Keys are 128, 192 or 256 bits. With the standard 96-bit IV the counter allows up to 2³² − 2 blocks (about 64 GiB) per message. SP 800-38D requires that IVs never repeat under one key and limits randomly generated 96-bit IVs to 2³² invocations per key, so long-lived keys use counters or rekey.
A repeated nonce is catastrophic: it leaks the XOR of the two plaintexts and lets an attacker recover the GHASH key and forge tags for any message under that key. Tags shorter than 128 bits weaken forgery resistance and are best avoided. AES-GCM-SIV (RFC 8452) is the misuse-resistant variant.
With AES and carry-less multiplication instructions it is extremely fast: on one Apple M4 Max core, OpenSSL 3.6.5 encrypts about 10.4 GB/s with AES-128-GCM and 8.8 GB/s with AES-256-GCM on 16 KiB buffers. Identifiers: TLS 1.3 suites TLS_AES_128_GCM_SHA256 (0x1301) and TLS_AES_256_GCM_SHA384 (0x1302), JWE enc A128GCM and A256GCM, key wrap A256GCMKW, WebCrypto AES-GCM.