Sign in with Google

Overview

Sign in with Google (powered by Google Identity Services) is one of the most widely deployed social login mechanisms on the web. It allows users to authenticate on third-party websites using their existing Google account credentials, eliminating the need to create and remember site-specific passwords. The service uses OAuth 2.0 and OpenID Connect protocols to securely exchange identity tokens between Google and the relying website.

What This Script Does

The Google Identity Services library loads from accounts.google.com/gsi/client and handles the full authentication flow.

• Script loaded: accounts.google.com/gsi/client — renders the "Sign in with Google" button, One Tap prompt, or automatic sign-in flow
• Authentication flow: When a user clicks the sign-in button, the script opens a consent dialog (popup or redirect) on accounts.google.com. After the user authenticates, Google returns an ID token (JWT) containing the user's email, name, profile picture, and a unique Google account identifier to the website.
• Cookies set:
  • g_state — First-party cookie. Manages the One Tap sign-in prompt state (whether it has been shown, dismissed, or the cooldown period).
  • g_csrf_token — First-party cookie. CSRF protection token for the sign-in callback, set during the authentication flow.
  • Google's own authentication cookies on accounts.google.com (e.g., SAPISID, APISID, SID) are used to maintain the user's Google session but are not set on the publisher's domain.
• Data exchanged: The website receives only the data scopes it requested (typically email, name, and profile picture). No browsing behavior or tracking data is exchanged through the authentication flow.
• FedCM integration: Modern implementations use the Federated Credential Management API (FedCM), which provides browser-mediated identity flows without third-party cookies.

Consent & Compliance

Sign in with Google falls under the essential consent category when used as an authentication mechanism.

Under GDPR and ePrivacy, authentication cookies set during login (g_state, g_csrf_token) qualify as strictly necessary for providing a service explicitly requested by the user. The ePrivacy Directive exempts cookies that are essential for delivering a service the user has asked for. The GDPR legal basis is Article 6(1)(b) — processing necessary for the performance of a contract (the user account). However, if the One Tap prompt appears automatically without user interaction, the g_state cookie managing prompt display could be argued as non-essential.

Under CCPA/CPRA, identity data exchanged during authentication is processed to provide the requested login service and does not constitute a "sale" or "sharing" of personal information for advertising.

Should You Block This Without Consent?

No. Sign in with Google is an authentication service that users explicitly invoke to log into a website. Blocking it would prevent users from accessing their accounts. The cookies set are functional (CSRF protection, prompt state management) and the data exchange is limited to authentication credentials. If the One Tap auto-prompt is used, consider whether it should appear only after the user has interacted with a login element.