Do Google scripts require cookie consent?

It depends on the product. reCAPTCHA and Tag Manager are essential. Analytics requires analytics consent. Ads and remarketing require marketing consent. Google Fonts needs no consent. The generic Google entry spans all four categories — each product must be assessed individually rather than treated as one vendor.

What cookies does Google set across its products?

Key cookies: _ga and _gid for Analytics (2-year and 24-hour expiry), IDE on doubleclick.net for advertising (13 months), _gcl_aw for Ads attribution (90 days), NID and 1P_JAR for preferences. Requests go to google-analytics.com, googletagmanager.com, googleads.g.doubleclick.net, and google.com.

How does ConsentStack handle the generic Google vendor?

ConsentStack detects generic Google scripts and applies consent rules per product. Analytics scripts are blocked until analytics consent is granted; advertising scripts require marketing consent. Essential scripts like reCAPTCHA load freely. ConsentStack supports Google Consent Mode v2, passing ad_storage and analytics_storage signals.

What tracker domains does Google use?

ConsentStack has catalogued tracker domains for Google including google.com, gstatic.com and ajax.googleapis.com, among 142 in total. These are the network destinations Google's scripts contact, which a consent platform blocks until a visitor agrees.

What cookies does Google set?

Google sets cookies such as _ga, _gid, _ga_ and _GRECAPTCHA. ConsentStack identifies these and classifies them so they can be blocked or allowed based on the visitor's consent choice.

Google - Multi-Product Tracking & Consent Overview

Back to Vendor Library

Overview

Google is the dominant provider of web infrastructure, analytics, advertising, and security tools used across virtually every category of website. Its products span essential site functionality (reCAPTCHA, Fonts), analytics (Google Analytics), advertising (Google Ads, AdSense), and tag management (Google Tag Manager). Because Google's ecosystem is so extensive, scripts identified generically as "Google" may serve any combination of these purposes.

What This Script Does

Google scripts identified under this generic vendor entry may include any of the following:

Google Analytics (gtag.js / analytics.js): Tracks page views, sessions, user demographics, traffic sources, and conversion events. Sets _ga, _gid, and other cookies to identify returning visitors.
Google Ads (conversion.js / remarketing): Fires conversion pixels and builds remarketing audiences. Sets cookies to correlate ad clicks with on-site actions.
Google Tag Manager (gtm.js): Container script that loads other tags. No data collection of its own, but acts as the loader for analytics and marketing tags.
reCAPTCHA (recaptcha/api.js): Bot detection that analyzes browser behavior. Sets cookies to assess human vs. bot probability.
Google Fonts: Loads typeface files from Google's CDN. No cookies, no tracking.
Other Google APIs: Maps, YouTube embeds, Firebase, Google Sign-In, etc.

Collectively, Google scripts may set dozens of cookies including _ga, _gid, _gat, _gcl_au, _gcl_aw, IDE, ANID, NID, 1P_JAR, CONSENT, and DSID. These range from first-party analytics cookies to third-party advertising cookies with lifespans from session to 2+ years. Network requests go to google-analytics.com, googletagmanager.com, googleads.g.doubleclick.net, google.com, and many other Google domains.

Consent & Compliance

Google scripts span all four consent categories: essential, functional, analytics, and marketing.

Essential: reCAPTCHA (bot protection) and Google Tag Manager (tag loader with no inherent data collection) can be classified as essential.
Functional: Google Maps, Google Sign-In, and YouTube embeds provide functional features.
Analytics: Google Analytics collects behavioral data and sets tracking cookies.
Marketing: Google Ads conversion tracking and remarketing tags are advertising tools.

Under GDPR and ePrivacy, analytics and marketing Google scripts require explicit opt-in consent. Essential scripts (reCAPTCHA) may load without consent. Google's own consent mode (GCM) provides a framework for adjusting tag behavior based on user consent signals, sending cookieless pings when consent is denied.

Under CCPA, Google's advertising scripts involve the "sharing" of personal information for cross-context behavioral advertising, triggering opt-out requirements. Google's Restricted Data Processing mode limits data use when activated.

Google Consent Mode v2 is required for sites using Google advertising products that target EEA users. It sends ad_storage, analytics_storage, ad_user_data, and ad_personalization consent signals to Google's tags.

Should You Block This Without Consent?

Conditional. Google's ecosystem spans essential and non-essential functions. Break the generic "Google" vendor into its specific products and apply consent rules per product:

reCAPTCHA, Google Tag Manager, Google Fonts: No blocking required (essential/functional).
Google Analytics: Block until analytics consent is obtained.
Google Ads, remarketing, DoubleClick: Block until marketing consent is obtained.
Google Maps, YouTube, Sign-In: Load as functional, but be aware that some set cookies that may require consent.

If you cannot distinguish which Google scripts are loading under this generic entry, the safest approach is to block until consent is granted, as the advertising and analytics components are the most commonly deployed.

Is Google GDPR compliant?

Google typically loads marketing, social media, analytics and functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Google can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Google, not on Google itself.

Visit website

Products (11)

Firebase

Firebase is Google's mobile and web application development platform offering authentication, real-time database, cloud functions, and analytics. Web SDK scripts initialize Firebase services and may track app events via Firebase Analytics, which is powered by Google Analytics 4. Widely used in single-page apps and PWAs for backend infrastructure and usage tracking.

Google Ads

Google Ads is Google's advertising platform for search, display, and remarketing campaigns. Conversion tracking scripts fire on advertiser landing pages to measure actions taken after ad clicks. The remarketing tag builds audience lists for retargeting users across Google's ad network.

Google Analytics

Google Analytics is the world's most widely deployed web analytics platform. Scripts track page views, sessions, user demographics, traffic sources, and conversion events. Drops cookies to identify returning visitors and attribute user journeys across sessions.

Google Fonts

Google Fonts is a free font hosting service that serves hundreds of typeface families via a global CDN. Stylesheets and font files load from fonts.googleapis.com and fonts.gstatic.com to deliver web fonts to visitors. No advertising or tracking functionality is included.

Google Maps

Google Maps is the dominant web mapping service used for embedded maps and location features on websites. Scripts load interactive map tiles, geocoding, and Places API functionality through the Maps JavaScript API. May set cookies to remember map preferences and manage API quota.

Google Tag Manager

Google Tag Manager is a tag management system that lets marketers deploy and update analytics and marketing scripts without code changes. The GTM container script loads synchronously in the page head and injects configured tags, triggers, and variables on behalf of other vendors. No data collection of its own — acts as a loader for other scripts.

reCAPTCHA

Google reCAPTCHA is a bot detection and spam prevention service protecting web forms, login pages, and checkout flows. Scripts analyze user behavior, mouse movements, and browser fingerprints to distinguish humans from bots. The invisible reCAPTCHA v3 scores interactions without requiring user challenges.

YouTube

YouTube is Google's video platform, widely used to embed video content on external websites. The YouTube iframe player loads JavaScript that communicates with Google's servers for video playback, quality control, and ad serving. Embedded players may set cookies tied to the viewer's Google account to track watch history and personalize recommendations.

Google Search

Google Search appears on websites through the Programmable Search Engine, enabling custom site-specific search functionality. Scripts load the search widget from Google's servers to render search bars and display results within the host website. Sends search queries to Google's index and may set cookies for search personalization and query history.

Sign in with Google is an OAuth-based authentication service that enables users to log into websites using their Google account credentials. Scripts load the Google Identity Services library, display sign-in buttons, and handle token exchange for secure authentication. Stores session tokens and authentication cookies to maintain login state across page visits.

YouTube Player

YouTube Player embeds YouTube videos on external websites via iframe. Scripts load from Google's servers and set cookies for video playback preferences, watch history, and ad targeting. Cookies are dropped even when visitors only view the embed without interacting with the player.

Consent Categories

Analytics Marketing Essential Functional

Also Known As

Google scriptsGoogle trackinggoogle.com cookiesGoogle GDPRGoogle third-party

Industries

Computers Electronics and TechnologySearch Engines

Tracked Domains (142)

Google's trackers are very common, seen on about 51% of the sites ConsentStack has scanned. Scan your own site to see which of these are firing before consent.

google.comMarketing

google.com is a marketing domain operated by Google, used to serve ads, build audiences, and measure ad conversions. Seen on about 51% of scanned sites.

gstatic.comEssential

gstatic.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 46% of scanned sites.

ajax.googleapis.comEssential

ajax.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 8% of scanned sites.

imasdk.googleapis.comEssential

imasdk.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 5% of scanned sites.

ytimg.comEssential

ytimg.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 4% of scanned sites.

jnn-pa.googleapis.comEssential

jnn-pa.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 3% of scanned sites.

storage.googleapis.comEssential

storage.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 2% of scanned sites.

translate.googleapis.comEssential

translate.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 2% of scanned sites.

translate-pa.googleapis.comEssential

translate-pa.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 1% of scanned sites.

googleusercontent.comEssential

googleusercontent.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on about 1% of scanned sites.

ampproject.orgMarketing

ampproject.org is a marketing domain operated by Google, used to serve ads, build audiences, and measure ad conversions. Seen on under 1% of scanned sites.

blogger.comSocial Media

blogger.com is a social media domain operated by Google, used to power social embeds, share buttons, and audience matching. Seen on under 1% of scanned sites.

www.googleapis.comEssential

www.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

bp.blogspot.comSocial Media

bp.blogspot.com is a social media domain operated by Google, used to power social embeds, share buttons, and audience matching. Seen on a small share of scanned sites.

firestore.googleapis.comEssential

firestore.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

firebasestorage.googleapis.comEssential

firebasestorage.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

retail.googleapis.comEssential

retail.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

identitytoolkit.googleapis.comEssential

identitytoolkit.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

us-central1-affilimate.cloudfunctions.netEssential

us-central1-affilimate.cloudfunctions.net is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

mt.googleapis.comEssential

mt.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

mapsresources-pa.googleapis.comEssential

mapsresources-pa.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

content-firebaseappcheck.googleapis.comEssential

content-firebaseappcheck.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

europe-west1-rapid-product-search.cloudfunctions.netEssential

europe-west1-rapid-product-search.cloudfunctions.net is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

hb-dot-valuad.appspot.comEssential

hb-dot-valuad.appspot.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

japfg-trending-content.appspot.comEssential

japfg-trending-content.appspot.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

envolve-chatbot-api-dot-envolvetech-001.nw.r.appspot.comEssential

envolve-chatbot-api-dot-envolvetech-001.nw.r.appspot.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

envolve-logging-dot-envolvetech-001.nw.r.appspot.comEssential

envolve-logging-dot-envolvetech-001.nw.r.appspot.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

japfg-trending-content.uc.r.appspot.comEssential

japfg-trending-content.uc.r.appspot.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

googlevideo.comEssential

googlevideo.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

apigee.netEssential

apigee.net is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

content.googleapis.comEssential

content.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

streetviewpixels-pa.googleapis.comEssential

streetviewpixels-pa.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

acp-magento.appspot.comEssential

acp-magento.appspot.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

us-central1-recruitology-app.cloudfunctions.netEssential

us-central1-recruitology-app.cloudfunctions.net is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

europe-west1-cookiebannergdpr.cloudfunctions.netEssential

europe-west1-cookiebannergdpr.cloudfunctions.net is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

us-central1-wrapper-analytics-prod.cloudfunctions.netEssential

us-central1-wrapper-analytics-prod.cloudfunctions.net is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

api-prime.appspot.comEssential

api-prime.appspot.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

sheets.googleapis.comEssential

sheets.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

us-central1-adsmovil-data-providers.cloudfunctions.netEssential

us-central1-adsmovil-data-providers.cloudfunctions.net is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

chart.googleapis.comEssential

chart.googleapis.com is an essential domain operated by Google, used to keep the site working, including security, load balancing, and sessions. Seen on a small share of scanned sites.

+ 102 more tracked domains, shown by how common they are across scanned sites.

Cookies Google Sets (21)

_ga

Distinguishes unique users by assigning a randomly generated client ID. Two-year expiration.

_gid

Identifies a user session within a 24-hour window. Set by Universal Analytics; persists on legacy installations.

_ga_

Per-stream session state cookie keyed by the GA4 measurement ID (e.g. _ga_GXXXXXXXXX).

_GRECAPTCHA

Google reCAPTCHA risk-analysis cookie. Distinguishes humans from automated bots on protected forms by accumulating signals across a browsing session. Set by the reCAPTCHA JavaScript injected on form pages.

_gcl_au

Google Ads conversion linker cookie that stores ad-click attribution for analytics. 90-day expiration; set by gtag.js and Google Ads tags.

IDE

DoubleClick advertising cookie used by Ad Manager, Display & Video 360, and Campaign Manager to register and report user actions on ads. 13 to 24 months.

g_csrf_token

CSRF protection cookie issued during the Sign in with Google flow. Short-lived; double-submit-cookie pattern with the ID token.

DSID

DoubleClick cookie linking activity across Google ad services. Two-week expiration; used by AdSense, Ad Manager, and Display & Video 360.

_gcl_

Conversion linker family cookies (e.g. _gcl_aw, _gcl_dc, _gcl_gb, _gcl_gf, _gcl_ha) that attribute ad clicks across Google Ads, Display & Video 360, Campaign Manager, Flights, and Hotel Ads. 90-day expiration.

_gat

Throttles request rate to Google Analytics on busy sites. One-minute expiration. Legacy UA cookie.

_dc_gtm_

GA throttle cookie issued when Analytics is loaded through Tag Manager. Keyed by the GA property ID (e.g. _dc_gtm_UA-XXXXX).

_gat_gtag_

Per-stream throttle cookie under gtag.js, keyed by the measurement ID (e.g. _gat_gtag_UA-XXXXX or _gat_gtag_G-XXXXX).

AID

Google ad services cross-device linkage cookie. Used by Ad Manager, Display & Video 360, Google Ads, and Search Ads 360. 13-month to 540-day lifetime.

FLC

DoubleClick floodlight conversion cookie. Ten-second expiration; used by Campaign Manager, Display & Video 360, and Search Ads 360.

__utmt

Legacy Universal Analytics throttle cookie (10-minute expiration). Sunset July 2024.

__utma

Legacy Universal Analytics cookie storing visitor and session counts. Two-year expiration. Sunset July 2024.

__utmb

Legacy Universal Analytics cookie marking session start time. 30-minute expiration. Sunset July 2024.

__utmc

Legacy Universal Analytics session cookie that expires when the browser closes. Sunset July 2024.

__utmz

Legacy Universal Analytics campaign source cookie storing referrer information. Six-month expiration. Sunset July 2024.

AMP_TOKEN

Stores a token used to retrieve a Client ID from the AMP Client ID service. Legacy AMP integration.

__utmv

Legacy Universal Analytics visitor variable cookie (custom segments). Sunset July 2024.

Frequently Asked Questions

Related Vendors

Microsoft Clarity is a free behavioral analytics tool providing session recordings, heatmaps, and scroll maps. Scripts capture every user interaction including clicks, scrolls, and rage clicks, and replay sessions in the Clarity dashboard. No personally identifiable information is transmitted.

Attribution

Attribution is a multi-touch marketing attribution platform. Its scripts track visitor journeys across channels and touchpoints by setting persistent cookies, collecting page view and interaction data, and sending it to attribution models that assign conversion credit.

Microsoft

Runs Clarity (session recording and heatmaps), the Microsoft Advertising UET tag (conversion tracking), and Bing's remarketing pixel. Clarity injects a recording script that captures mouse movements, clicks, and rage clicks. The UET tag fires conversion events to tie ad clicks to on-site actions across Microsoft's ad network.

Manage consent for Google

ConsentStack automatically detects and manages Google trackers so your site stays compliant with global privacy regulations.

Get started free