Domain, path, SameSite attributes, and browser behavior affect scope. Typical GA4 web setups use first-party cookies such as _ga.
Browser restrictions or user deletion can shorten the configured lifetime. Server issuance does not guarantee a two-year lifetime or bypass all restrictions, and first-party status alone does not determine consent requirements.