_gcl_au Cookie: What It Is, Who Sets It, and Consent Rules

What the _gcl_au Cookie Does on Your Site

The _gcl_au cookie is a first-party advertising cookie that the Google tag sets for Google Ads to link conversions on your site to ad interactions. The _gcl_au cookie stores a random identifier and the time the cookie was created. Google uses cookies that start with _gcl_ mainly to help advertisers count how often people who click their ads take an action on their site. The explanation comes from the Google page on how Google uses cookies.

The Google tag reads the _gcl_au cookie when a conversion happens, such as a purchase or a form submission, and sends the identifier with the conversion to Google Ads. The _gcl_aw cookie holds the click ID itself after a visitor clicks an ad.

The value of the _gcl_au cookie looks like 1.1.1234567890.1712345678. The table explains each part.

Who Sets the _gcl_au Cookie

The Google tag with a Google Ads AW- ID sets the _gcl_au cookie, and so does the Conversion Linker tag in Google Tag Manager. The Conversion Linker "stores this information in new cookies on your domain", according to the Google Ads help on conversion tracking. Scans by the TermsFeed website auditor on 25 September and 9 October 2026 found the _gcl_au cookie written by gtm.js on both sites.

The _gcl_au cookie appears on visits without any ad click, because the Conversion Linker writes the identifier on every page view. A site that runs Google Tag Manager with a Conversion Linker tag sets the _gcl_au cookie even when nobody remembers adding Google Ads.

Read how Google LLC handles the data in the Google Ads privacy policy, and sign the Google Ads Data Processing Terms before you collect data from visitors in the EU or the UK. Both documents appear in the sources at the end of this page.

Does the _gcl_au Cookie Need Consent?

Yes, the _gcl_au cookie needs consent in the EU and the UK, and needs no prior opt-in in California. The table gives the rule for each law.

The consent table describes what each law requires and is not legal advice. Whether a law applies to your site depends on where your visitors are, where your business is based, and how you set up Google Ads, such as conversion linking and Google Consent Mode v2.

The ePrivacy Directive requires consent before a site sets the _gcl_au cookie. The General Data Protection Regulation (GDPR) sets the standard for that consent: freely given, specific, informed, and unambiguous.

The UK Privacy and Electronic Communications Regulations (PECR) require consent before a site sets the _gcl_au cookie.

The California Consumer Privacy Act (CCPA) sets no general opt-in requirement before a site sets the _gcl_au cookie. The CCPA treats the data the _gcl_au cookie collects for cross-context behavioral advertising as sharing. Offer visitors a way to opt out of sale and sharing, such as a "Do Not Sell or Share My Personal Information" link or the alternative opt-out link the CCPA regulations allow. Honor Global Privacy Control (GPC) signals as opt-out requests. Sharing the data of a consumer under 16 needs opt-in consent instead: from the consumer from 13 to 15 years, and from a parent under 13.

Read how each law decides which cookies need consent in the EU ePrivacy Directive + GDPR guide, the UK PECR guide, and the California CCPA guide.

How to Block the _gcl_au Cookie Until Visitors Accept

Block the _gcl_au cookie by holding back the Google tag with your AW- ID until the visitor accepts advertising cookies. TermsFeed Free Cookie Consent and TermsFeed Privacy Consent place Google Ads in the advertising category. Check whether an exemption applies to your own use of Google Ads in the consent rules for the _gcl_au cookie.

<script type="text/plain" data-cookie-consent="targeting" async src="https://www.googletagmanager.com/gtag/js?id=AW-YOUR_ID"></script>
<script type="text/plain" data-cookie-consent="targeting">
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'AW-YOUR_ID');
</script>

Block the _gcl_au Cookie With Google Consent Mode v2

Google Consent Mode v2 loads the Google tag before consent and holds the Google Ads cookies while ad_storage is denied. Set ad_storage, ad_user_data, and ad_personalization to denied by default, and update all 3 to granted once the visitor accepts advertising cookies.

Advanced consent mode sends measurements without cookies to Google while consent is denied, and basic consent mode loads no Google tag before the visitor answers. Google requires consent signals through Google Consent Mode v2 for visitors in the European Economic Area (EEA), according to the Google EU user consent policy.

Set up the default and the update calls with how to integrate Google Consent Mode v2 with Cookie Consent.

Stop the _gcl_au Cookie in the Google Tag Settings

Turn off conversion linking in the Google tag to stop the first-party _gcl_ cookies for every visitor. Google Ads then measures conversions less accurately, and the Google Ads help on conversion tracking says the opt-out "isn't recommended".

Use Google Consent Mode v2 with ad_storage denied instead of a site-wide opt-out. Consent mode stops the Google Ads cookies for every visitor who declines and keeps full conversion measurement for every visitor who accepts.

How to Verify That the _gcl_au Cookie Waits for Consent

Verify the setup in a private window. Open Chrome DevTools, select the Application tab, and open Cookies. Click "I decline" on the consent banner and reload the page. The _gcl_au cookie must not appear in the list until you accept advertising cookies.

How Long the _gcl_au Cookie Lasts

The _gcl_au cookie lasts 90 days (3 months). Safari caps the cookies that JavaScript sets at 7 days of Safari use without an interaction with your site, according to the WebKit team behind Safari.

Google states that "'_gcl_' cookies last for 90 days" on the Google page on how Google uses cookies, and the auditor scans measured the same 90-day expiry for the _gcl_au cookie.

Cookies That Work Together With _gcl_au

Google Ads sets 3 other cookies and 1 browser storage key next to the _gcl_au cookie in its current setup.

Scripts and Requests of Google Ads That Come With the _gcl_au Cookie

The catalog lists 5 scripts, pixels, and data endpoints of Google Ads, which a cookie scanner or the Network tab of Chrome DevTools shows next to the _gcl_au cookie. Block the main script, and the requests in the table stop with the main script.

_gcl_au Cookie FAQs

Is _gcl_au a necessary cookie?

No, the _gcl_au cookie is not a strictly necessary cookie. Firstly, your site works the same for a visitor who refuses the _gcl_au cookie. Secondly, Google Ads uses the _gcl_au cookie to measure ad conversions, a purpose the ePrivacy Directive exemption does not cover. Thirdly, Google itself stops Google Ads cookies through Google Consent Mode v2 until the visitor grants ad_storage.

What is the difference between _gcl_au and _gcl_aw?

The _gcl_au cookie holds a random identifier for every visitor, and the _gcl_aw cookie holds the Google click ID (GCLID) of a visitor who clicked a Google ad. Google adds the click ID to the landing page URL as the gclid parameter, and the Google tag stores the click ID in the _gcl_aw cookie.

Why do I see _gcl_au without running Google Ads?

The _gcl_au cookie comes from the Conversion Linker tag or a Google tag with conversion linking, which often stays in Google Tag Manager after an old campaign. Open Google Tag Manager, search the tags for "Conversion Linker", and remove the tag when no Google Ads or Floodlight account uses it.

Does the _gcl_au cookie contain personal data?

Yes, the _gcl_au cookie holds personal data under the GDPR. Firstly, the identifier is unique to a single browser. Secondly, Google Ads links the identifier to the conversions of that browser. Thirdly, Recital 30 of the GDPR names cookie identifiers among the online identifiers that make a person identifiable.