What is the __Host-1PLSID cookie?
__Host-1PLSID belongs to Google's family of authentication cookies (alongside SID, HSID, SSID, LSID, and others) and is set by Google on the accounts.google.com domain when a user signs in to a Google account or interacts with Google services requiring authentication.
On a third-party site, this cookie typically appears when Google services are embedded, such as Google Sign-In, embedded YouTube videos, Maps, or other widgets that require an active Google session. The „__Host-” prefix is a browser security standard requiring the cookie to be sent only over HTTPS, with no Domain attribute and Path=/, which prevents it from being overwritten from subdomains.
What data it stores
The cookie stores an encrypted session identifier tied to the authenticated Google account, used to maintain and secure the login state. The value is an opaque string generated and interpreted exclusively by Google's systems.
The data is sent to Google's servers (accounts.google.com and related services) with each request to that domain; a third-party site does not have direct access to the cookie's contents, as it is managed entirely by Google's infrastructure.
What it is used for
For Google, the cookie ensures continuity of the authenticated session and protects against fraud and unauthorized account access. For the administrator of a site embedding Google services (login, video, maps, etc.), its role is purely functional: it allows the visitor's Google session to work correctly within the embedded widget.
It is not used for advertising or marketing tracking, but exclusively for account-level authentication and security.
Does it require consent?
CookieFix classifies __Host-1PLSID as a strictly necessary cookie. Since it is essential to Google authentication working correctly (without it, login or embedded Google services would not function properly), it does not require the visitor's prior consent under Romania's Law 506/2004 (transposing the ePrivacy Directive) and ANSPDCP guidance.
Site administrators should still list this cookie in their cookie policy, stating the provider (Google), purpose (authentication), and duration, to meet GDPR's transparency requirements.
How to block or delete __Host-1PLSID
A visitor can delete or block this cookie from browser settings (Chrome, Firefox, Edge, Safari – per-site cookie management), but doing so will sign them out of the active Google account and may break embedded Google widgets on the site.
- From the browser: delete cookies for accounts.google.com or block Google cookies in privacy settings.
- As a site administrator: being strictly necessary, it should not be blocked before consent; however, if the Google widget (e.g. Sign-In) only loads after a cookie category is accepted, a platform like CookieFix can automatically hold back the script that generates it until the visitor makes a choice.
Frequently asked questions
It is an authentication cookie set by Google on accounts.google.com, used to maintain and secure a Google account session.
No, it is classified as strictly necessary because it supports Google authentication functionality, so it falls outside the prior-consent requirement under ePrivacy/GDPR.
It is a browser security mechanism: the cookie can only be set over HTTPS, without a Domain attribute and with Path=/, which prevents it from being overwritten by other subdomains.
You will be signed out of the active Google account, and Google services embedded on the site (login, video, maps) may temporarily stop working correctly.