Last Updated: October 4, 2023

Why do you need a great understanding of Google Analytics 4 Cookies?

If you really want to understand how Google Analytics 4 (GA4): collects data, defines users, defines sessions, and defines metrics and/or if you want to implement cross-domain tracking, cross-device tracking or any other specialized tracking in GA4, then you need to develop a good great understanding of GA4 cookies.

Introduction to Cookies

A cookie is a text file that is used to:

• Store information about user preferences, user location, and other details
• Protect users’ data from unauthorized access
• Maintain certain websites’ functionality
• Serve personalize ads to users and make advertising more effective via re-marketing
• Collect Google Analytics data and other tracking data.

Cookies are stored on a user’s hard disk and can be enabled or disabled via web browser settings. 

In general, a browser can accept a maximum of 300 cookies, and the maximum size of each cookie could be 4096 bytes. 

The different browser has a different limit set for cookie storage. 

So as of now, the maximum size per cookie limit is as below based on the browser type.

• Google Chrome – 4096 bytes
• Internet Explorer – 5117 bytes
• Firefox – 4097 bytes
• Microsoft Edge – 4097 bytes

Typically, the following configuration is allowed

• 300 cookies in total
• 4096 bytes per cookie
• 20 cookies per domain
• 81920 bytes per domain

Cookies are nothing but a piece of code saved by the websites onto the user’s web browsers when a session is initiated. 

As mentioned above, they have many uses, but the most important ones are session management, user personalization, and tracking.

Cookies are not programs; they do not perform any function. 

For example, if a user visits a website, that website’s cookie is dropped on the user’s browser.

When the users visit the website again after a few days, the website will know that it was the same user.

With the EU cookie policy in place, every website owner must now seek the user’s consent before dropping any cookies in their browser. 

According to GDPR, users have all the rights to opt-in or opt-out of the cookies, and they also have the right to opt-out of specific cookies as well (for example, opting out of marketing cookies).

Note: You cannot determine the exact number of users who have cookies enabled/disabled.

Get this 70 page detailed checklist containing screenshots, step-by-step instructions and links to articles

Do you want to set up Google Analytics 4 (GA4) fast and correctly?

Yes I want the ebook

Types of Cookies

There are two types of cookies:

#1 First-Party Cookies

These cookies are issued by the website being visited, and only the website which issued the first-party cookies can read them.

The data collected by these cookies is used mainly for calculating sessions, pageviews, bounce rate and other metrics.

As an example of the first-party cookie, when a user signs into an ecommerce website, the web browser will send a request in a process that provides the highest level of trust that the user is directly interacting with the main website. 

The website drops a cookie into the user’s browser under the same domain name.

#2 Third-Party Cookies

These cookies are issued by the website(s) other than the website being visited. For example, say you have visited an online shopping website and spent

some time on the product purchase page and did not make a purchase. Later, you would receive emails about a price drop for the same product that you looked at. These are shown to the user by remarking pixels placed on the page.

Cookies With and Without Expiration Date

Cookies (both first and third-party cookies) can be set with or without an expiration date.

The cookies set without an expiration date are known as temporary cookies. Such cookies expire when you end the web session or close the browser window.

The cookies set with an expiration date are known as persistent cookies.

Such cookies expire only on the expiration date and can remain on your computer even when you have ended the web session or closed your browser window.

Apart from this, you also have secure cookies. Only an HTTPS website can set these cookies.

It is mostly ecommerce websites with checkout pages that redirect to payment gateways with secure cookies to make transactions safe and secure. Banking websites also use secure cookies.

Note: All Google Analytics cookies are persistent except the _utmc cookie, which is temporary.

Cookies Set By Google

Google sets different types of cookies for different purposes.

Following are the type of cookies set by Google on a user’s hard disk:

• Preference cookie (PREF) is used to store users’ preferences (like preferred language or any type of customization).
• Security cookies (like ‘SID’ and ‘HSID’) are used to protect users’ data from unauthorized access.
• Advertising cookies (like ‘id’) used to serve personalized ads to users and to make advertising more effective
• Analytics cookies (like _utma, _utmb, _ga, etc.) are used to collect Google Analytics data.

Introduction to Google Analytics 4 Cookies

Google Analytics 4 sets cookies to:

• Identify unique users
• Identify unique sessions
• Throttle the request rate
• Store information about users’ sessions and campaigns.

Google Analytics 4 mainly sets first-party cookies.

But it can also set third-party cookies (DoubleClick cookies) if a website uses GA4 display advertiser features, such as re-marketing.

Cookies and JavaScript Libraries

Google Analytics uses cookies based on the JavaScript library being used.

Google Analytics has got four types of JavaScript libraries for tracking website usage data:

1. Google Analytics 4 (gtag.js)
2. Universal Analytics (gtag.js)
3. analytics.js (used in Universal Analytics)
4. AMP HTML

Google Analytics Cookies are created as soon as you visit a website on which a valid Google Analytics tracking code is installed and fired.

Since all cookies are browser-specific, Google Analytics will set a different set of cookies if you return to a website via another web browser. 

If a GA cookie already exists, it is updated to collect users’ data. So if you try to create a cookie that already exists, it will be overwritten.

Note: Google Analytics does not store and does not allow any personally identifiable information in its cookies.

Cookies used by Google Analytics 4

The Google Analytics JavaScript library sets the following first-party cookies:

#1  _ga cookie – used to identify unique users and expires after two years.

#2  _gat cookie – used to throttle the request rate, and it expires after one minute. If Google Analytics is set up using GTM, this cookie is set as  _dc_gtm_<property-id>.

#3  _gid – used to identify the user and expires in 24 hours

These cookies are set on the top-level domain so that users can be automatically tracked across subdomains without any extra configuration.

Get this 70 page detailed checklist containing screenshots, step-by-step instructions and links to articles

Do you want to set up Google Analytics 4 (GA4) fast and correctly?

Yes I want the ebook

Understanding Top-Level Domains

The top-level domain is the highest domain level.

For example, in the case of the following domains:

1. www.abc.com
2. music.abc.com
3. asian.music.abc.com

The highest domain level is abc.com.

So the top-level domain is abc.com

The second highest domain levels are: www.abc.com and music.abc.com

The third highest domain level is asian.music.abc.com

Note: Ideally, ‘.com’ should be the highest domain level. But Google Analytics can not set up a cookie at ‘.com’ level.

Creating gtag.js Cookies

To create gtag.js cookies,  you need to create a tracking object using the ‘config’ command.

Syntax: gtag(‘config’, ‘GA_TRACKING_ID’);

Note: Google Analytics 4 can also collect data even without any cookies through the GA4 measurement protocol.

Viewing Google Analytics Cookies

The Google Analytics cookies are set as soon as a user loads your web page in his browser (provided the web page contains valid Google Analytics tracking code and it fires on page load).

To view the analytics.js cookies, follow the steps below:

Step-1: Click on the 3 dots at the left corner of your Chrome browser and then click on settings.

Step-2: Scroll Down and click on ‘Cookies and other site data‘ in Privacy and Security.

Step-3: Scroll Down and Click on “See all cookies and site data”.

Step-4: Look for your website domain and click on it.

Step5: Click on “_ga” and in content, you will find your Google Analytics 4 cookie.

_ga cookie is made up of the following four fields:

The first field is the version number like GA1.

The second field is the number of components at the domain separated by a dot.

By default, the _ga cookie is set on the top-level domain with the root level (/) path. 

So if you have set a cookie at the top-level domain like optimizesmart.com then the second field would have a value of 2 as there are 2 components separated by a dot. 

One component is ‘optimizesmart’ and the second component is ‘com’.

If you have set up a cookie at the sub-domain level, like analytics.optimizesmart.com, then the second field would have a value of 3 as there are now three components separated by a dot. 

The first component is ‘analytics’.

The second component is ‘optimizesmart’.

The third component is ‘com’

The third field is a random unique ID (randomly generated number). Here 908899769 is the random unique id.

The fourth field is the first timestamp, i.e. the time when the cookie was first set for the user. Here 1600020018 is the first timestamp.

The third and fourth fields together make the client ID. So the client ID would be 908899769.160020018. 

Cookies and Client ID

Google Analytics identifies unique users across GA4 sessions through client ID.

The client ID is stored in the Google Analytics cookie.

The GA cookie is set when a person visits your website for the first time. Google Analytics sends the client ID with each hit to associate hits with a user.

A GA cookie can exist only on the device and browser where it has been set. 

Since the client ID is stored in a GA cookie, the client ID will also exist only on the device and browser where it has been set. 

Because of this reason, by default, GA can’t identify unique users across different web browsers and devices.

Also, note that cookies are site-specific. The default Google Analytics implementation will track the subdomain user’s activity. 

If a user travels between the site and the subdomain, they will still maintain the same cookie. 

However, cross-domain tracking is different; cookies will not be shared unless you have set up cross-domain tracking correctly on your website.

If you want to retrieve the client ID from _ga cookie, then use the following call back function:

ga(function(tracker) {
var clientId = tracker.get(‘clientId’);
});

If you want to collect client IDs in GA reports, then you can do that by creating a new custom dimension with user scope:

ga(‘set’, ‘dimension1’,clientId); for Universal Analytics

gtag(‘set’, ‘parameter_name’, clientId); for Google Analytics 4 (here parameter name is the name you have set for the user scope custom dimension in GA4.

Identifying unique users across different web browsers and devices is known as ‘Cross-Device Tracking’.

If users can log in on your website, then you can implement cross-device tracking with the help of a User ID.

Get this 70 page detailed checklist containing screenshots, step-by-step instructions and links to articles

Do you want to set up Google Analytics 4 (GA4) fast and correctly?

Yes I want the ebook

Cookies and User ID

User ID is a unique random number used to uniquely identify users across different web browsers and devices.

According to Google’s terms of service, the User ID must not contain any personally identifiable data like the user’s name, email address, etc. 

User ID is different from client ID in that client ID is generated by Google Analytics. Whereas a User ID is generated by your users’ authentication system (like Website Login).

To send user ID data to Google Analytics, use the ‘set’ command method like the one below:

gtag(‘set’, ‘userId’, ‘USER_ID’);

here, the value of USER_ID is of type string. For example:

gtag(‘set’, ‘userId’, ‘DTS234554134’});

You can also send user ID data to GA while creating the tracking object:

gtag(‘config’, ‘STREAM_ID’, {

  ‘user_id’: ‘id’

});

There are two important points that you need to remember about using user IDs:

#1 The user IDs must be set after the tracking object has been created. Otherwise, the user IDs will not be associated with your web property.

#2 The user IDs must be set before you send any hit data to GA. Otherwise, user IDs won’t be set for all subsequent hits that occur on a page.

Note: You can also set up user IDs for mobile apps.

Attributes of _ga Cookie

_ga cookie has got the following attributes:

1. Cookie name
2. Cookie domain
3. Cookie path
4. Cookie expires

You can modify _ga cookie by changing its attributes.

Note: Google recommends not to directly access the _ga cookie as the cookie format might change without warning, which could lead to script errors and incorrect data.

#1 Cookie name

The cookie name is the name of the google analytics cookie, which is _ga by default. 

If you want to change this cookie name to something else, you can do this by setting the cookieName field. For example:

gtag(‘config’, ‘Stream_ID’, {‘cookieName’: ‘optimizesmart’});

The cookieName field accepts values of type text.

#2 Cookie Domain

Cookie domain is the domain at which the Google Analytics cookie _ga is set up.

By default, the cookie is set on the top-level domain.

So, if you set a cookie at the top-level domain like www.optimizesmart.com, the cookie domain would be ‘optimizesmart.com’.  (without ‘www.’ Prefix).

If you want to set _ga cookie at the sub-domain level like music.optimizesmart.com, then set the cookieDomain field as:

gtag(‘config’, ‘Stream_ID’, {‘cookieDomain’: ‘music.optimizesmart.com’});

If you want to set _ga cookie at the sub-sub-domain level like asian.music.optimizesmart.com, then set the cookieDomain field as:

gtag(‘config’, ‘Stream_ID’, {‘cookieDomain’: ‘asian.music.optimizesmart.com’});

Note: The cookieDomain field accepts values of type text.

The cookie domain needs to be an ancestor of the current domain.

In the case of cross-domain tracking, the cookie domain needs to be an ancestor of the current domain.

For example, if the current domain is www.abc.com, you can set the cookie at abc.com as abc.com is the ancestor of www.abc.com.

But you can’t set a cookie at music.abc.com because it is not the ancestor of www.abc.com.

Similarly, you can’t set a cookie on some other website like ‘example.com’ because it is not the ancestor of www.abc.com.

Note: When you set an incorrect value for cookieDomain, the _ga cookie is not set.

Setting cookies on localhost.

If you want to set _ga cookie on localhost, then set the value of cookieDomain to ‘none’. For example:

gtag(‘config’, ‘Stream_ID’, {‘cookieDomain’: ‘none’});

Automatic cookie domain configuration

If you want google analytics to automatically determine and set the _ga cookie at the top-level domain or automatically set the value of cookieDomain to ‘none’ when you use localhost, then use ‘auto’ as the value of cookieDomain.

For example:

gtag(‘config’, ‘Stream_ID’, {‘cookieDomain’: ‘auto’});

You can also write this line of code as:

gtag(‘config’, ‘Stream_ID’,‘auto’);

The advantage of using an automatic cookie domain configuration is that you can track users across all sub-domains without any additional configuration.

#3 Cookie Path

Cookie Path is the path at which the cookie is set up.

The _ga cookie is set on the top-level domain with the root level (/) path by default.

If you want to modify the _ga cookie path from the default ‘/’ to say ‘/lib’, then set the ‘cookiePath‘ field to ‘/lib’:

gtag(‘config’, ‘Stream_ID’, {‘cookiePath’: ‘/lib/’});

Note: Google does not recommend changing the cookie path.

#4 Cookie Expires

Cookie Expires is the time in seconds after which the _ga cookie will expire.

By default, a _ga cookie expires after two years from the date it was last refreshed.

Every time a new hit is sent to google analytics, the cookie is refreshed.

You can set your own cookie expiration time by using the cookieExpires field:

gtag(‘config’, ‘Stream_ID’, {‘cookieExpires’: 180});

Here we set the _ga cookie to expire after 180 seconds.

Note: The cookieExpires field accepts values of type integer.

Making  _ga cookie a ‘browser session’ based cookie

If you set the _ga cookie to expire after 0 seconds, then the cookie turns into a browser session-based cookie and expires once the current browser session ends.

For example:

gtag(‘config’, ‘Stream_ID’, {‘cookieExpires’: 0});

Note: The biggest drawback of the _ga cookie is that you can’t dig out session or campaign-specific data from the cookie as all of these calculations happen in the backend on GA servers