What cookies does Google Analytics set, and do they need consent?

Google Analytics 4 primarily sets the _ga cookie, which distinguishes individual visitors and lasts two years, and the _ga_<container-id> cookie, which keeps session state. Because these are analytics cookies and not strictly necessary, they require opt-in consent in the EU and UK before they are set.

The main GA cookies

The _ga cookie holds a randomly generated client ID that makes it possible to tell one visitor from another across sessions. The _ga_<container-id> cookie tracks session state such as the number of visits. Depending on your configuration, Google signals and advertising features can add more identifiers.

Why they need consent

Analytics cookies are useful but not essential for the site to work, so under EU and UK rules they fall into the consent-required category. Regulators in Austria, France, and Italy have specifically examined Google Analytics setups, which makes this one of the most scrutinized trackers on the web.

The compliant pattern

Load the consent banner first, block the GA tag until the visitor accepts, and pass the consent state through Google Consent Mode v2 so analytics behavior matches the choice. A visitor who declines should get no _ga cookie at all.