What that cookie actually is, and whether it can be refused.

_ga

The client identifier Google Analytics uses to distinguish one browser across visits. Its documented default is first-party and persistent.

Set by: Google Analytics

_gid

A legacy Universal Analytics cookie with a historical 24-hour default; current GA4 documentation instead lists `_ga` and `_ga_<container-id>`.

Set by: Google Analytics (legacy)

_gcl_au

A Google Ads conversion-linker cookie used to support conversion attribution across visits.

Set by: Google Ads

_fbp

The Meta Pixel’s browser identifier, written on your domain by Meta’s script, and used to link site activity to a Meta ad account.

Set by: Meta

_fbc

The click identifier. Where `_fbp` says "this browser", `_fbc` says "this browser arrived from this specific ad click".

Set by: Meta

_ttp

The TikTok Pixel’s browser identifier, in the same shape as Meta’s `_fbp` and with the same consent position.

Set by: TikTok

_hjSessionUser_*

Hotjar’s persistent user identifier, one of a family of cookies all beginning `_hj` and all matched by that prefix.

Set by: Hotjar

_clck

Microsoft Clarity’s persistent user identifier, paired with a session cookie that joins page views into a single replay.

Set by: Microsoft Clarity

MUID

A Microsoft identifier that is recognised across Microsoft properties, which makes it a cross-site identifier rather than a site-scoped one.

Set by: Microsoft

hubspotutk

The HubSpot visitor token, the cookie that turns anonymous browsing into a contact record once someone submits a form.

Set by: HubSpot

__hstc

HubSpot’s principal tracking cookie: the domain, the visitor token, the first and last visit timestamps, and a session counter.

Set by: HubSpot

bcookie

LinkedIn’s browser identifier, set when the Insight Tag is present and accompanied by an unusually long list of companions.

Set by: LinkedIn

_pin_unauth

Pinterest’s identifier for a visitor who is not signed in to Pinterest, which is most of the people on your site.

Set by: Pinterest

_shopify_y

A Shopify analytics identifier whose current status must be verified: Shopify’s retirement notice and its current cookie policy conflict.

Set by: Shopify

VISITOR_INFO1_LIVE

A YouTube cookie used for functionality, analytics and, depending on settings, advertising or personalization. Google’s current disclosure says `__Secure-YNID` is replacing it.

Set by: YouTube

YSC

A session-scoped YouTube security cookie that Google says helps ensure requests in a browsing session are made by the user rather than another site.

Set by: YouTube

IDE

DoubleClick’s advertising identifier, set on doubleclick.net and used to measure and target ads across the sites that carry Google advertising.

Set by: Google (DoubleClick)

OptanonConsent

OneTrust’s record of the visitor’s decision. Storage narrowly limited to remembering a choice may be necessary, but the conclusion depends on the actual payload and purpose.

Set by: OneTrust

CookieConsent

Cookiebot’s record of the visitor’s decision, encoded per category, and one of the most recognisable strings in any cookie audit.

Set by: Cookiebot

euconsent-v2

The IAB Transparency and Consent Framework string, a compact encoding of purposes and vendors that travels down the programmatic advertising chain.

Set by: IAB TCF

__stripe_mid

A Stripe identifier used for fraud prevention. It may be necessary during a requested payment flow; that conclusion should not automatically be extended to every page.

Set by: Stripe