What is the __utmc cookie?
__utmc is one of the classic Google Analytics cookies (Urchin/ga.js and Classic Analytics versions), set as a first-party cookie by the tracking script when a visitor lands on a site running this older version of the analytics tool.
It worked together with __utma and __utmb to determine visit duration: __utmc marked the end of a session, while __utmb marked its start. Google gradually phased out this technology in favor of Universal Analytics and later Google Analytics 4 (GA4), neither of which generates __utmc anymore. If this cookie still shows up on a scanned site, it usually signals leftover code from an old Analytics implementation.
What data it stores
The __utmc value typically contains a numeric identifier derived from the domain hash of the Google Analytics property, used to correlate the current session with the other __utm cookies on the same domain.
It is a first-party cookie (set on the visited site's own domain), and the associated data is sent, along with other tracking information, to Google's servers for statistical processing.
What it is used for
Its main purpose was to help Google Analytics distinguish new visits from returning ones and to determine when a browsing session ended, based on the absence of an active session cookie when the browser reopened.
For site owners, this fed basic metrics such as session duration and bounce/return rate; in modern GA4 setups these functions are handled through different mechanisms, without __utmc.
Does it require consent?
__utmc is classified as a statistics (analytics) cookie and is not strictly necessary for the site to function. Under Law 506/2004 (transposing the ePrivacy Directive) and the GDPR, this type of cookie requires the visitor's prior, informed and freely given consent before the script runs.
Site owners must list it explicitly in their cookie policy, stating the provider (Google), purpose (statistical analysis) and duration, and ensure it is not set automatically before consent is obtained.
How to block or delete __utmc
A visitor can delete or block this cookie manually from browser settings (Chrome, Firefox, Edge, Safari – per-site cookie management), or use the official Google Analytics Opt-out browser add-on.
- For site owners, the most practical approach is a CMP that automatically blocks analytics scripts until consent is given – CookieFix, for instance, prevents the Google Analytics script from loading, and __utmc along with related cookies from being set, until the visitor accepts the statistics category.
- If the site already runs GA4, check whether the old script (ga.js/urchin.js) is still loaded somewhere and remove it, since it is redundant.
Frequently asked questions
No, it belongs to the old Classic/Urchin version. Google Analytics 4, the current version, no longer sets this cookie.
It is a session cookie, so it is deleted automatically when the browser is closed.
Yes, as a statistics cookie it requires prior consent under GDPR and Romanian law, even though its lifespan is short.
Usually because an unused fragment of old tracking code (ga.js) or a parallel implementation is still active and should be checked and removed.