Google Ads sets first-party cookies on your domain, mainly _gcl_aw, _gcl_au and _gcl_dc (90 days each), and third-party cookies on Google's domains, such as IDE on doubleclick.net (13 months in the EEA and UK) and NID (6 months). They link ad clicks to conversions and build remarketing audiences, so none of them is strictly necessary: in the EU and the UK they wait for consent. Since March 2024 Google has also expected Consent Mode v2 signals for EEA traffic.
Google Ads cookies at a glance
Every time someone clicks a Google ad and lands on your website, Google's advertising tags write cookies to that visitor's browser. Those cookies record which ad was clicked, when, and whether the visitor later completed a purchase, sign-up, or other conversion.
These are Google Ads cookies: small text files that connect ad clicks to on-site behaviour. They power conversion tracking, remarketing lists, frequency capping, and click-fraud detection. Without them, Google Ads would have no way to report which campaigns actually drove results.
Under GDPR, the ePrivacy Directive, and comparable laws in other regions, advertising cookies require informed, prior consent before they are placed. Get this wrong and you face both regulatory fines and the loss of Google Ads data for the visitors whose choice Google cannot see.
The Google Ads cookies list
Google Ads uses a family of first-party and third-party cookies, each with a distinct role. As of October 2026, Google's list of advertising cookies gives the lifetimes below.
| Cookie name | Type | Purpose | Duration |
|---|---|---|---|
_gcl_aw | First-party | Stores the Google Click Identifier (gclid) after an ad click. Used by the conversion linker to attribute conversions. | 90 days |
_gcl_au | First-party | Stores a unique experiment ID and timestamp for conversion tracking. | 90 days |
_gcl_dc | First-party | Used by the conversion linker for Campaign Manager, Display & Video 360 and Search Ads 360 click information. | 90 days |
_gac_<property-id> | First-party | Set by Google Analytics when linked to Google Ads. Records campaign data for attribution. | 90 days |
IDE | Third-party (doubleclick.net) | Serves and personalises display ads across non-Google sites. | 13 months in the EEA and UK, 24 months elsewhere |
NID | Third-party (google.com) | Stores preferences and personalises ads on Google properties. | 6 months |
DSID | Third-party | Identifies a signed-in user on non-Google sites so their ad personalisation settings are respected. | 2 weeks |
__gads | First-party | Enables sites running AdSense or Ad Manager to display and measure ads. | 13 months |
All _gcl_ cookies are first-party cookies set on your domain. IDE, NID, and DSID are third-party cookies set on Google's domains. Both types fall into the advertising cookie category, and neither qualifies as strictly necessary under the ePrivacy Directive's Article 5(3) exemption.
Alongside cookies, Google Ads appends URL parameters when auto-tagging is enabled. The _gcl_aw cookie is where the conversion linker stores the gclid (Google Click Identifier) after a visitor lands on your site from an ad, so a later conversion can be credited to that click. IDE is the DoubleClick cookie: it sits on doubleclick.net and serves and personalises display ads across sites. Two newer parameters, gbraid and wbraid, serve a similar function for iOS traffic where Apple's privacy restrictions limit cross-app tracking.
Why these cookies need consent
The valid consent requirement comes from two overlapping sources. Article 5(3) of the ePrivacy Directive requires prior consent before placing any cookie that is not strictly necessary. GDPR Articles 6 and 7 govern the lawful processing of the personal data those cookies collect.
Google Ads cookies exist to measure advertising performance and build remarketing audiences. A visitor who clicks an ad requested a product page, not conversion tracking. Pre-ticked boxes, implied consent, and continued browsing do not qualify. The CJEU made this explicit in the Planet49 ruling (Case C-673/17, 2019).
The CNIL's September 2025 fine against Google
On 1 September 2025, the CNIL fined Google 325 million euros, 200 million against Google LLC and 125 million against Google Ireland, for two breaches. The first concerned advertising cookies at Google account creation: refusing personalised-ad cookies was harder than accepting them, and users were not clearly told that using Google services depended on those cookies. A refuse button Google added in October 2023 did not cure the missing information. The second concerned ads inserted between emails in Gmail's Promotions and Social tabs without consent, treated as direct marketing by email under French law.
The cookie breach concerned more than 74 million accounts. The CNIL noted that Google had already been sanctioned for cookie breaches in 2020 and 2021, and took that history as a sign of negligence.
Google Consent Mode v2 and what Google requires
Google Consent Mode v2 adjusts how Google tags behave depending on a user's consent choices. It reads four signals from your consent management platform: ad_storage, ad_user_data, ad_personalization, and analytics_storage.
Since March 2024, Google has required these signals for ads personalisation and measurement on EEA traffic. Google Ads' EU user consent guidance says advertisers must collect consent from EEA end users and share consent signals with Google, and warns that tags which wait for the visitor to interact with the banner leave Google unable to verify the choice, which may lead to loss of data. Data that was never collected cannot be backfilled.
Having a cookie banner alone is not enough. The banner must send the four Consent Mode v2 signals to Google tags. Advertisers do not need the IAB TCF for this. Publishers using AdSense, Ad Manager or AdMob are different: they also need a Google-certified CMP integrated with the IAB TCF to serve personalised ads. If your banner does not pass the four parameters, Google cannot see what visitors chose.
There are two implementation approaches. Basic Consent Mode blocks all Google tags until consent is granted: simple and cautious, but you lose all data from visitors who decline. Advanced Consent Mode loads tags immediately but sends anonymised, cookieless pings when consent is denied, enabling Google's conversion modelling to estimate part of the conversions it cannot observe, once an account reaches 700 ad clicks over 7 days per country and domain grouping. The trade-off is legal complexity, since some privacy professionals argue that even cookieless pings constitute data collection requiring a legal basis.
Third-party cookies in Chrome today
In April 2025, Google confirmed it would not introduce a standalone user-choice prompt for third-party cookies in Chrome. Then in October 2025, Google retired much of its Privacy Sandbox API programme. Third-party cookies remain functional in Chrome for users who have not manually blocked them, while Safari and Firefox continue to block them by default.
Third-party Google Ads cookies like IDE and NID still work for Chrome visitors but are already blocked for a significant share of traffic on other browsers. First-party cookies (_gcl_aw, _gcl_au) are more durable because they sit on your domain, but they still require consent. A cookieless advertising strategy is worth planning regardless.
Consent rules for ad cookies beyond the EU
Under the CCPA as amended by the CPRA, advertising cookies usually count as a "sale" or "sharing" of personal information. Website owners must honour opt-out requests and display a "Do Not Sell or Share My Personal Information" link. Brazil's LGPD requires consent as the most common legal basis for advertising cookies. Canada's PIPEDA requires meaningful consent and transparency. The UK GDPR and PECR mirror the EU framework, requiring prior consent for non-essential cookies, and the UK cookie exemptions that took effect in February 2026 cover statistics and site appearance, not advertising.
How to handle Google Ads cookies on your website
Audit your cookies
Run a free cookie scan to identify every cookie your site places, including all _gcl_ variants and any third-party Google cookies loaded through iframes or embedded content. Do not assume you know what your tags set: tag changes add cookies quietly.
Implement a CMP with Consent Mode v2
Choose a consent management platform that passes all four Consent Mode v2 parameters to your Google tags. If you also run AdSense, Ad Manager or AdMob, it must be Google-certified and integrated with the IAB TCF as well. Without these signals, Google cannot use EEA visitors' data for measurement and personalisation as their choices allow.
Classify and document correctly
All _gcl_ and _gac_ cookies belong in the advertising category, not analytics, and not functional cookies. Keep your cookie policy updated with specific cookie names, purposes, and durations, and review it whenever you change your tags or Google updates its cookie list.
Google Ads cookies: short answers
Do Google Ads cookies count as strictly necessary?
No. Strictly necessary cookies are limited to those essential for delivering a service the user explicitly requested. Advertising cookies like _gcl_aw and IDE serve the advertiser's measurement needs, not the visitor's request. They always require consent under the ePrivacy Directive.
What happens when running Google Ads without Consent Mode v2?
For EEA traffic, Google cannot see the visitor's choice, so personalisation, remarketing audiences and measurement for those visitors are limited, as Google has required the signals since March 2024. Smart Bidding then optimises on incomplete data, and data that was never collected cannot be recovered.
Is Consent Mode v2 a legal requirement?
Consent Mode v2 is a Google policy requirement, not a legal one. GDPR does not mandate any specific technical standard. However, Google enforces it as a condition of using its advertising products for EEA and UK traffic, so the practical impact is comparable.
How long do Google Ads cookies last?
Most first-party cookies (_gcl_aw, _gcl_au, _gac_) expire after 90 days. The third-party IDE cookie lasts 13 months in the EEA and UK, and 24 months elsewhere. NID expires 6 months after last use. __gads persists for 13 months.
Is consent needed for Google Ads cookies under the CCPA?
The CCPA uses an opt-out model. Prior consent is not required, but you must honour opt-out requests and provide a "Do Not Sell or Share My Personal Information" link. Google Ads remarketing cookies qualify as "sharing" for cross-context behavioural advertising.
Is it possible to use Google Ads without any cookies at all?
Not entirely. Enhanced Conversions can reduce reliance on cookies by sending hashed first-party data to Google. Advanced Consent Mode sends cookieless pings for modelling. But remarketing and detailed conversion paths still depend on cookies for consenting users.
What is the difference between _gcl_aw and _gac cookies?
_gcl_aw is set by Google's conversion linker tag and stores the gclid from an ad click. _gac_ is set by Google Analytics when linked to Google Ads and records campaign data for GA4 reports. Both last 90 days but originate from different tags.
See which Google Ads cookies your pages set
If you run Google Ads for visitors in the EU or UK, start by finding out which of these cookies appear before anyone chooses. Kukie.io scans your site, sorts the Google Ads cookies it finds into the advertising category, and sends the four Consent Mode v2 signals from its banner.
