The new cookieFlags parameter in Google Analytics

With the application of SameSite settings in the latest versions of Google Chrome, it has become a mad rush for cookies to work in proprietary and third-party contexts. I already covered this phenomenon in my article on SameSite, as well as in my guide to configure tracking without cookies for iframes.

Recently, Google Analytics has updated its libraries (App + Web, gtag.js, and analytics.js) with a new setting: cookieFlags (analytics.js) or cookie_flags (App + Web and gtag.js).

NOTE March 25, 2020: The feature is not yet officially released, and there may be additional features added to the feature before it is officially documented. I will update this article with all updates, if necessary.

In this short article, I will show you how to use it to customize the cookies used by Google Analytics.

Cookie guidelines

When you create a cookie, you give it a Last name and one value. Google Analytics, for example, creates a cookie named _ga with a pseudo-random client ID generated for the current browser instance.

If you create a cookie with only the name and the value, it has the following functionality by default:

• It will be a session cookie, which means it has no expiration. When the browser is closed, all session cookies are deleted (although not always).
• It will be written on the current domain of the browser.
• It will be written to the current browser path.

In addition, in the latest version of the Google Chrome browser, the cookie will also be treated as having the SameSite=Lax flag. This means that the cookie Will not do operate when accessible in a third-party context.

When configuring a cookie, you can configure these fields as desired. The directives available for configuration are:

As you can see, there are some fields that you can already define with pre-existing Google Analytics parameters, but you are still missing the configuration option all aspects of the cookie.

The new cookieFlags field

New cookieFlags field allows you to define all directive relating to cookies when creating the Google Analytics cookie.

Naturally, this excludes HttpOnly as this is only available for cookies defined in the HTTP response.

The value of this parameter is a semicolon separated list of lowercase cookie directives and their respective values. For example, this is a possible value of cookieFlags:

max-age=7200;domain=simoahava.com;path=/;secure;samesite=none

If defined as the value of cookieFlags, it would create the Google Analytics cookie with an expiration of two hours (7200 seconds), place it on the simoahava.com domain and on the root path, and make sure it is only sent with HTTPS requests and make it available as a third party cookie.

Mostly, cookieFlags takes precedence if some of the indicators have already been defined with for example cookieExpires and cookieDomain. If there is a conflict, cookieFlags wins.

Define the field in analytics.js

To define the field with Universal Analytics where you use an online script to collect data (i.e. not Google Tag Manager), you must define it as follows:

ga('create', 'UA-XXXXX-Y', {
  cookieFlags: 'max-age=7200;secure;samesite=none'
});

The right place for cookieFlags is in the method of creating the tracker, embedded in an object that you pass as a parameter to ga() method.

Define the field in gtag.js

You can also define the field with an online gtag.js implementation. The field name is cookie_flags rather than cookieFlags.

gtag('config', 'G-N2A3FMNDT5', {
  cookie_flags: 'max-age=7200;secure;samesite=none'
});

Define the field in Google Tag Manager

In Google Tag Manager, the main places where you want to change this field are Universal Analytics tags and App + Web Configuration tags.

Universal Analytics tag

This includes the Google Analytics Settings variable.

The field name is cookieFlags and the value is the string of directives you want to define.

App + Web configuration tag

The field name is cookie_flags.

Summary

This is an important update to the Google Analytics data collection libraries. There is so much scenarios in which the proprietary cookies used by Google Analytics must be accessible in a third-party context.

These scenarios include, for example, integrated reservation flows, integrated forms and login portals.

Without adjusting the samesite=none;secure in the Google Analytics settings, cookies created by GA would not be available in a third-party context, which disrupts your ability to follow the same user on the parent site and in the integrated resource.

The other fields are also useful – Max-Age is so much easier to use than Expiresand set the cookie Secure by default, this is just good practice.

Let me know in the comments if you have any questions about this new setting!