What it does
`_gid` was used by Universal Analytics to distinguish users, with a historical default duration of 24 hours. Standard Universal Analytics stopped processing new data in 2023, and Google’s current GA4 cookie table does not list `_gid`. A live finding may indicate leftover code, another product using the same name or a nonstandard integration, so confirm the script and request initiator before naming the provider conclusively.
If it is being used as an analytics identifier, its short life does not create a general consent exemption. Duration is relevant to proportionality, while the storage/access analysis turns on purpose and necessity.
What to write in a cookie declaration
List it only if it is observed and the initiator confirms the provider. Record the measured duration and mark it separately from current GA4 defaults rather than copying a legacy cookie table into every declaration.
| Field | Value |
|---|---|
| Name | _gid |
| Provider | Google Analytics (legacy) |
| Purpose category | analytics |
| Consent category | Analytics |
| Expiry | Historical default: 24 hours (vendor default) |
| Storage | First-party, written by script |
Treat the expiry as indicative
The value above is the vendor’s documented default. Vendors change configuration and several browsers cap script-written lifetimes. Record what repeated scans observe on your own site, with the browser, region, path and interaction state; one run is not authoritative for every visitor.
Can a visitor refuse it?
Yes, on the same basis as `_ga`. In a standard consent-required implementation it waits for analytics consent; a claimed audience-measurement exception must be assessed against the exact configuration and applicable national conditions.
A verification scan supplies runtime evidence for the pages and states it exercises. Test a fresh profile with no choice made, then after refusal, and reconcile observed storage with response headers, server-side integrations and paths the scan did not visit.
Common questions
Is a 24-hour cookie exempt from consent?
No. There is no short-duration exemption. The test is whether the storage is strictly necessary for a service the visitor asked for.
Sources and verification
Verified on . Product-behaviour statements were checked against the current implementation and tests. The links below are the verification basis recorded for this article. They support the stated facts, not a legal conclusion for every site or configuration; recheck changing vendor behaviour before relying on it in production.
- Google Analytics: cookie usage on websites
Vendor documentation
Checked
- Google Analytics: Universal Analytics migration timeline
Vendor documentation
Checked
See what your own site is loading
A browser scan reports the requests and storage it observed during the sampled journey. Use configured workspace scans to compare the states and pages that matter to your implementation.