What is the __utma cookie?
__utma belongs to the cookie family of the classic Google Analytics implementation (based on the ga.js library), the predecessor to Universal Analytics and Google Analytics 4. It is set by the site's analytics script directly on the site's own domain (first-party cookie) on a visitor's first page load.
Although Google has migrated most properties to newer versions, this cookie can still appear on websites that run older tracking code or haven't updated their analytics implementation in a long time.
What data it stores
__utma typically stores a randomly generated, anonymous unique visitor identifier along with timestamps for the first visit, the previous visit, and the current visit. The exact structure of the value can vary depending on the implementation and script version used.
The data read from this cookie is sent to Google Analytics servers to be associated with the events and sessions recorded on the site.
What it is used for
Its main purpose is statistical: __utma helps the site owner estimate the number of unique visitors, distinguish new visitors from returning ones, and calculate the time between visits. This information feeds the traffic and behavior reports in Google Analytics.
For the site owner, the aggregated data helps understand content performance and optimize the user experience, without directly identifying the person behind the visit.
Does it require consent?
According to CookieFix's classification, __utma falls under the statistics (analytics) category. It is not strictly necessary for the site to function, so under GDPR (Regulation 2016/679) and the ePrivacy Directive (2002/58/EC, transposed in Romania via Law 506/2004), setting it requires the visitor's prior, informed, and freely given consent.
- The site owner must explicitly disclose it in the cookie policy.
- The script that sets __utma must be blocked until consent for the statistics category is obtained.
- Visitors must be able to refuse or withdraw consent as easily as they grant it.
How to block or delete __utma
A visitor can manually delete __utma from the browser's settings (cookies and site data section), or install Google Analytics opt-out browser extensions. Deleting the cookie does not affect site functionality, only the continuity of Google's statistics.
For site owners, the most effective approach is using a consent management platform (CMP) such as CookieFix, which automatically blocks the Google Analytics script – and therefore the setting of __utma – until the visitor explicitly accepts the statistics category.
Frequently asked questions
It's an analytics cookie set by Google Analytics Classic (ga.js), used to identify unique visitors and measure the number of sessions on a website.
The typical duration is 2 years from being set or last updated, though the exact lifespan can vary depending on the script configuration.
Yes, since it's a statistics cookie, it requires the visitor's prior consent under GDPR and the ePrivacy rules, as it is not strictly necessary for the site to function.
It can be removed from the browser's cookie and site data management settings, just like any other first-party cookie.