Google Analytics 4 cookies: the complete list
Google Analytics 4 is the analytics tool on most small business websites. Here is exactly which cookies it sets, what they do, how long they last, and what that means for your cookie banner.
The cookies GA4 sets
According to Google's documentation, GA4 sets two cookies on your own domain:
_ga2 yearsDistinguishes users by giving each browser a randomly generated ID. GA4 uses it to count users and sessions.
First-party cookie
_ga_<container-id>2 yearsKeeps the session state for your GA4 property.
First-party cookie
The two-year lifetime is Google's default. Under the tag settings for your data stream you can choose whether it counts from the visitor's first visit or their most recent one.
Extra cookies when GA4 is linked to Google Ads
If you link Google Analytics to Google Ads, or run Google Ads conversion tracking on the same site, these cookies are added:
_gac_<property-id>90 daysCampaign information for Google Analytics when it is linked to Google Ads.
First-party cookie
_gcl_au, _gcl_aw90 daysUsed by Google Ads for conversion tracking and advertising measurement.
First-party cookie
Cookies you may still see: _gid and _gat
Many cookie lists still name _gid (24 hours) and _gat(1 minute). They are not on Google's list of GA4 cookies; they come from Universal Analytics, which Google switched off on 1 July 2024. If they turn up in your scan, an old tracking snippet is probably still on your site.
Which category do they belong to?
The GA4 cookies belong in analytics; the Google Ads cookies belong in marketing. None of them is needed for your website to work, so under the ePrivacy Directive they need the visitor's consent before they are set.
That means your cookie banner has to let visitors accept or refuse analytics cookies separately, and GA4 must not set its cookies before they have decided.
What happens when a visitor declines?
With a correctly set-up consent tool:
- No
_gaor_ga_cookies are set - The visitor is not counted as a returning user across visits
- In Consent Mode's basic mode, GA4 does not load at all and sends nothing
- In advanced mode, GA4 loads with consent denied and sends measurements without cookies, which Google uses to model the missing data
Read more in our guide to Google Consent Mode v2.
How to handle GA4 cookies with Consentaur
Put the Consentaur script first in your <head> (see the installation guide), then add data-cookiebar-category="analytics" to both parts of your GA4 snippet:
<script
src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"
data-cookiebar-category="analytics"
></script>
<script data-cookiebar-category="analytics">
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-XXXXXXX');
</script>Consentaur holds both scripts back until the visitor accepts analytics cookies, and it sets analytics_storage to denied by default and to granted once they accept. Its automatic scan also finds the cookies above and sorts them into the right categories for your cookie declaration.
Frequently asked questions
Does Google Analytics 4 need cookie consent in the EU?
Yes. Article 5(3) of the ePrivacy Directive only allows cookies without consent when they are strictly necessary for a service the visitor asked for, and analytics cookies are not. The GDPR also counts cookie identifiers as online identifiers, so the client ID in _ga is personal data.
Can I run GA4 without cookies?
With Google Consent Mode in advanced mode, GA4 stops setting cookies when analytics_storage is denied and sends measurements without cookies instead. Google's script still loads in the visitor's browser, though, which is why many businesses prefer basic mode: GA4 is blocked entirely until the visitor consents.
My cookie scan shows _gid and _gat. Are those GA4 cookies?
Google's list of GA4 cookies contains only _ga and _ga_<container-id>. _gid and _gat belong to the older Universal Analytics, which Google switched off on 1 July 2024. If your scan still finds them, check your site for old tracking code.
Does server-side tagging remove the need for consent?
No. Server-side tagging changes where the data goes after it leaves the browser. If your set-up still stores or reads a cookie on the visitor's device, the consent rules for that cookie still apply.
What about visitors from the UK?
The UK has its own cookie rules in the Privacy and Electronic Communications Regulations (PECR). Since the Data (Use and Access) Act 2025, PECR includes an exception for some analytics cookies, with conditions such as clear information and a simple, free way to object. Check the ICO's guidance before relying on it for Google Analytics.
Read next
Handle GA4 cookies properly
Consentaur finds and categorises the cookies on your site, holds Google Analytics back until visitors consent and sends Consent Mode v2 signals for you.
Start your free trial14-day free trial. No credit card required.