Cookies in Google Analytics

Cookies are at the heart of Google Analytics. Not the chocolate chip-filled ones, but browser cookies that store session data and provide a critical link in tracking return visitors and attribution.

There is shockingly little documentation on the cookies created by the tracking code, what they store or how they work. But they are so integral to the Google Analytics reports, it is important to lift the hood and understand exactly what is going on.

***Update: Universal Analytics uses a different cookie “recipe” than the one outlined in this article.

Flavors

First, to dispel some confusion. Cookies are used across the wide expanse of the Interwebs. You might have hundreds of cookies stored on your computer right now. They are small text files stored by the browser and can only be read by the website that created them. Cookies are browser-specific. In other words, if you are using multiple browsers on a computer, they will each have their own set of cookies.

If I am visiting www.mysite.com, and it sets cookies on my machine, those are first-party cookies. If, however, a script from www.annoying-popup-ds-world.com sets cookies on my machine, these are third-party cookies. The difference is in which domain the cookies are tied to, and therefore, which domain can read them.

Google Analytics uses first-party cookies. One primary reason for this is that third-party cookies are often blocked by browsers. It does this by setting cookies with code that is called on your site, the _trackPageview() method.

Cookies come in two more flavors: session and persistent. Session cookies are deleted when the browser closes. Persistent cookies have a defined expiration date. The browser will only delete them when they expire.

How Google Analytics Uses Cookies

Certain reports in Google Analytics rely heavily on cookies. If a visitor deletes or blocks their cookies, information for that visit or visitor will be misinterpreted or lost.

Unique Visitors

Cookies are a major component of unique visitor tracking. They tie all the activity of a visitor into a single visit, and are used to determine when a visit ends.

Activity

Cookies store vital information about each visit. They store the start time of the current visit and keep track of how many pages have been viewed so far. If a visitor closes the browser or is inactive for too long, the cookies will indicate that the visit has ended.

Cookies store the date and time of the visitor’s first visit (allowing for calculations of how many visits it took to convert). The total number of visits from the visitor is stored in cookies, too.

Traffic Source

Cookies are the main vehicle for attributing visit information and conversions to specific marketing campaigns or traffic sources. Each time the visitor comes to the site, the code stores new referral or campaign variable information in the visitor’s cookies.

Dissecting Google Analytics Cookies

Google Analytics uses several cookies to record all of this information. The most common are covered here. The expiration dates for each cookie may be customized with built-in GA code.

All of the cookies store a domain hash that ties them to the same site. In the case that cookie information changes during a visit (e.g., a user-defined variable gets changed from “Prospect” to “Customer”), Google Analytics will attribute the entire visit to the last cookie value.

__utma
This is the main way Google Analytics tracks unique visitors. Stored in this cookie is a unique visitor ID, the date and time of their first visit, the time their current visit started and the total number of visits they have made.

The __utma cookie is a persistent cookie that expires in two years. With each new visit, the expiration date is refreshed.

The expiration time can be customized in the tracking code.

__utmb
This is how Google Analytics decides whether a visit has timed out and also how deep a visit has gotten. It stores the number of pageviews in the current visit and the start time of the visitor’s current visit.

The __utmb cookie is a persistent cookie that expires in 30 minutes. Each pageview refreshes it.

The expiration time can be customized for each site (or page).

__utmc
The __utmc cookie is the only session cookie used by Google Analytics. Its only purpose is to register that the visit ended if the browser gets closed.
__utmz
This is the traffic source cookie. It contains all of the traffic source information for the current visit, if it was different from the previous visit. If no traffic source information can be found for the current visit, the cookie is not changed. This is the way that Google Analytics attributes visit information, including conversions and transactions to a traffic source. It does not contain historical information for previous sources.

This is a persistent cookie with a catch: it expires in six months and is only refreshed when the traffic source changes. Every other cookie is refreshed with each pageview. The impact of this is that a banner ad that brings a visitor to your site will get the credit for all future direct visits for up to six months. After six months, if there have not been visits from any other source, the cookie will expire and start to attribute information to direct visits.

The expiration window can be customized in the tracking code.

__utmv
This is the user-defined variable cookie. Developers can segment visitors by custom variables by calling a native JavaScript method. This new variable gets stored in a persistent cookie which expires in two years.

Sending it to Google Analytics

Finally, all of this cookie information is sent to Google Analytics via the __utm.gif request that it makes with each pageview. When Google Analytics processes data, it relies on this cookie information (among other pieces of data in the query string) to populate your reports.

Next Steps

Check out our Recommended Tools to learn about products that complement Google Analytics.