The following document outlines the Cookies used and their purpose.
The __cfduid cookie
This Cookie is used to override any security restrictions based on the IP address the visitor is coming from. For example, if the visitor is in a coffee shop where there are a bunch of infected machines, but the visitor’s machine is known trusted, then the cookie can override the security setting. It does not correspond to any userid in the web application, nor does the cookie store any personally identifiable information.
The __utma Cookie
This cookie is what’s called a “persistent” cookie, as in, it never expires (technically, it does expire…in the year 2038…but for the sake of explanation, let’s pretend that it never expires, ever). This cookie keeps track of the number of times a visitor has been to the site pertaining to the cookie, when their first visit was, and when their last visit occurred. Google Analytics uses the information from this cookie to calculate things like Days and Visits to purchase.
The __utmz Cookie
__utmz keeps track of where the visitor came from, what search engine you used, what link you clicked on, what keyword you used, and where they were in the world when you accessed a website. It expires in 15,768,000 seconds – or, in 6 months. This cookie is how Google Analytics knows to whom and to what source / medium / keyword to assign the credit for a Goal Conversion or an E-commerce Transaction. __utmz also lets you edit its length with a simple customisation to the Google Analytics Tracking code.
The _ga cookie
default, the analytics.js library uses a single cookie named _ga to store a unique client identifier (Client ID), which is a randomly generated number. Once the ID is generated it’s stored in the cookie and is included with each hit / request sent to Google Analytics. This ID is later used by Google Analytics servers to calculate user, session, and campaign data.
The _gat cookie
The _gat global object is used to create and retrieve tracker objects, from which all other methods are invoked. Therefore the methods in this list should be run only off a tracker object created using the _gat global variable. All other methods should be called using the _gaq global object for asynchronous tracking.