What is the __Host-GAPS cookie?
__Host-GAPS is a cookie placed by Google, specifically on accounts.google.com, the central authentication system Google uses for Gmail, YouTube, Google Drive, and other connected services.
The „__Host-” prefix is not arbitrary: it is part of a browser security standard that enforces strict rules on the cookie — it must be set with the Secure attribute, without a Domain attribute (so it only applies to the exact domain that created it), and with Path=/. This reduces the risk of the cookie being read or spoofed by other subdomains or third-party scripts.
On a typical website, this cookie usually appears when a visitor uses a „Sign in with Google” button or another Google Identity integration, rather than through a script placed directly by the site owner.
What data it stores
__Host-GAPS stores technical information related to the Google authentication session, used by Google to recognize and protect the account during the login process. The value is an encrypted string generated and interpreted exclusively by Google's own systems.
The exact value format is not publicly documented by Google and the internal structure may vary. The data is sent to Google's servers (accounts.google.com), not to the website hosting the integration.
What it is used for
Its main purpose is to support the authentication process and maintain the security of the Google account session — helping detect suspicious activity, protecting the account from unauthorized access, and preserving login state across requests.
For a site owner integrating „Sign in with Google” or other Google Identity services, this cookie is not configurable and does not serve marketing or analytics purposes — it is part of Google's infrastructure, not the site's own code.
Does it require consent?
In CookieFix's classification, __Host-GAPS falls under the „necessary / strictly necessary” category, since it supports an essential function — secure authentication — and is not used for profiling or advertising.
- Under the ePrivacy Directive (transposed in Romania via Law 506/2004) and ANSPDCP guidance, strictly necessary cookies do not require prior consent.
- Site owners should still list it in their cookie policy, naming the provider (Google) and its purpose (authentication).
- If a site uses Google only for sign-in, this cookie should not be presented as an optional choice in the consent banner.
How to block or delete __Host-GAPS
Visitors can manually delete or block Google cookies from their browser settings (Chrome, Firefox, Edge, Safari all offer per-site cookie management), though blocking it may prevent signing in with a Google account on that site.
For site owners who want centralized control over third-party scripts and integrations, a CMP such as CookieFix can automatically block scripts that are not strictly necessary until the visitor gives consent, and can generate the corresponding cookie policy automatically.
Frequently asked questions
No, it is a technical cookie used by Google for authentication and account security, not for advertising tracking.
No, since it is strictly necessary for authentication it does not require prior consent, but it should be disclosed in the cookie policy.
You may be signed out of your Google account or need to log in again on your next visit.
It appears when the site uses a Google integration, such as „Sign in with Google”, and the cookie is set directly by Google on the accounts.google.com domain.