Quick answer
Google Analytics 4 sets two first-party cookies by default: _ga, which tells one browser from another, and _ga_ followed by your property’s ID, which keeps track of the session. Both last two years by default. If you link Google Ads or turn on advertising features, extra cookies can be set. UK rules affect when you may set them.
The two default cookies
According to Google’s own page on Google Analytics cookie usage on websites, a standard GA4 set-up uses these:
| Cookie | What it does | Default expiry |
|---|---|---|
| _ga | Distinguishes users with a random identifier | 2 years |
| _ga_<container-id> | Persists session state for that property | 2 years |
Both are first-party cookies, meaning they are set on your own domain rather than on Google’s. The expiry renews each time the visitor returns, and you can shorten it in your Analytics settings.
What about older cookies like _gid?
If you have read older cookie policies, you may see _gid, _gat or __utma. These belonged to Universal Analytics and earlier versions of Google Analytics, which have been retired. A GA4-only site should not need them listed, so update your cookie policy if it still describes them. Copying an old list is one of the most common mistakes in small business cookie policies.
Extra cookies from advertising features
If you link Google Analytics to Google Ads, turn on Google signals, or use remarketing audiences, additional Google cookies may be used for advertising purposes. These are more intrusive than plain analytics and are treated as needing consent. Check what you have switched on in your Analytics admin, and make sure your cookie banner and policy reflect it.
What the UK rules say
The UK’s cookie rules sit in the Privacy and Electronic Communications Regulations, and the ICO explains them in its guidance on cookies and similar technologies. The long-standing position has been that cookies which are not strictly necessary, analytics included, need the visitor’s consent before they are set, with a clear choice and no pre-ticked boxes.
The Data (Use and Access) Act 2025 changed this for some low-risk cookies, including certain analytics used to improve a website, provided visitors get clear information and a simple way to object. How that applies depends on the cookies, the purpose and the current ICO guidance, so check it before removing consent for analytics. Advertising cookies still need consent.
Consent mode in plain English
Google’s consent mode lets your cookie banner tell Google’s tags what the visitor agreed to. If they decline analytics storage, Analytics does not set or read its cookies for that visitor and sends limited signals without identifiers instead. If they accept, it works normally. Setting it up properly means your banner and your tags agree, which is what regulators expect.
Your analytics will undercount
Once consent is in place, many visitors decline, and your Analytics reports show fewer users than you really had. That is normal and not a fault. For a fuller picture of search traffic, use Google Search Console alongside Analytics, because it reports clicks from Google’s side without cookies. Our guide to website analytics for beginners explains which numbers to watch, and our comparison of GA4, Matomo and Plausible covers cookie-free alternatives.
A quick check of your own site
- Open your site in a private browser window and do not accept the banner.
- Open the browser’s developer tools and look at the cookies for your domain.
- If _ga appears before you made a choice, analytics is firing before consent.
- Accept, reload, and check the cookies appear as expected.
- Compare what you find with your cookie policy, and update the policy.
Your privacy notice should also explain analytics in plain words: what is collected, why, how long it is kept and how visitors can opt out. If your site has a contact form, our post on a contact form that is not working is a reminder to test the other places personal data enters your site too.
Writing the cookie policy entry
For each cookie, a clear policy states the name, who sets it, what it is for and how long it lasts. For a standard GA4 set-up, that is two short lines: the _ga cookie, used by Google Analytics to distinguish visitors, lasting two years; and the _ga_ cookie with your property ID, used to keep session state, lasting two years. Add any advertising cookies only if you have switched those features on. Plain wording beats a legal-sounding wall of text, and it is easier to keep accurate when settings change.
A worked example
A garden centre’s website had a cookie banner, but Analytics loaded the moment the page opened, so _ga was set before anyone clicked. Its cookie policy still listed _gid and _gat from the old version of Analytics. The fix was to connect the banner to consent mode, so analytics only set cookies after acceptance, and to rewrite the cookie policy to list the two GA4 cookies, their purpose and their duration. Reported visitors dropped, as expected, while Search Console showed search clicks were unchanged.
Getting it set up
Every custom WordPress website we build includes Google Analytics as standard. If you want analytics and search performance looked after month to month, our SEO service is £249 a month, and all our prices are on the pricing page. This post is general information, not legal advice.
Get the UK SEO DIY Audit Checklist (free)
A 32-point checklist UK SMEs can run against their own website in an afternoon. Surfaces the quick wins before paying for a paid audit.
No spam. UK GDPR compliant. We only use your email to send this resource, unless you tick the box to hear from us.
Frequently asked questions
Does Google Analytics 4 need cookie consent in the UK? +
Under the UK's cookie rules, non-essential cookies such as analytics have generally needed consent, and the ICO has treated analytics as non-essential. The Data (Use and Access) Act 2025 introduced an exception for some low-risk analytics cookies, subject to conditions such as clear information and an easy way to object. Check the ICO's current guidance before relying on it.
What is the _ga cookie? +
The _ga cookie is set by Google Analytics on your own domain to distinguish one visitor's browser from another, using a randomly generated identifier. By default it lasts two years and is renewed each time the visitor returns. It does not store a name or email address, but it is still treated as personal data in many contexts.
What happens to my analytics if visitors decline cookies? +
With Google's consent mode switched on, tags adjust their behaviour: if analytics storage is denied, Analytics does not set or read its cookies for that visitor and can send limited, cookieless signals instead. Your reports will show fewer visitors than reality. That is expected, and why other sources such as Search Console are worth checking too.
