_gid Cookie: What It Is, How Long It Lasts and Whether It Needs Consent

If a cookie scan of your site lists _gid, Google Analytics code is running somewhere on your pages. It’s one of the most common cookies on the web, and scanners and privacy teams ask about it constantly: what it stores, why it disappears after a day, and whether it can load before a visitor clicks “Accept.”

The short answer: _gid is a first-party analytics cookie that Google lists with a 24-hour lifespan. It is not strictly necessary, so in the EU and UK it needs consent before it’s set, and in US states it belongs in your disclosures and opt-out setup.

What Is the _gid Cookie?

_gid is set by Google Analytics on your own domain (Google describes it as “set from partner domain”). Google’s Google’s advertising and measurement cookie reference lists its purpose as Analytics and its lifespan as 24 hours. It holds a random identifier that lets Analytics tell one browser from another over a single day, so a visitor who loads five pages in an afternoon is counted as one user rather than five.

It works alongside the longer-lived _ga cookie, which Google lists at two years. Think of _ga as the long-term visitor ID and _gid as a short daily one. The value usually looks like GA1.2.123456789.1730500000: a version prefix, a random number and a timestamp.

Why _gid Still Appears After the Move to GA4

_gid was part of the analytics.js library used by Universal Analytics. Google stopped processing data in standard Universal Analytics properties on July 1, 2024, and the GA4 tag (gtag.js) relies mainly on _ga and a property-specific _ga_<container-ID> cookie. If _gid still shows up, the usual reasons are:

• An old analytics.js or Universal Analytics snippet was never removed from a template, plugin or landing page.
• A Google Tag Manager container still has a legacy Universal Analytics tag in it.
• A third-party plugin or theme ships its own copy of the old tracking code.

Treat a live _gid cookie as a clean-up signal. Legacy code that sends nothing useful still collects identifiers, and it’s often the tag nobody remembered to wire into the consent banner. The same goes for the even older __utma cookie from the ga.js era.

How Long Does _gid Last?

Google lists _gid at 24 hours. Each new page view refreshes it, so the 24-hour window rolls forward while the visitor stays active. Browsers with tracking protection, such as Safari’s Intelligent Tracking Prevention, can shorten the life of script-set cookies further, but they won’t make it last longer than Google’s setting.

What Data Does _gid Help Collect?

The cookie itself only holds the identifier. The data comes from the Analytics hits the identifier is attached to: page URLs, referrers, device and browser details, approximate location derived from IP address, and any events you’ve configured. Because the ID is unique to a browser, regulators treat it as personal data under the GDPR and as a unique identifier under the CCPA, even though it doesn’t hold a name or email.

Does _gid Require Consent Under GDPR and CCPA?

EU and UK (GDPR and ePrivacy rules)

Yes. Article 5(3) of the ePrivacy Directive, and the UK’s PECR, allow cookies without consent only when they’re strictly necessary for a service the user asked for. Audience analytics isn’t, so _gid should stay blocked until the visitor opts in. Some regulators allow narrow exemptions for tightly configured first-party analytics, but standard Google Analytics, which sends data to Google, isn’t usually covered.

United States (CCPA/CPRA and other state laws)

US state laws mostly work on notice and opt-out, not prior consent. List _gid in your privacy policy and cookie notice. If Analytics data is shared with Google in a way that counts as a “sale” or “sharing” (for example, when Google Signals or ad features are on), honor opt-out requests and Global Privacy Control signals by stopping the tag.

How to Block or Delete the _gid Cookie

1. Website owners: load Analytics only after consent, using your banner and Google Tag Manager consent settings, or Google Consent Mode with analytics_storage set to “denied” by default.
2. Remove legacy code: search templates and your tag manager for analytics.js and UA- tracking IDs and delete them.
3. Visitors: clear cookies for the site in browser settings, use private browsing, or install a tracker blocker. The cookie disappears on its own after 24 hours of inactivity.

If you use Google’s server-side setup, also look at the related FPID cookie, and check whether the _gat throttling cookie is also appearing from the same legacy code.

Finding _gid on Your Site

Captain Compliance’s cookie scanner crawls your pages, lists every cookie it finds with its vendor and category, and flags analytics cookies like _gid that load before consent. Pairing the scan with our consent banner lets you hold Google Analytics until a visitor opts in and keep a record of that choice.

FAQ

Is _gid a first-party or third-party cookie?

First-party. It’s written on your own domain by the Analytics script, though the data it supports goes to Google.

Is the _gid cookie dangerous?

No. It can’t run code or read files. The privacy question is about tracking and sharing, not security.

Can I keep _gid if I anonymize IP addresses?

IP truncation reduces what’s stored but doesn’t remove the identifier, so EU consent rules still apply.

Why does _gid have a different value every day?

Because it expires after 24 hours and a new ID is generated on the next visit.

A _gid cookie in a 2026 scan is usually a sign of legacy code. The decision for most teams is whether to rewire it into the consent banner or remove it, and in most cases removing it is cleaner.