A first-party cookie belongs to the domain shown in the browser's address bar. When GA4 runs on example.com, it stores its client ID in a cookie on example.com, which is first-party. These cookies are not affected by third-party cookie blocking, which is why most analytics relies on them, but browsers still limit them in some cases, especially when they are set by JavaScript.
How analytics uses them
GA4 sets the _ga cookie with a random client ID and a session cookie for each property. On each visit, the tag reads the client ID so events from the same browser count as one user. Clearing cookies, using another browser or switching devices creates a new user.
Browser limits
Even first-party cookies are not permanent. Safari's Intelligent Tracking Prevention caps the lifetime of cookies set by client-side script, and adds further limits in some cases involving link decoration from known trackers. Exact behavior differs by browser version, so check current WebKit and browser documentation rather than old summaries.
- Script-set cookies may expire sooner in privacy-focused browsers
- Server-set cookies (via HTTP response headers) are treated differently by some browsers
- Private browsing modes clear cookies at the end of the session
First-party is not the same as consent-free
Whether a cookie is first-party or third-party has no bearing on whether you need consent. EU-style rules focus on whether the cookie is strictly necessary, not on which domain sets it.
Example
Returning visitors that looked new
Suppose Mapleforge, a CAD collaboration tool, notices that new user share is much higher on Safari than on Chrome for the same pages. Shorter cookie lifetimes mean returning Safari visitors are counted as new. The team treats new versus returning splits as directional and relies on logged-in IDs for retention analysis.
Common mistakes
Assuming first-party avoids consent rules
Consent depends on purpose, not domain.
Treating client ID as a person
It identifies a browser for a limited time, not a human across devices.
Questions
First-party cookies belong to the site you are visiting. Third-party cookies belong to another domain, such as an ad network embedded in the page, and are blocked or restricted by default in several browsers.
Sources
