What is the _ga cookie?
The _ga cookie is set by Google Analytics (GA4 or Universal Analytics), Google's website traffic measurement service. It appears on a site as soon as the tracking script (gtag.js, or the older analytics.js) runs in the visitor's browser, usually on the first page load.
It is an HTTP cookie, stored directly by the browser on the visited site's domain (first-party cookie), not set directly by Google.
What data it stores
_ga stores a randomly generated unique identifier used to distinguish visitors from one another in Google Analytics reports. The value typically follows an alphanumeric format that includes a version code and a client identifier, though the exact structure can vary depending on the GA version in use.
The data collected via this identifier (pages visited, traffic source, on-site behavior) is transmitted to Google's servers for processing and aggregated reporting.
What it is used for
For Google, _ga allows multiple sessions and actions to be attributed to the same visitor over time, which is essential for calculating metrics like unique visitors, returning visitor rate, or session duration.
For the website owner, this data feeds the traffic reports in Google Analytics: how many visitors arrive, where they come from, which pages they read, and how long they stay — information used for marketing decisions and content optimization.
Does it require consent?
_ga is classified under the statistics category. Under GDPR (Regulation 2016/679) and the ePrivacy Directive (transposed in Romania via Law 506/2004), this type of cookie is not strictly necessary for the site to function, so it requires the visitor's prior, explicit consent before being set.
- The site owner must disclose the cookie in the cookie policy
- The Google Analytics script must not load before consent is obtained
- Visitors must be able to refuse as easily as they accept
How to block or delete _ga
A visitor can manually delete or block _ga from browser settings (Chrome, Firefox, Edge – cookies and site data section), or install the official Google Analytics Opt-out Browser Add-on.
For site owners, the practical solution is a CMP (Consent Management Platform) such as CookieFix, which automatically blocks the Google Analytics script until the visitor gives explicit consent for the statistics category, preventing the _ga cookie from being set prematurely.
Frequently asked questions
_ga does not directly contain a name or email, just a random unique identifier. However, GDPR treats it as personal data because it can indirectly identify a visitor when combined with other information.
The typical duration is 2 years from setting or last update, after which the browser deletes it automatically unless renewed by a new visit.
Yes. Since _ga is a statistics cookie, not a strictly necessary one, Romanian and EU law requires obtaining consent before it is set.
The Google Analytics script must not load, and that visit will not appear in the site's traffic reports.