What is the __utmz cookie?
Contains information about the traffic source or campaign that directed user to the website. The cookie is set when the GA.js javascript is loaded and updated when data is sent to the Google Anaytics server.
Our October 2026 scan found it on 18 sites (1% of the 2,450 we scanned), set before any consent.
- Purpose
- Analytics
- Belongs to
- Google Analytics
- Set as
- First-party (under the site's own domain)
- Typical lifetime
- 6 months (vendor says: 6 months after last activity) — about what the vendor documents
Sites that set __utmz before consent
The highest-ranked 18 of 18 sites.
- cornell.edu3 tracking companies
- pixiv.net3 tracking companies
- jalan.net27 tracking companies
- mbga.jp2 tracking companies
- nosv.org2 tracking companies
- fc2.com2 tracking companies
- russianfood.com6 tracking companies
- duke.edu3 tracking companies
- hatena.ne.jp19 tracking companies
- douban.com1 tracking company
Show 8 more sites
- imageshack.us2 tracking companies
- man7.org1 tracking company
- wikidot.com8 tracking companies
- dnszi.com1 tracking company
- fang.com2 tracking companies
- quicksetcloud.com3 tracking companies
- boutell.com3 tracking companies
- pp.ua1 tracking company
Related cookies
Other cookies from Google Analytics.
- _ga700 sites
- _ga_*685 sites
- _gid185 sites
- _gat*108 sites
- _gat_gtag_*55 sites
How to stop it
Declining non-essential cookies in a site's consent banner should stop __utmz being set on later visits. Blocking third-party cookies in your browser settings stops the third-party kind everywhere, and clearing cookies for a site removes any it already set.
Description from the Open Cookie Database (Apache 2.0).
Understanding this page
- How cookie lifetimes work, and why a 13-month _ga matters
What a cookie's "expires" field actually controls, why Google Analytics ships a 2-year default that many sites cut down to 13 months, and how Safari's 7-day cap on script-set cookies changes the picture.
- First-party vs third-party cookies (and why "first-party" still tracks you)
What the distinction actually means technically, why browsers only block one of the two, and how CNAME cloaking, server-side tagging and cookies like _ga let sites keep tracking under their own domain.
- How to block or limit trackers
Browser privacy settings, content blockers, Global Privacy Control and clearing cookies compared honestly — what each one actually stops, what it doesn't, and what it costs you in return.