Does Firebase require cookie consent?

It depends on which modules are loaded. Firebase Auth, Firestore, Hosting, and Functions are essential — no consent required. Firebase Analytics (powered by GA4) sets persistent tracking cookies and requires analytics consent before initialization. Block only the analytics module; do not block the entire Firebase SDK.

What cookies does Firebase Analytics set?

Firebase Analytics sets _ga (first-party, 2 years) as the GA4 client identifier, _ga_ (2 years) for session tracking, and _gid (24 hours) for day-level sessions. A _FIREBASE_APP_INSTANCE_ID is stored in IndexedDB. Data is sent to analytics.google.com. Firebase Auth stores session tokens in localStorage, not cookies.

How does ConsentStack manage Firebase on single-page apps?

ConsentStack classifies Firebase as mixed: essential for Auth, Firestore, and Hosting; analytics for Firebase Analytics. It blocks Firebase Analytics initialization until analytics consent is granted. ConsentStack recommends modular SDK imports so the analytics package is never loaded before the user's consent status is established on page load.

What tracker domains does Firebase use?

ConsentStack has catalogued tracker domains for Firebase including firebaseinstallations.googleapis.com, firebase.googleapis.com and firebaseremoteconfig.googleapis.com, among 4 in total. These are the network destinations Firebase's scripts contact, which a consent platform blocks until a visitor agrees.

Firebase - Google Platform Consent & Privacy Guide

Back to Vendor Library

Overview

Firebase is Google's full-stack application development platform, providing authentication, real-time and Firestore databases, cloud functions, hosting, remote config, and analytics. On the web, the Firebase JavaScript SDK initializes one or more services depending on what the application imports, and Firebase Analytics — powered by Google Analytics 4 — is frequently bundled with Firebase deployments in single-page applications and progressive web apps.

What This Script Does

Firebase web SDK scripts are modular, and the specific functionality loaded depends on which packages the site imports. The following covers the most commonly deployed components.

Firebase Authentication Firebase Auth uses localStorage and IndexedDB to store session tokens and user credentials. It contacts identitytoolkit.googleapis.com for sign-in flows, securetoken.googleapis.com for token refresh, and www.googleapis.com for OAuth provider flows. No tracking cookies are set for cross-site purposes; storage is strictly scoped to session management.

Firebase Analytics (GA4-powered) When firebase/analytics is imported, the SDK loads from www.googletagmanager.com/gtag/js and registers the following cookies:

_ga (first-party, 2 years) — unique client identifier for GA4
_ga_<MEASUREMENT_ID> (first-party, 2 years) — session and hit counter for the specific GA4 property
_gid (first-party, 24 hours) — day-level session identifier
_FIREBASE_APP_INSTANCE_ID (IndexedDB/localStorage) — Firebase-specific app instance identifier

The analytics layer contacts analytics.google.com, www.google-analytics.com, and region1.google-analytics.com. It collects: page URLs, page titles, referrer, scroll depth, session duration, event names and parameters, device type, browser and OS version, screen resolution, language, and approximate geolocation inferred from IP address.

Firebase Performance Monitoring When firebase/performance is imported, the SDK instruments the browser using the PerformanceObserver API. It captures First Contentful Paint (FCP), page load timing, network request latency for XHR and fetch calls, and custom performance traces. Data is sent to firebaselogging-pa.googleapis.com. No cookies are set; measurements are sent as authenticated payloads using the Firebase app config.

Firebase Cloud Messaging (FCM) When push notifications are enabled, the SDK registers a service worker that contacts fcm.googleapis.com. The browser's notification permission prompt is shown before any messaging occurs. A registration token is stored in the app's IndexedDB.

Firebase Remote Config Contacts firebaseremoteconfig.googleapis.com to fetch configuration values. No cookies or persistent identifiers are set for this module specifically.

Consent & Compliance

GDPR/ePrivacy: Firebase Authentication, Hosting, Firestore, and Remote Config are strictly necessary services when used as application infrastructure. Firebase Analytics sets persistent tracking cookies (_ga, _gid) and transfers behavioral data to Google — requiring explicit opt-in consent under GDPR Article 7 and the ePrivacy Directive. The French CNIL and German DSK have both issued guidance that Google Analytics (the engine behind Firebase Analytics) requires consent and appropriate data transfer safeguards.

CCPA/CPRA: Firebase Analytics data flowing to Google Analytics constitutes sharing personal information under CCPA. Sites must honor opt-out requests and disclose this data sharing.

EU-US Data Transfers: Firebase Analytics data is processed by Google LLC in the United States. Google participates in the EU-US Data Privacy Framework (DPF), providing a valid transfer mechanism post-Schrems II.

IAB TCF: Firebase Analytics maps to IAB TCF Purpose 1 (store/access information) and Purpose 7 (measurement).

Consent category: Mixed — Essential (Auth, Firestore, Hosting, Functions) and Analytics (Firebase Analytics, Performance Monitoring).

Should You Block This Without Consent?

Conditional. Firebase Authentication, Firestore, Cloud Functions, and Hosting are essential infrastructure — do not block them. Firebase Analytics and Performance Monitoring set persistent cookies and transfer behavioral data to Google; initialize these modules only after analytics consent is granted. Use Firebase's modular SDK imports to ensure analytics packages are never loaded before consent is established.

Is Firebase GDPR compliant?

Firebase typically loads analytics trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Firebase can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Firebase, not on Firebase itself.

Visit website

Consent Categories

Analytics Essential

Also Known As

Firebase AnalyticsFirebase SDKGA4Google FirebaseFirebase Hosting

Industries

Computers Electronics and TechnologySearch Engines

Tracked Domains (4)

Firebase's trackers are occasionally seen, seen on under 1% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

firebaseinstallations.googleapis.comEssential

firebaseinstallations.googleapis.com is an essential domain operated by Firebase, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

firebase.googleapis.comEssential

firebase.googleapis.com is an essential domain operated by Firebase, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

firebaseremoteconfig.googleapis.comEssential

firebaseremoteconfig.googleapis.com is an essential domain operated by Firebase, used to keep the site working, including security, load balancing, and sessions. Seen on under 1% of scanned sites.

firebaselogging-pa.googleapis.comEssential

firebaselogging-pa.googleapis.com is an essential domain operated by Firebase, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.