Google Tag Gateway: Serving Google Tags From Your Own Domain

The sources are Google's developer documentation (Google tag gateway for advertisers, Set up Google tag gateway for advertisers and the Google tag gateway guide), two Tag Manager Help articles (set up in the Google tag with Cloudflare and set up in Google Tag Manager with Cloudflare), Google's Google Ads announcement, and the Cloudflare documentation that Google's Cloudflare set-up depends on. How Tag Manager itself works is in our Google Tag Manager basics guide; this page only covers the gateway.

What the gateway changes

Google describes the normal set-up like this: In standard Google tag setups, your web page requests a Google tag from a Google domain. When the tag fires, it sends measurement requests directly to the Google product. With the gateway, your website loads the Google tag from your first-party domain. When the tag fires, some measurement requests will be sent to Google using your first-party domain.

In practice you reserve a path on your own site, such as /metrics/. Your CDN, load balancer or web server sends anything on that path to Google's gateway endpoint, and the tag script and its requests appear to the browser as coming from your domain. Google says you can set it up using your existing Content Delivery Network (CDN), load balancer, or web server. Before you start, Google expects you to already have a Google tag or a Tag Manager container on the site, plus a content delivery network (CDN) or load balancer that can forward requests to external endpoints.

The gateway does not replace your tags, your Tag Manager container or your conversion actions. It changes where the script loads from and which address the measurement requests go to. If you have no tracking yet, set that up first (our Google Ads conversion tracking guide covers the conversion side).

Why Google recommends it

Google's set-up page says We recommend Google tag gateway for advertisers for the most durable tag configuration. The Google Ads announcement, dated 2 May 2025, says it helps you improve the accuracy and resilience of your measurement signals and reports that Advertisers who configured Google tag gateway for advertisers saw an 11% uplift in signals. Read that number with Google's footnote: it is Google's own data for one week in April 2025, and the uplift is based on Google tag script loads. It is not a promise about your conversions.

The same announcement said gateway tags will soon get confidential computing by default. Google did not give a date there.

If you already run server-side Tag Manager, Google's guide suggests combining the two: the CDN serves Google's scripts from your domain, and measurement goes to a separate path that routes to your server container. Google says We recommend you complete both steps for the most durable tagging setup.

Choosing a measurement path

Every tag or container needs its own path on your domain. Google's rules for it are:

• the path must not already be in use on your domain;
• it must not be the root path /;
• it must not be longer than 100 characters.

Google suggests either a random mix of letters and numbers, or a readable word such as /gtm, /metrics or /analytics. Take the warning seriously: This setup reroutes all traffic with the chosen path. If a real page lives under that path, visitors stop reaching it.

If you use Tag Manager, one container covers everything inside it. Google says the container ID is sufficient for all tags (like Google Analytics, Google Ads, etc.) that are already added to that container. You repeat the set-up, with a different path each time, only for separate containers or standalone tags (for example a G- tag that is not in a container).

The set-up routes

From the Google tag or Tag Manager (automated)

The gateway screen lives in the Google tag settings, under Admin. Google lists where to find those settings from each product:

• Google Ads: Tools, Data manager, then under Google tag click Manage and go to Admin.
• Google Analytics: Admin, Data streams, pick a stream, Configure tag settings, then Admin.
• Campaign Manager 360: Data manager under Floodlight, Manage under Google tag, then Admin.
• Google Tag Manager: the Google tags tab for a Google tag, or, for a whole container, Admin in the container.

There you choose Google tag gateway, scan your site, and Google shows the CDN it detected (Only detected CDN platforms are displayed in the scan results; Show all platforms lists the rest). With Cloudflare, the default Automated option asks you to sign into Cloudflare, choose the domains to activate and click Complete setup. Your Cloudflare user needs to be Super Administrator, Administrator or Zaraz Admin, or Domain Administrator if you use domain-scoped roles.

Guided set-up

Under More ways to set up, the Guided option gives you step-by-step instructions for your CDN instead. With Cloudflare, Tag Assistant can walk you through creating a Cloudflare Snippet, but Google notes this needs a Cloudflare Pro plan or higher.

From the Cloudflare dashboard

Cloudflare's own documentation describes a second way in: open Google Tag Gateway in the Cloudflare dashboard, pick the domain, turn it on and enter your Google tag ID and the measurement path. Cloudflare says the feature is free to use and that gateway requests do not count toward billing for its other products. Two Cloudflare notes matter here. It is set per zone, so it applies to all hostnames and subdomains within that zone, and you cannot switch it off for one subdomain (Cloudflare suggests Tag Manager triggers on Page Hostname instead). And if a GTM script is already on the site, this First Party Tag will override the existing script.

CDNs and load balancers Google documents

Google's self-service instructions cover Google Cloud's External Application Load Balancer, Cloudflare (with Snippets, which Google notes are officially supported on Cloudflare Pro plans and higher), Akamai, Amazon CloudFront and Fastly, plus an "Other" section for any CDN or load balancer. The general recipe in that section is:

1. add an origin or backend that points to your tag ID followed by .fps.goog (Google's example is G-12345.fps.goog);
2. override the Host header to that same address, and Allow all cookies and query strings to be forwarded;
3. pass the visitor's location in headers, either X-Forwarded-CountryRegion (for example US-CA) or X-Forwarded-Country plus X-Forwarded-Region;
4. add a rule that sends your path (for example /metrics/*) to that origin, with higher priority than your default rule.

For CloudFront, Google's steps set caching to CachingDisabled for the path. For Akamai, Google warns not to strip response headers, because Google scripts may fail if the Content-Type response header is missing. If your site sits behind a CDN you do not control, this is a job for whoever manages it; our hosting and CDN guide explains how that layer fits in.

Do you need to change your site code?

It depends on the route. Google's help says: The automated setup method configures your scripts automatically. You don’t need to manually re-tag your website’s code. When automated set-up is on and a page has no tag, the platform inserts the new script into the HTML.

With the guided or self-service route, you must manually re-tag your site: every Google tag script source on every page has to point to your measurement path. For gtag.js, the src of the script changes from www.googletagmanager.com/gtag/js?id=... to your path; for Tag Manager, the path goes into the container snippet. If you skip this, Google says the browser will continue to request scripts directly from Google, bypassing Google tag gateway for advertisers entirely.

One exception: the gateway does not support the <noscript> snippet. If you use the Tag Manager noscript fallback, keep it pointing to www.googletagmanager.com.

Consent: what changes and what does not

Google puts a warning in both Cloudflare set-up articles: Enabling this feature affects Google tag firing behavior. If your current tag behavior is impacted by user consent actions, adopt Consent Mode and review your consent settings to ensure your preferences are respected. Google links that warning to About consent mode. The Google tag article goes further: If you use consent mode, you must turn off automated script set up.

So if your banner blocks or delays Google tags, test it again after switching the gateway on. Pay most attention to the automated route, because it can insert scripts by itself.

None of Google's or Cloudflare's pages say the gateway changes what consent you need. Cloudflare describes measurement events going to your domain, where they are forwarded to Google, so the data still ends up with Google. What your banner must ask for, and how consent mode works with it, is covered in our cookie banners and consent guide.

Checking that it works

Google gives the same checks for every CDN:

1. Open https://your-domain/your-path/healthy in a browser. The page should show ok.
2. Open https://your-domain/your-path/?validate_geo=healthy. It should also show ok, which confirms location headers are coming through. On Fastly, Google notes you may need to purge and wait a few minutes.
3. Make sure at least one tag fires, open Tag Assistant, connect to your site and click around. Under Summary, Output, Hits Sent, check the hits go to your measurement path.

In the Google tag gateway screen, each domain shows a status. Google lists First-party (active), Not started, Paused and Pending (enabled, but no diagnostic information has been received yet). For a wider check of your GA4 events after the change, see our guide to DebugView and Tag Assistant.

Managing domains and switching it off

Manage domains in the gateway screen groups your domains into tagged domains, untagged domains (Google says if you choose one, the gateway will add the missing tag automatically) and other active domains that use the gateway with a different tag or a different set-up.

To switch it off, click Configure, then Delete. Google warns this will also disable the feature for all active domains. If you re-tagged pages by hand, switch them back to the standard script first, otherwise they keep requesting a path that no longer forwards anywhere. If setup through Google keeps failing, Google's advice is to set it up from the Cloudflare side instead, or use the self-service steps.

Frequently asked questions

What is Google tag gateway for advertisers?

A Google feature that loads the Google tag from your own domain and sends some measurement requests through that domain, using your CDN, load balancer or web server, instead of the browser talking straight to a Google domain.

Does Google tag gateway cost anything?

None of the Google pages used here mention a fee. Cloudflare says its integration is free and does not count toward other Cloudflare billing, but Google notes the Cloudflare Snippets route needs a Pro plan or higher. Other CDNs bill under their own terms.

Do I need one set-up per tag?

No, not if your tags sit in one Tag Manager container: the container ID covers all tags inside it. Separate containers and standalone tags each need their own set-up and their own path.

Does it replace server-side tagging?

No. Google describes them as complementary: the gateway serves scripts from your domain, and server-side Tag Manager processes the data before it goes on. Google recommends doing both for the most durable set-up.

Does the gateway change my cookie consent needs?

Google's pages do not say so. They say the feature affects how tags fire and tell you to adopt consent mode and review consent settings. If you use consent mode, Google says to turn off automated script set-up.

The gateway changes how your tracking reaches Google, so it pays to test it alongside the site itself. See our website development service and all our services, or email [email protected].