What it does
Google documents `_gcl_au` as being used by Conversion Linker functionality for conversion attribution. Avoid claiming that every instance contains a particular click identifier without inspecting the current implementation and vendor documentation.
That is an advertising purpose, not a measurement one, and the scanner classifies the whole `_gcl_` family as advertising. It is a frequent source of confusion because the cookie is often installed by a tag manager alongside analytics tags and inherits the same consent setting by accident.
What to write in a cookie declaration
Describe it as advertising conversion attribution, and make sure it is listed under marketing rather than analytics. Getting this one into the wrong category is a common declaration error.
| Field | Value |
|---|---|
| Name | _gcl_au |
| Provider | Google Ads |
| Purpose category | advertising |
| Consent category | Marketing |
| Expiry | 90 days (vendor default) |
| Storage | First-party, written by script |
Treat the expiry as indicative
The value above is the vendor’s documented default. Vendors change configuration and several browsers cap script-written lifetimes. Record what repeated scans observe on your own site, with the browser, region, path and interaction state; one run is not authoritative for every visitor.
Can a visitor refuse it?
Yes, and it should normally be in marketing. In an opt-out model StrongPrivacy conservatively applies GPC by disabling every optional category, so a sale/share use cannot escape merely because it was misfiled. You still need to document whether the actual Google Ads data flow constitutes sale or sharing.
A verification scan supplies runtime evidence for the pages and states it exercises. Test a fresh profile with no choice made, then after refusal, and reconcile observed storage with response headers, server-side integrations and paths the scan did not visit.
Common questions
Is _gcl_au analytics or advertising?
Advertising. It exists to attribute conversions to ad clicks. Placing it in an analytics category understates what it does and puts the consent in the wrong place.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- Google: how Google uses cookies
Vendor documentation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.