Google Analytics Cookies (v2) Cheat Sheet by Jay Taylor
An overview of the anatomy of the cookies set and used by Google Analytics.
__utma (Visitor cookie)
Each group is separated by a period character. All times stored are UNIX timestamps. For new visits the three times in this cookie will all be the same.
__utmb (Session cookie)
Each group is separated by a period character. All times stored are UNIX timestamps.
The token bucket stores how many requests are being made to GA at once. This number will decrease for each request, any requests sent while the bucket is empty will be discarded.
__utmc (Session cookie)
This cookie is deprecated due to session handling changes within Analytics, but is still set by ga.js. Sessions now only end when the __utmb cookie expires.
__utmv (Custom Variable cookie)
Each group is separated by a period character. This cookie can only be created by using Google Analytics' deprecated _setVar() method. Calling this method sets this cookie and automatically sends the data to Google Analytics via a __utm.gif request.
Values sent in this manner appear in the "User Defined" report, unless otherwise intercepted with profile filters.
__utmmobile (Mobile Visitor cookie)
This cookie is only created by the Google Analytics mobile tracking SDK. It stores an ID generated by MD5 hashing several possible values, and then returning a substring of the result prefixed with '0x' - this serves as a unique visitor ID.
This cookie is used as a basic Visitor cookie, similar to __utma.
__utmz (Campaign cookie)
Each group is separated by a period character. The campaign parameters are a single URL-encoded string, separated by pipe '|' characters. They can include:
utmcsr = source
utmcmd = medium
utmccn = campaign name
utmctr = campaign keyword
utmcct = campaign content / variation
utmgclid = Google Click ID
utmgclid will only be set for AutoTagged AdWords visits. If set, other parameters will be unset, as utmgclid is a hash of the campaign values and is used instead.
* the __utmb cookie will only expire after thirty minutes of no interaction with Google Analytics, i.e.: idle time.