What is the __utmz cookie?
__utmz belongs to the older generation of Google Analytics cookies (known as "ga.js" or Classic Analytics), predating Universal Analytics and later Google Analytics 4. Although GA Classic was officially deprecated years ago, CookieFix's scanner still finds it on sites running legacy installations or outdated tracking snippets.
The cookie is set by the analytics script (typically ga.js or urchin.js) on a visitor's first page load and gets updated on subsequent visits whenever the traffic source changes.
What data it stores
__utmz stores information about how the visitor arrived at the site: the source (e.g. google, direct, another domain), the medium (organic, referral, cpc, email), the search keyword used (if applicable), and optionally campaign parameters (utm_source, utm_medium, utm_campaign). The value is a text string made up of several segments separated by dots and semicolons, not easily human-readable but parsed by Google Analytics.
The data stays stored locally in the visitor's browser and is read by the analytics script on each page load; it is not sent to Google separately, only indirectly through GA's regular tracking requests.
What it is used for
Its main purpose is traffic attribution: it lets the site owner see, in Google Analytics reports, which channels (organic search, paid campaigns, social media, referrals) bring visitors and conversions. Without this cookie, Analytics couldn't group a returning visitor's sessions by source and would miscalculate acquisition statistics.
For site owners, this data helps assess the effectiveness of marketing campaigns and traffic channels, but it is not used for content personalization or targeted advertising.
Does it require consent?
__utmz is classified as a statistics (analytics) cookie. Under Romania's Law 506/2004 (transposing the ePrivacy Directive) and the GDPR, this type of cookie is not strictly necessary for the site to function, so it requires the visitor's prior consent before being set.
Site owners must disclose this cookie in their cookie policy, place it correctly under the "statistics" category in the consent banner, and make sure the Google Analytics Classic script does not fire before the visitor has opted into that category. Romania's data protection authority (ANSPDCP) can sanction sites for missing consent on analytics cookies.
How to block or delete __utmz
Visitors can delete or block __utmz manually from their browser settings (Chrome, Firefox, Edge, Safari all offer per-site cookie management), or use browser extensions that block Google Analytics trackers.
- On the site owner's side, the correct fix is to prevent the analytics script from executing at all before consent, not just to hide it visually afterward.
- A CMP such as CookieFix handles this by automatically blocking tracking scripts (including legacy Google Analytics variants) until the visitor grants consent for the statistics category, avoiding premature cookie placement.
Frequently asked questions
It's a cookie used by Google Analytics Classic to remember where a visitor came from, such as the traffic source, medium, keyword, or campaign.
It doesn't contain sensitive data like names or email addresses; it stores traffic-source information, but it's still considered a tracking cookie for statistical purposes.
Its typical duration is about 6 months, after which it expires automatically if the visitor doesn't return.
Yes, since it's a statistics cookie, it requires the visitor's prior consent under the GDPR and Romania's ePrivacy legislation.