Vendors & measurement
Unauthorized cookies on Google domains
- Ad Manager API value
- UNAUTHORIZED_COOKIE_DETECTED
What Google's rule says
Authorized Buyers states that the ad sets an unauthorized cookie on a Google domain such as googlesyndication.com or doubleclick.net. The Ad Manager API records the same condition as UNAUTHORIZED_COOKIE_DETECTED.
What actually causes it
- A script setting a cookie without specifying a domain, so it lands on whatever host the frame came from.
- A frequency or sequencing library written for first-party use and dropped into a served creative.
- A vendor tag storing state locally because its own third-party cookie was blocked.
- Code carried over from a page-level deployment where the same call was perfectly correct.
How to fix it
Load the creative and inspect which domain each cookie was written to, not just how many were written. Anything on googlesyndication.com or doubleclick.net has to go — those are the two hosts Google names.
The part that is not obvious
The mechanism is almost always accidental, and it follows from where the creative runs. A served creative executes inside a frame from a Google ad-serving domain, so a script that calls document.cookie without naming a domain writes to that Google host by default — it does not have to target Google to hit it. That is why this violation shows up on code that behaves impeccably on a publisher's own page: moving the same script into an ad frame changes the domain it writes to without changing a line of it.
Related reasons
Reason name and API value verified against Common ad disapproval reasons — Authorized Buyers Help on 30 July 2026 (Ad Manager SOAP API v202602). The causes and fix above are practitioner guidance, not Google policy text.