What is the SSID cookie?
SSID is an HTTP cookie placed by Google on the .google.com domain. It belongs to a family of Google session/security cookies (alongside HSID and APISID) used both for sign-in purposes and for ad personalization and targeting.
On a non-Google website, SSID typically appears indirectly — when the site loads Google services such as Google Ads, Google sign-in components, ads served through the Google network, or other integrations that communicate with Google domains. It is not set by the site's own code, but by Google scripts embedded in the page.
What data it stores
The cookie stores a unique identifier tied to the user's Google session or account, used to recognize the browser on later visits to Google properties and partner sites displaying Google ads. Google does not publicly document the exact value format, and it may vary or change.
The data is sent to Google's servers (the .google.com domain), not to the website where the cookie was encountered. The site owner has no access to this cookie's content and cannot read or modify it.
What it is used for
For Google, SSID helps authenticate users across the company's services and correlate activity between different Google products, including for targeted advertising and campaign performance measurement.
For the website owner, this cookie's presence is usually a side effect of integrating Google services (Ads, sign-in, embedded ads) rather than something that serves a direct function for the site itself — it supports Google's advertising ecosystem instead.
Does it require consent?
SSID is classified as a marketing/tracking cookie and is not strictly necessary for the website to function. Under the GDPR (Regulation 2016/679) and the ePrivacy Directive, transposed in Romania through Law 506/2004, setting and reading this type of cookie requires the visitor's prior, informed, and freely given consent.
- The website owner must list this cookie in the cookie policy, including its category, provider, and duration.
- Google scripts that generate SSID should only load after consent for the marketing category has been obtained.
- Withdrawing consent must be as easy as giving it.
How to block or delete SSID
A visitor can manually delete or block the SSID cookie from browser settings (per-domain cookie management) or use tracking-blocking extensions. Since it is tied to the Google account, signing out of Google may remove or invalidate the associated session.
For website owners, the correct approach is to automatically block Google scripts until consent is given. A CMP such as CookieFix can prevent scripts that generate marketing cookies, including those in the SSID family, from loading until the visitor explicitly accepts the marketing category in the consent banner.
Frequently asked questions
It is an HTTP cookie set on the .google.com domain, used by Google for authentication and targeted advertising, as part of a family of session/security cookies.
It is not malicious, but it is a tracking cookie used for advertising purposes, which is why it falls under the marketing category and requires consent.
Yes. As a marketing cookie set through Google services, the visitor's explicit consent is required before the script generating it can load.
The typical duration is 2 years from being set, though Google may update this timeframe without public notice.