part of cross-context behavioral advertising, which the CCPA treats as sharing.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the _ga Cookie Until Visitors Accept

Block the _ga cookie by holding back the Google tag (gtag.js) until the visitor accepts analytics cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place Google Analytics 4 in the analytics category. Check whether an exemption applies to your own use of Google Analytics 4 in the consent rules for the _ga cookie.

Google Analytics 4 writes no _ga cookie while the Google tag waits as a tagged script, so a visitor who declines sends no request to Google Analytics.

<script type="text/plain" data-cookie-consent="tracking" async src="https://www.googletagmanager.com/gtag/js?id=TAG_ID"></script>
<script type="text/plain" data-cookie-consent="tracking">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'TAG_ID');
</script>

Block the _ga Cookie With Google Consent Mode v2

Google Consent Mode v2 loads the Google tag before consent and stops the Google Analytics 4 cookies while analytics_storage is denied. Google tags "won't read or write first-party analytics cookies" while analytics_storage is denied, according to the Google consent mode documentation.

Advanced consent mode sends measurements without cookies to Google while consent is denied, and Google uses them for modeling. Basic consent mode loads no Google tag before the visitor answers. Choose basic consent mode to send no request to Google before consent.

Set up the default and the update calls with how to integrate Google Consent Mode v2 with Cookie Consent.

How to Verify That the _ga Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The _ga cookie must not appear in the list until you accept analytics cookies.

How Long the _ga Cookie Lasts

The _ga cookie lasts 2 years (730 days), and the lifetime restarts at every page view. Chrome keeps the cookie for 400 days (about 13 months) at most, according to the Chrome team. Safari caps the cookies that JavaScript sets at 7 days of Safari use without an interaction with your site, according to the WebKit team behind Safari.

Change the lifetime in Google Analytics under Admin, Data streams, Configure tag settings, and Override cookie settings, which accepts a value from immediately to 25 months, according to Google. A cookie_expires value in the Google tag or in Google Tag Manager takes precedence over the setting in the Google Analytics interface.

Expect a shorter lifetime than 2 years in practice. Scans of 2 sites by the TermsFeed website auditor on 9 October 2026 found the _ga cookie with a 400-day expiry in Chrome on both sites. Chrome applies that 400-day limit to every cookie.

Cookies That Work Together With _ga

Google Analytics 4 sets 1 other cookie next to the _ga cookie in its current setup, and older versions set 4 more. Rows marked "older version" come from earlier versions of Google Analytics 4 that still run on some sites.

Scripts and Requests of Google Analytics 4 That Come With the _ga Cookie

The catalog lists 6 scripts, pixels, and data endpoints of Google Analytics 4, which a cookie scanner or the Network tab of Chrome DevTools shows next to the _ga cookie. Block the main script, and the requests in the table stop with the main script.

Changes to the _ga Cookie

The catalog records 2 dated changes that affect the _ga cookie. The newest change comes first.

_ga Cookie FAQs

Is _ga a necessary cookie?

No, the _ga cookie is not a strictly necessary cookie. Firstly, your site works the same for a visitor who refuses the _ga cookie. Secondly, Google Analytics 4 uses the _ga cookie to measure visitors, a purpose the ePrivacy Directive exemption does not cover. Thirdly, Google itself stops the _ga cookie through Google Consent Mode v2 until the visitor grants analytics_storage.

Does the _ga cookie contain personal data?

Yes, the _ga cookie holds personal data under the GDPR. Firstly, the client ID in the _ga cookie is unique to a single browser. Secondly, Recital 30 of the GDPR names cookie identifiers among the online identifiers that make a person identifiable. Thirdly, Google Analytics 4 links every page view and event of the browser to the same client ID.

What is the difference between the _ga and _ga_ cookies?

The _ga cookie identifies the browser, and the _ga_<container-id> cookie stores the session state of a single Google Analytics 4 property. The <container-id> part is the measurement ID of the property without the G- prefix, so a site with 2 properties sets 1 _ga cookie and 2 _ga_<container-id> cookies.

What is the difference between _ga and _gid?

The _ga cookie identifies a browser for 2 years, and the _gid cookie identified a browser for 24 hours in Universal Analytics. Google Analytics 4 sets no _gid cookie, so a _gid cookie on your site today comes from an old Universal Analytics tag. Remove the old tag, because Universal Analytics stopped processing data on 1 July 2023.

How do I delete the _ga cookie?

Delete the _ga cookie in Chrome DevTools: open the Application tab, open Cookies, select your domain, and delete the _ga row. The Google tag writes a new _ga cookie with a new client ID at the next page view, so Google Analytics 4 counts the same person as a new user.