Does the AMP_TOKEN cookie need consent?

In the EU and the UK, yes. AMP_TOKEN is an analytics cookie, so it may be set only after the visitor agrees. Under the CCPA, California residents can opt out if the data is sold or shared.

How long does the AMP_TOKEN cookie last?

AMP_TOKEN usually lasts 30 seconds till 1 year. The exact lifetime depends on the site's settings and the version of the script that sets it.

Who sets the AMP_TOKEN cookie?

AMP_TOKEN is set by Google Analytics. It is in the Analytics category.

How do I block or delete the AMP_TOKEN cookie?

Visitors can delete AMP_TOKEN in their browser's cookie settings. On your own website, a consent banner can keep the script that sets it waiting until the visitor accepts analytics cookies. Kukie.io's banner does this for known trackers by default, and for any other script you tag with its category.

Analytics

AMP_TOKEN cookie

Set by Google Analytics.

What it does

Contains a token code that is used to read out a Client ID from the AMP Client ID Service. By matching this ID with that of Google Analytics, users can be matched when switching between AMP content and non-AMP content. Reference: https://support.google.com/analytics/answer/7486764?hl=en

Cookie name: AMP_TOKEN
Category: Analytics
Provider: Google Analytics
Duration: 30 seconds till 1 year
Data source: Open Cookie Database (opens in a new tab)

Consent

Needed in the EU and the UK

AMP_TOKEN is in the Analytics category. In the EU and the UK, analytics cookies need the visitor's consent before they are set. California's CCPA works differently: it lets residents opt out of the sale or sharing of their personal information.

GDPR and ePrivacy (EU): Prior consent is needed before setting AMP_TOKEN. Analytics cookies are not covered by the strictly necessary exemption; only a few regulators (for example France's CNIL) allow a narrow exemption for first-party audience measurement under strict conditions.
UK GDPR and PECR: Consent is needed before setting AMP_TOKEN. The ICO treats analytics cookies as non-essential.
CCPA and CPRA (California): Disclose AMP_TOKEN in your privacy policy and honour opt-out requests, including the Global Privacy Control signal, if the analytics data is shared or sold.

Managing AMP_TOKEN with a consent banner

A consent banner can keep the script that sets AMP_TOKEN waiting until the visitor accepts analytics cookies. Kukie.io's cookie scanner finds AMP_TOKEN and sorts it into a category. The banner holds back known trackers by default, and any other script you tag with its category waits too.

Learn more about script blocking

Related cookies