What is the HSID cookie?
HSID is a first-party HTTP cookie set by Google on the .google.com domain. It typically appears when a visitor is signed into a Google account (Gmail, YouTube, Google Ads, etc.) or interacts with Google services embedded on a third-party website, such as maps, embedded YouTube videos, or Google ads.
It belongs to a group of Google cookies (alongside SID, SSID, APISID, SAPISID) used together to identify and authenticate users across Google services.
What data it stores
HSID stores an encrypted identifier unique to the Google user account, used internally by Google to confirm identity and help protect against unauthorized access to account data. The exact cookie value is an opaque, encrypted string generated by Google; its internal format is not publicly documented.
Data collected through this cookie is sent to Google's servers and is used, among other things, to personalize the ads shown to the user on other sites through the Google Ads/DoubleClick network.
What it is used for
For Google, HSID helps secure user accounts and build a behavioral profile used to target relevant ads (retargeting). For a website embedding Google services (e.g. YouTube, Google Maps, ads), this cookie supports those services' operation, but it offers no direct functional benefit to the site owner — its main role is advertising-related tracking.
Does it require consent?
CookieFix classifies HSID as a marketing cookie (advertising/tracking). Under the GDPR (Regulation 2016/679) and the ePrivacy Directive, this type of cookie cannot be placed before the visitor gives explicit consent.
- Site owners must list HSID in their cookie policy, under the marketing/advertising category.
- The Google script or service that sets this cookie must load only after consent has been obtained.
- Rejecting consent must be as easy as accepting it, and withdrawal must be possible at any time.
How to block or delete HSID
Visitors can delete or block HSID from their browser settings (Chrome, Firefox, Edge, Safari) under cookie management for google.com, or use private/incognito browsing. Ad- and tracker-blocking browser extensions can also prevent this cookie from being set.
For site owners, the correct approach is to automatically block the Google scripts that generate this cookie until the visitor gives consent. A CMP like CookieFix does this automatically, scanning third-party scripts and holding them back until the marketing category is accepted.
Frequently asked questions
It's an HTTP cookie set by Google on the .google.com domain, used for account authentication and targeted advertising, classified as a marketing cookie.
Its typical duration is around 2 years from being set or last updated, though Google may adjust this period.
No; although it relates to Google account authentication, it's classified as marketing because it also feeds into advertising-related tracking, so visitor consent is required.
Use a CMP that prevents Google scripts from loading until consent is given; visitors can also block it manually through their browser settings.