Standard ratio of cookies to "visitors"?
There's another factor at play with Quantcast undercounting: They use third-party cookies (cookies served from the .quantserve.com domain), whereas Google Analytics uses first-party cookies (stackexchange.com, etc.)
This is pretty crucial, as some browsers (particularly Safari, but more recently Firefox and Chrome) disable third-party cookies as the default setting, and many others may individually choose privacy settings that bar third-party cookies. This means there is a subset of the population that will never get tracked by QuantCast's cookies. Inherently, that means Google Analytics will always return a higher visitor count.
I'd say there is no rule of thumb. As an analytics practitioner, I'd say that the quest for a 'true' visitor count is hopeless, and instead focus on the visits themselves. For example, to your Google Analytics account, I'm at least 8 different visitors, having accessed StackOverflow from Chrome, Safari and Firefox on my work laptop, my personal laptop, my phone, and my iPad. Analytics services all count in different ways, and thus all return significantly different numbers.
Even with perfect implementation, Google Analytics will almost always show lower visit counts than a server-log based analytics system, but will show higher visit count than a third-party cookie based system like Quantcast. The important thing isn't to look at the raw totals, but the trends that each method shows in its strengths. So, never compare Quantcast numbers to Google Analytics numbers; instead, use the numbers within the contexts in which they were collected.
Another issue could be that your Google Analytics implementation isn't correct, since configuring it for your kind of multiple-domain-and-subdomain setup can be a nightmare if not done correctly and rigorously, which could lead to a single browser being counted as multiple visitors, itself inflating your count. This is never an issue for Quantcast, as all cookies are set at their one third party domain.
Quantcast emailed me:
You mentioned that there was a fairly substantial delta between your GA numbers and your QC numbers. While this doesn’t happen often, it does happen and there are several reasons this can occur. For instance, we account for 3rd party cookies and auto-refreshes and GA does not. We also ask that publishers to place our tag near the bottom of the page to comply with MRC and IAB standards. If your other measurement tags are higher on the page, they could fire when Quantcast’s does not. (We are the only MRC accredited traffic measurement service). Also, the numbers are never going to be exactly the same because of time zone considerations - we use a normalizing function and GA’s is fixed.
If you would like to learn more about how we determine our numbers, please check out: http://www.quantcast.com/how-we-do-it. We also have white papers on our cookie-corrected audience data and our methodology located here.
Perusing the white papers I see that they are, actually, doing what Jeff suggests: fudging the "official" numbers to get something that they think is closer to the true number of people. They have a Cookie Corrected Audience White Paper (PDF link) which implies that their system is rather elaborate, not as simple as just dividing by a magic number:
The Quantcast Quantified Publisher program captures over 75 billion media consumption events every month, generated by more than 1.4 billion cookies (data as of June, 2008). What’s more, many of our Quantified Publisher partners share anonymous identifiers with us that are independent of cookies. Our model also includes several panels which provide for people-based reference points and calibration which are free of cookie deletion. We triangulate across this mass of data with different collection processes, biases and issues. Our models take into account visit frequency, time periods, the likelihood of multiple computer usage and even the impact of multiple people using the same computer to deliver people based estimates. Our model for translating unique cookies to people has been validated using hold-out samples and independent data sets. Further, our model is dynamic and recalibrated on an ongoing basis to reflect the evolving nature of Internet traffic patterns.
The ratio of cookies to unique visitors is usually between 1.3 and 1.7 for sites with over a million visits.
While yc01 is correct that GA uses first-party cookies vs third-party cookies, we at RealSelf.com use two first-party analytics providers (GA and Comscore Direct) and GA still shows 30% more Absolute Unique Visitors than Comscore's Unique Visitors.
Comscore only shows unique visitors by country, so to compare GA to Comscore we have to calculate the number of US-based absolute unique visitors as follows:
US Visits / Global Visits * Absolute Unique Users
(1,150,110 / 1,650,979) * 1,273,059 = 886,842 US-based Unique Users
In contrast, Comscore reports 680,900 US-based Unique Users. So GA shows 30.2% more.
Comscore has built their business around trying to be accurate, while GA is primarily a free way to track and optimize sites that use AdWords and AdSense. Comscore has a panel of people that they also use to estimate traffic, and they use that panel to determine an average number of cookies per person. With more people using mobile devices (our mobile usage is 15%), it makes sense that unique cookies overstate the number of unique people.