Setting Google Tag Manager cookies with SameSite and Secure attributes

cookies google-analytics session-cookies google-tag-manager samesite
user3621633 picture user3621633 · Oct 11, 2019 · Viewed 11k times · Source

Chrome is reporting the following warning:

A cookie associated with a cross-site resource at https://www.googletagmanager.com/ was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

I have two warnings of this type. The three cookies I see are gtm_auth, gtm_preview, and gtm_debug. All session cookies. I see gtm_auth is set with Secure attribute (SameSite attribute is empty). The other two cookies do not have either attribute set.

They are classified as analytical cookies, not marketing cookies, by the way.

Using Google Tag Manager, how do I set or modify these cookies? I'm not looking to update the cookies in my code. I imagine adding cookie attributes should be doable using Google Tag Manager. What is Google's stance on how to address this with Google Analytics and Google Tag Manager?

Answer

rowan_m picture rowan_m · Oct 15, 2019

For any of these warnings, if you are not responsible for the domain then you are not responsible for updating the cookies. The Google Tag Manager team will be responsible for updating the relevant code that sets the SameSite attributes for cookies from googletagmanager.com.

At this point, the warnings are purely informational and are not impacting functionality. Enforcing this behaviour in stable Chrome is not scheduled until M80, currently targeted for Feb 2020.

Related questions

what are the values in _ga cookie?

I am using universal analytics. universal analytics creates first party cookie _ga _ga=1.2.286403989.1366364567; 286403989 is clientId 1366364567 is timestamp what is 1 and 2 in _ga cookie?

Read More
Is there a setting on Google Analytics to suppress use of cookies for users who have not yet given consent

According to EU Article 5(3) of the E-Privacy Directive (a.k.a 'The Cookie Laws'), web sites that target EU users have to gain opt-in consent from users before they set a cookie. See ICO Guidance I am trying to square …

Read More
google analytics - multiple trackers on one page (cookie conflict)

I'm writing a web application that's supposed to be embedded in other people's websites (kind of a widget). I'm using Google Analytics to track all the people that visit all instances of my script on the embedding websites. The problem …

Read More