what are the values in _ga cookie?

I think this would be helpful.

/**
 * Get Google Analytics UID
 * @return int
 */
public function getGAUID() {
    $uid = 0;
    if ($_COOKIE['__utma'])
        list($hash_domain, $uid, $first_visit, $prew_visit, $time_start, $num_visits) = sscanf($_COOKIE['__utma'], '%d.%d.%d.%d.%d.%d');
    elseif ($_COOKIE['_ga'])
        list($c_format, $c_domain, $uid, $first_visit) = sscanf($_COOKIE['_ga'], 'GA%d.%d.%d.%d');

    return $uid;
}

_ga=1.2.286403989.1366364567;

1st Field

This is a versioning number. In case the cookie format changes in the future. Seems to be fixed at 1 at the moment. The one above is an old format. Newer cookies have this value set at "GA1"

2nd Field

This field is used to figure out the correct cookie in case multiple cookies are setup in different paths or domains.

By default cookie are setup at path / and at the domain on document.location.hostname (with the www. prefix removed).

You could have a _ga cookie set at sub.example.com and another cookie set at example.com. Because the way the cookie API on browsers works there's no way to tell which is the correct cookie you use.

So the second number is the number of components (dot separated) at the domain.

• for sub.example.com the number would be 3
• for example.com the number would be 2

The path defaults to / but you can also change it by passing the cookiePath option to the ga.create method. If you pass it this field becomes 2 numbers dash separated. And the second number is the number slashes in the path.

Using these numbers the analytics.js script can correctly identify the cookie to be used in case there are multiple cookies set.

eg: Imagine that you have a site that lives at sub1.sub2.example.com/folder1 in case you want to store the cookie only on your site and not make it visible to other subdomains or folders you can use the following configs:

ga('create', 'UA-XXXX-Y', {
  'cookiePath': '/folder1/',
  'cookieDomain': 'sub1.sub2.example.com'
});

In this case the cookie will look somoething like this;

_ga=1.4-2.XXXXXXXX.YYYYYYY

3rd Field

This is a random generated user ID. Used to identify different users.

4th Field

It's a timestamp of the first time the cookie was set for that user.

new Date(1366364567*1000)
> Fri Apr 19 2013 06:42:47 GMT-0300 (BRT)

This is also used to uniquely identify users in case of userId collisions.

Worth mentioning that a cookie is not an API. In the future it may completely change. Google doesn't recommend reading/writing the _ga cookie directly. You should interact with Google Analytics through one of the tracking libraries such as analytics.js. There's not a lot of use for this information other than curiosity.

If you are reading/writing directly the cookie you are doing it wrong.