What is the __Secure-3PSIDCC cookie?
__Secure-3PSIDCC is an HTTP cookie for the google.com domain, set by Google when a user is signed into a Google account or interacts with Google services (Search, YouTube, Maps, Google Sign-In integrations, or Google ads displayed on third-party sites).
It typically appears when a page loads Google Ads, reCAPTCHA, Google Sign-In, or other Google services that rely on an authenticated session. The „__Secure-” prefix means the browser only accepts it over HTTPS connections, and „3P” indicates its use in a third-party context (on sites other than google.com).
What data it stores
The cookie stores a cryptographic token linked to the user's Google account session, used to confirm the authenticity and security of that session in requests made to Google services. Its value is an opaque, encrypted string generated and interpreted exclusively by Google's systems — it does not contain readable text.
The data is sent to Google's servers (the .google.com domain and related subdomains) with every request to Google services active on the page, including advertising and analytics scripts embedded on the visited site.
What it is used for
For Google, this cookie helps keep account sessions secure and supports personalized advertising features — it helps correlate user activity across Google services and partner sites to deliver relevant ads and measure campaign performance.
For the site owner, this cookie's presence is usually indirect, resulting from embedding Google services (Ads, reCAPTCHA, Sign-In, YouTube embeds) that rely on Google's authentication infrastructure.
Does it require consent?
__Secure-3PSIDCC is classified as a marketing (advertising/tracking) cookie, since it is used partly to personalize ads and link activity across sites. Under GDPR and the ePrivacy Directive (transposed in Romania via Law 506/2004), this type of cookie requires the visitor's prior consent before being set or read.
- Site owners must explicitly list it in the cookie policy, under the marketing/advertising category.
- The Google script that generates this cookie (Ads, YouTube embeds, reCAPTCHA in certain setups) should only load after consent is obtained.
- Declining consent must be as easy as accepting it, in line with regulatory requirements.
How to block or delete __Secure-3PSIDCC
A visitor can manually delete or block the cookie via browser settings (Chrome, Firefox, Edge, Safari — cookie management section for google.com), or use private/incognito browsing, which discards cookies once the session ends.
For site owners, blocking must happen at a technical level, not just in a policy document: the Google scripts that set this cookie should be prevented from running until the user gives consent. A CMP like CookieFix can automatically block such scripts before consent and only activate them once the visitor explicitly accepts the marketing category.
Frequently asked questions
It's a security and advertising cookie set by Google, used to confirm the authenticity of account sessions in third-party contexts, including for delivering personalized ads.
It's not malicious, but it is used for advertising-related tracking, which is why it's classified as a marketing cookie and requires consent under GDPR.
Its typical duration is 1 year, though Google may adjust this over time within its own infrastructure.
Yes — since it's a marketing cookie set through Google services, it must be listed in your cookie policy and technically blocked until the visitor gives explicit consent.