Does Google Analytics 4 Use Cookies? Which Ones, How Long, and When You Need Consent

Yes. GA4 sets two first-party cookies, _ga and _ga_<container-id>, that last two years by default. What each one does, how browsers shorten them, what consent mode changes, and when analytics can run without a banner.

Does Google Analytics 4 Use Cookies? Which Ones, How Long, and When You Need Consent

The short answer: Yes. As of October 8, 2026, Google Analytics 4 sets two first-party cookies by default: _ga, which tells users apart, and _ga_<container-id>, which keeps session state. Both expire after two years by default, though browsers cut that short for visitors who do not return (Google cites up to 400 days in Chrome and 7 days in Safari). Linking GA4 to Google Ads adds more cookies. With consent mode and analytics_storage denied, GA4 stops reading and writing those cookies and sends cookieless pings that Google uses for modeling.

This page answers the question in the order people usually ask it: which cookies, how long they last, whether they count as first-party, what consent mode changes, and whether you need a banner.

Which cookies GA4 sets

Google's own documentation lists two cookies for the GA4 JavaScript tag (Google Analytics Help, Cookie usage on websites):

Cookie What it does Default expiry
_ga Distinguishes users 2 years
_ga_<container-id> Persists session state 2 years

Two more details from the same page:

  • Google Ads linking adds cookies. When GA4 is linked to a Google Ads account, the tag sets additional cookies so Google Ads can measure interactions more reliably.
  • The cookies are not required to send data. Google states the GA4 libraries do not require cookies to transmit data. Cookies are how GA4 recognizes a returning visitor and stitches a session together; without them, each page view looks less connected.

If you use Google Tag Manager or a consent platform, you may see other cookies on the same page. Those belong to those tools, not to GA4.

How long GA4 cookies last

The default is two years. You can change it in GA4: Admin → Data streams → your stream → Configure tag settings → Show all → Override cookie settings, where cookie expiration runs from immediately to 25 months, and you choose whether the clock resets on each visit or counts from the first visit.

Browsers have the final say. Google notes that browsers limit first-party cookie lifetimes when a visitor does not return: a maximum of 400 days in Chrome and 7 days in Safari. So a Safari visitor who comes back after ten days is usually counted as a new user. That is one reason GA4 user counts run high on sites with a lot of iPhone traffic.

GA4's cookies are first-party: they are set on your domain by the tag on your site, not by a google.com domain. That matters for browser blocking, since browsers treat first-party cookies more leniently than third-party ones.

It does not settle the consent question. EU and UK cookie rules look at what a cookie is for, not who sets it. Analytics cookies are not needed to deliver the page the visitor asked for, so they are generally treated as non-essential, and storing them usually requires prior consent.

Consent mode lets your banner tell Google tags what the visitor agreed to. The parameter that governs analytics cookies is analytics_storage (Google Analytics Help, Consent mode reference).

When analytics_storage is denied:

  • The tag does not read or write first-party analytics cookies.
  • It sends cookieless pings instead. Google describes them as anonymized, non-identifiable events that may carry the user agent, screen resolution and IP address as part of normal browser communication, and says Google Analytics does not store or log IP addresses.
  • GA4 uses those pings for behavioral and conversion modeling to fill the gaps.

Google distinguishes two setups (Google Ads Help, About consent mode):

  • Basic consent mode: Google tags do not load until the visitor consents. No data at all from visitors who decline.
  • Advanced consent mode: tags load with consent denied by default and send cookieless pings until the visitor consents.

The practical effect: with advanced consent mode, part of your GA4 traffic is modeled rather than observed. Keep that in mind before you compare GA4 numbers with another tool or with your payment processor.

This section is general information, not legal advice.

  • EU and UK: generally yes. Under the EU's ePrivacy rules, storing non-essential cookies needs prior consent, and analytics cookies are usually non-essential.
  • The French exemption, and why GA4 rarely fits it. France's data protection authority, the CNIL, exempts audience measurement cookies from consent if they meet strict conditions: users are informed and can object, the purpose is limited to audience measurement and A/B testing, the data is not combined with other processing, the tracker is limited to one site, the last byte of the IP address is truncated, and the cookie lasts no more than 13 months. The CNIL adds that "most large audience measurement offerings do not fall within the scope of the exemption, regardless of their configuration" (CNIL, Sheet no. 16: Use analytics on your websites and applications). GA4's two-year default already exceeds the 13-month limit.
  • United States: there is no single federal cookie-consent law; some state privacy laws give opt-out rights over certain tracking. Requirements depend on the states you serve and what you do with the data.

To estimate where your own setup lands, try the cookie consent calculator.

Analytics without GA4 cookies

If the banner, the modeled data or the cookie lifetimes are the problem, there are two routes:

  1. Keep GA4 and run consent mode properly. You keep Google's reporting and Ads integration, and accept that declined visitors are modeled.
  2. Use a cookie-free analytics tool for measurement on your own site. These count visits without storing an identifier on the device. Our guide to cookieless analytics tools compares eight, and Google Analytics vs cookie-free analytics covers what you give up.

Humblytics takes the second route. Its analytics script uses no cookies or local-storage identifiers, anonymizes visitors with a one-way hash and discards raw IPs immediately. It runs analytics, heatmaps, funnels and A/B testing from that one script and matches Meta and Google Ads spend to Stripe revenue. The Humblytics analytics layer does not itself require a consent banner, but your site may still need consent for other tools or uses on the page. See pricing or start a 14-day trial.

Sources and freshness

Google changes GA4 settings and menu paths from time to time. Check the linked help pages before relying on a specific setting.