What is the LSID cookie?
LSID is an HTTP cookie set by Google on the accounts.google.com domain. It appears when a visitor signs in to a Google account or interacts with a Google service embedded on a website (for example a "Sign in with Google" button, an embedded form, or a Google widget).
It belongs to a group of Google authentication cookies (alongside others such as SID or HSID) used to confirm the user's identity and protect the session from unauthorized access.
What data it stores
LSID stores an encrypted session identifier generated by Google's authentication system. The value is not human-readable plain text but an encoded string specific to the current account and session; the exact format is not publicly documented.
The data is sent to Google's servers (accounts.google.com domain) with each relevant request, to validate the login session. The cookie is not accessible to domains other than those operated by Google.
What it is used for
The main purpose of LSID is authentication security: it helps Google verify that an access request comes from a valid login session and helps prevent unauthorized access or replay of a compromised session.
For a website that integrates Google services (for example "Sign in with Google", Google Maps with a connected account, or other widgets), this cookie enables the user's session to function correctly and does not serve marketing or advertising profiling purposes.
Does it require consent?
In CookieFix's classification, LSID falls under the necessary (strictly necessary) category. Under the ePrivacy Directive (2002/58/EC, transposed in Romania via Law 506/2004) and ANSPDCP guidance, cookies strictly necessary to provide a service explicitly requested by the user (here: authentication) do not require prior consent.
The website operator should still list this cookie in the cookie policy, with its purpose and provider, for GDPR (Regulation 2016/679) transparency requirements.
How to block or delete LSID
A visitor can delete or block LSID from browser settings (per-site cookie management or clearing browsing data for accounts.google.com), though this may automatically sign the user out of their Google account or disable features that rely on authentication.
- Chrome/Edge/Firefox: Settings → Privacy → Cookies and site data → search "google.com"
- Safari: Preferences → Privacy → Manage Website Data
For site owners integrating Google services, a consent management platform like CookieFix can automatically block third-party scripts until the visitor gives consent, although for strictly necessary cookies like LSID such blocking is not a legal requirement.
Frequently asked questions
No, since it is classified as strictly necessary for the authentication function, LSID does not require prior consent under ePrivacy, but it should still be disclosed in the cookie policy.
You will typically be signed out of your Google account or need to re-authenticate, since the cookie directly supports the login session.
It is set by Google on the accounts.google.com domain, usually when a user signs in to a Google account or uses a Google service embedded on a third-party site.
No, LSID is an authentication security cookie, not a marketing or ad-targeting cookie.