What is the __Secure-3PSIDTS cookie?
__Secure-3PSIDTS belongs to Google's family of session and security cookies (alongside __Secure-3PSID, __Secure-1PSIDTS, and similar), used to maintain and refresh authentication for a Google account. It is set by Google when a visitor is signed in to a Google account or interacts with Google services embedded on a third-party site.
It commonly appears not only on google.com but also on sites that load Google resources such as Ads, embedded YouTube videos, reCAPTCHA, or Google Sign-In, which is why it shows up in cookie scans of many websites even when the site owner does not set it directly.
What data it stores
The cookie stores a session identifier tied to the user's Google account, used internally by Google to validate and refresh authentication tokens (the "TS" in the name suggests a security/timestamp token). The value is generated and controlled entirely by Google; its exact format is not publicly documented and may vary.
The data is sent to Google domains (.google.com and related services), not to the site where the cookie is observed. The "__Secure-" prefix means it can only be set over HTTPS, while "3P" marks its use in a third-party (cross-site) context.
What it is used for
For Google, this cookie helps maintain sign-in state across services (Search, YouTube, Ads, reCAPTCHA) and helps protect accounts against fraudulent session use. In third-party contexts, cookies in this family are also linked to personalization and measurement of interactions with Google content embedded on other sites.
For the website owner, the cookie itself provides no direct data, but its presence signals that the site loads Google resources (embeds, advertising, or sign-in scripts) that must be disclosed and, where applicable, consented to.
Does it require consent?
CookieFix classifies __Secure-3PSIDTS under marketing (third-party advertising/tracking), since it is not essential for the host site's core functionality. Under GDPR and the ePrivacy rules (in Romania, Law 506/2004), this type of cookie requires prior, informed, freely given consent before it is set.
- List it in the site's cookie policy, including provider, category, and duration.
- Block the Google script or resource that triggers this cookie until consent is obtained.
- Do not make essential site functionality dependent on accepting it.
How to block or delete __Secure-3PSIDTS
Visitors can delete or block this cookie via browser settings (Chrome, Firefox, Edge, Safari – cookie management for google.com), or use private/incognito browsing. Removing it may sign the user out of Google on other integrated services.
For site owners, blocking it automatically before consent is essential, since Google resources can load together with the page. A consent management platform like CookieFix can block the scripts that trigger this cookie until the visitor makes a choice, preventing it from being set without agreement.
Frequently asked questions
It's a Google cookie used for account authentication and session security, often seen in a third-party context on sites that load Google services.
Yes, since it's classified as marketing/third-party tracking, GDPR and ePrivacy rules require prior consent before it is set.
The typical duration observed is 1 year, though Google may adjust this.
It can't be removed directly if you use embedded Google services; it can only be blocked until consent is given, using a CMP that delays loading of Google scripts.