Cookies are at the heart of Google Analytics. Not the chocolate chip-filled ones, but browser cookies that store session data and provide a critical link in tracking return visitors and attribution.
There is shockingly little documentation on the cookies created by the tracking code, what they store or how they work. But they are so integral to the Google Analytics reports, it is important to lift the hood and understand exactly what is going on.
***Update: Universal Analytics uses a different cookie “recipe” than the one outlined in this article.
First, to dispel some confusion. Cookies are used across the wide expanse of the Interwebs. You might have hundreds of cookies stored on your computer right now. They are small text files stored by the browser and can only be read by the website that created them. Cookies are browser-specific. In other words, if you are using multiple browsers on a computer, they will each have their own set of cookies.
If I am visiting www.mysite.com, and it sets cookies on my machine, those are first-party cookies. If, however, a script from www.annoying-popup-ds-world.com sets cookies on my machine, these are third-party cookies. The difference is in which domain the cookies are tied to, and therefore, which domain can read them.
Google Analytics uses first-party cookies. One primary reason for this is that third-party cookies are often blocked by browsers. It does this by setting cookies with code that is called on your site, the
Cookies come in two more flavors: session and persistent. Session cookies are deleted when the browser closes. Persistent cookies have a defined expiration date. The browser will only delete them when they expire.
Certain reports in Google Analytics rely heavily on cookies. If a visitor deletes or blocks their cookies, information for that visit or visitor will be misinterpreted or lost.
Cookies are a major component of unique visitor tracking. They tie all the activity of a visitor into a single visit, and are used to determine when a visit ends.
Cookies store vital information about each visit. They store the start time of the current visit and keep track of how many pages have been viewed so far. If a visitor closes the browser or is inactive for too long, the cookies will indicate that the visit has ended.
Cookies store the date and time of the visitor’s first visit (allowing for calculations of how many visits it took to convert). The total number of visits from the visitor is stored in cookies, too.
Cookies are the main vehicle for attributing visit information and conversions to specific marketing campaigns or traffic sources. Each time the visitor comes to the site, the code stores new referral or campaign variable information in the visitor’s cookies.
Dissecting Google Analytics Cookies
Google Analytics uses several cookies to record all of this information. The most common are covered here. The expiration dates for each cookie may be customized with built-in GA code.
All of the cookies store a domain hash that ties them to the same site. In the case that cookie information changes during a visit (e.g., a user-defined variable gets changed from “Prospect” to “Customer”), Google Analytics will attribute the entire visit to the last cookie value.
The __utma cookie is a persistent cookie that expires in two years. With each new visit, the expiration date is refreshed.
The expiration time can be customized in the tracking code.
The __utmb cookie is a persistent cookie that expires in 30 minutes. Each pageview refreshes it.
The expiration time can be customized for each site (or page).
This is a persistent cookie with a catch: it expires in six months and is only refreshed when the traffic source changes. Every other cookie is refreshed with each pageview. The impact of this is that a banner ad that brings a visitor to your site will get the credit for all future direct visits for up to six months. After six months, if there have not been visits from any other source, the cookie will expire and start to attribute information to direct visits.
The expiration window can be customized in the tracking code.
Sending it to Google Analytics
Finally, all of this cookie information is sent to Google Analytics via the __utm.gif request that it makes with each pageview. When Google Analytics processes data, it relies on this cookie information (among other pieces of data in the query string) to populate your reports.