Google Analytics Cookies: Does GA4 Really Track You?

Does Google Analytics use cookies? Yes. I could stop the article right there but that’s not really useful to anyone, is it. What people actually want to know is which cookies, how long they stick around, and whether they need to slap a consent banner on their site because of it. That’s what this post covers. I ended up writing this after a client asked me the same question while we were migrating her site to GA4. I gave her a half answer on the call and then spent that evening actually reading Google’s documentation properly, because I realized I’d been assuming things about GA4’s cookie behavior that were true for the old Universal Analytics setup, not necessarily true anymore. A lot changed when GA4 took over. Some of it for the better honestly.

What Is Google Analytics 4 Anyway?

Google Analytics is the tool most websites use to track visitors. Free, made by Google, been around forever in various forms.

GA4 is just the latest/update version of it, the one that took over from Universal Analytics after Google pushed everyone to switch a few years back (a change that upset many people, including myself, who had produced dashboards and reports based on the old system).

The big technical shift with GA4 is that it tracks everything as events rather than sessions. Old system grouped your activity into a visit and measured things within that. The new system just logs individual actions as they happen, clicks, scrolls, video starts, purchases, whatever. It’s a different way of thinking about data and it took me a minute to adjust to it too.

So, Does It Use Cookies?

Yes, GA4 uses cookies. When someone visits your website for the first time, it places a first-party cookie with a random ID. The next time that person comes back, GA4 checks for the cookie and recognizes it, so it knows they’re not a new visitor.

The interesting part is that Google trimmed the number of cookies quite a bit compared to before. Fewer moving parts. There’s also this newer layer now, Consent Mode, that lets GA4 grab some signal even from people who never accepted cookies at all. Not full tracking, more like a rough estimate. I’ll get into that later in the post.

The Cookies GA4 Actually Sets

Here’s where people usually want specifics instead of vague statements. GA4 mainly sets these four:

• _ga – the main one, gives each visitor a unique ID, and typically lasts around two years unless someone clears their browser data. This is the cookie doing most of the heavy lifting for identifying returning visitors.
• ga[Container-ID] – specific to your GA4 property, handles session state, basically keeping track of how active someone is during a single visit before the session times out.
• _gid – short-lived, usually disappears within a day. Handles same-day tracking, nothing that persists long term.
• _gat – barely lasts a minute. Its only job is throttling how many requests get sent so Google’s servers don’t get flooded.

Essentially, all four of these are ‘first-party’; meaning, instead of being set by an external tracker or service provider’s domain, they are set on your own domain. This is far more significant than commonly realized, because first-party cookies are subject to less rigorous scrutiny than third-party cookies under privacy regulations and laws.

How This Compares to Old Universal Analytics

People who used the old system remember it being a lot heavier on cookies. GA4 cleaned a good chunk of that up. Here’s the actual difference:

• Cookie count – Universal Analytics ran something like seven or eight separate cookies for different jobs (campaign tracking, visit counts, user IDs, session data, all sitting in the browser separately). GA4 handles most of that through just one or two.
• Data model – the old system leaned on client-side cookies almost entirely. GA4 shifts more of the load to server-side processing and Google’s own modeling, so the browser isn’t doing all the work anymore.
• Why the change happened – part of it is just Google tidying things up, sure, but a bigger reason is that third-party cookies are on their way out across the browser world. Safari and Firefox already block most of them, Chrome’s been threatening to follow for years. GA4 was built for that reality, not against it.

Basically, if you were annoyed by how much clutter Universal Analytics left behind in the browser, GA4 is a noticeable improvement.

What About Visitors Who Reject Cookies

This is the part that surprises most people, myself included the first time I read about it. Rejecting cookies doesn’t make someone invisible to GA4. A couple things kick in instead:

• Cookieless pings – Consent Mode lets GA4 send a stripped-down signal with no personal identifier attached. It basically tells Google “something happened here” without saying who did it.
• Behavioral modeling – Google looks at patterns from visitors who did consent, then uses that data to estimate what’s probably happening with the ones who didn’t. Not exact, but not nothing either.
• Real-world accuracy – if a decent chunk of your traffic still consents, the modeled estimates for the rest tend to land reasonably close to reality. If almost nobody consents, though, don’t expect much useful data from that group.

So no, a “no” on the consent banner doesn’t erase someone from your reports entirely, it just makes their data fuzzier.

Why This Actually Matters for You

Cookies come with legal strings attached, that’s really the whole reason to care. A quick breakdown of where this bites you if ignored:

• GDPR (EU visitors) – if your site uses Google Analytics, and most do, you’re legally required to show a consent banner before tracking EU visitors. Not optional, even if enforcement against small sites is rare in practice.
• Other regions catching up – California has its own privacy law now, Brazil does too, and several countries across Asia are drafting or already enforcing similar rules. This isn’t just a Europe problem anymore.
• The cost of waiting – setting up consent properly now takes an afternoon. Retrofitting it later, after a law you didn’t know applied to you suddenly does, tends to take a lot longer and involves way more stress.

Worth handling early rather than treating it as a someday task.

Setting This Up Without Losing Your Mind

You don’t need a law degree for this part, just a few things done in the right order. Get a consent management plugin running first. CookieYes and Complianz both work fine on WordPress and neither takes long to configure.

Then hook up Google Consent Mode through Tag Manager so GA4 actually respects whatever the visitor picks on that banner instead of ignoring it. Update your privacy policy while you’re at it. Actually, list the cookies you’re using and roughly how long they last, instead of copying some generic template that says nothing specific.

Last thing, double check IP anonymization is on. It’s supposed to be default in GA4 but I’ve seen sites where an old plugin or a Tag Manager override messed with it, so it’s worth confirming yourself rather than assuming. None of this is a huge project. An afternoon, maybe less if you’re not starting from scratch.

Conclusion

Short version, since we covered a lot: Google Analytics uses cookies, and that’s not changing anytime soon. What actually changed is how GA4 handles it, fewer cookies overall, heavier reliance on first-party data, and Consent Mode picking up slack for the people who opt out. If you’re running Google Analytics on your own site, don’t leave the consent banner and privacy policy as an afterthought. Get them sorted properly. It’s not just about staying on the right side of GDPR either, cleaner consent data genuinely makes your GA4 reports more useful too.