Firebase

Overview

Firebase is Google's full-stack application development platform, providing authentication, real-time and Firestore databases, cloud functions, hosting, remote config, and analytics. On the web, the Firebase JavaScript SDK initializes one or more services depending on what the application imports, and Firebase Analytics — powered by Google Analytics 4 — is frequently bundled with Firebase deployments in single-page applications and progressive web apps.

What This Script Does

Firebase web SDK scripts are modular, and the specific functionality loaded depends on which packages the site imports. The following covers the most commonly deployed components.

Firebase Authentication Firebase Auth uses localStorage and IndexedDB to store session tokens and user credentials. It contacts identitytoolkit.googleapis.com for sign-in flows, securetoken.googleapis.com for token refresh, and www.googleapis.com for OAuth provider flows. No tracking cookies are set for cross-site purposes; storage is strictly scoped to session management.

Firebase Analytics (GA4-powered) When firebase/analytics is imported, the SDK loads from www.googletagmanager.com/gtag/js and registers the following cookies:

• _ga (first-party, 2 years) — unique client identifier for GA4
• _ga_<MEASUREMENT_ID> (first-party, 2 years) — session and hit counter for the specific GA4 property
• _gid (first-party, 24 hours) — day-level session identifier
• _FIREBASE_APP_INSTANCE_ID (IndexedDB/localStorage) — Firebase-specific app instance identifier

The analytics layer contacts analytics.google.com, www.google-analytics.com, and region1.google-analytics.com. It collects: page URLs, page titles, referrer, scroll depth, session duration, event names and parameters, device type, browser and OS version, screen resolution, language, and approximate geolocation inferred from IP address.

Firebase Performance Monitoring When firebase/performance is imported, the SDK instruments the browser using the PerformanceObserver API. It captures First Contentful Paint (FCP), page load timing, network request latency for XHR and fetch calls, and custom performance traces. Data is sent to firebaselogging-pa.googleapis.com. No cookies are set; measurements are sent as authenticated payloads using the Firebase app config.

Firebase Cloud Messaging (FCM) When push notifications are enabled, the SDK registers a service worker that contacts fcm.googleapis.com. The browser's notification permission prompt is shown before any messaging occurs. A registration token is stored in the app's IndexedDB.

Firebase Remote Config Contacts firebaseremoteconfig.googleapis.com to fetch configuration values. No cookies or persistent identifiers are set for this module specifically.

Consent & Compliance

GDPR/ePrivacy: Firebase Authentication, Hosting, Firestore, and Remote Config are strictly necessary services when used as application infrastructure. Firebase Analytics sets persistent tracking cookies (_ga, _gid) and transfers behavioral data to Google — requiring explicit opt-in consent under GDPR Article 7 and the ePrivacy Directive. The French CNIL and German DSK have both issued guidance that Google Analytics (the engine behind Firebase Analytics) requires consent and appropriate data transfer safeguards.

CCPA/CPRA: Firebase Analytics data flowing to Google Analytics constitutes sharing personal information under CCPA. Sites must honor opt-out requests and disclose this data sharing.

EU-US Data Transfers: Firebase Analytics data is processed by Google LLC in the United States. Google participates in the EU-US Data Privacy Framework (DPF), providing a valid transfer mechanism post-Schrems II.

IAB TCF: Firebase Analytics maps to IAB TCF Purpose 1 (store/access information) and Purpose 7 (measurement).

Consent category: Mixed — Essential (Auth, Firestore, Hosting, Functions) and Analytics (Firebase Analytics, Performance Monitoring).

Should You Block This Without Consent?

Conditional. Firebase Authentication, Firestore, Cloud Functions, and Hosting are essential infrastructure — do not block them. Firebase Analytics and Performance Monitoring set persistent cookies and transfer behavioral data to Google; initialize these modules only after analytics consent is granted. Use Firebase's modular SDK imports to ensure analytics packages are never loaded before consent is established.