Google Tag Gateway (GTG) and consent

What Google tag gateway does, how it can break consent timing, how to check whether your tag is enrolled, and the configurations Google recommends.

Google tag gateway for advertisers (GTG) is Google's way of serving the Google tag through your own domain. This page explains what that changes for consent, how to check whether your site is enrolled, and which configuration keeps your consent signals correct.

What is Google tag gateway?

Normally the Google tag (gtag.js or Google Tag Manager) loads from googletagmanager.com, and measurement data goes to Google's domains. With GTG, both are served through a reserved path on your own domain (the "measurement path"). Your CDN or server forwards requests on that path to Google, so to the browser everything looks first-party.

Google offers several ways to enable it: a one-click integration inside your CDN (Cloudflare, with Fastly and Akamai following), Google Cloud Load Balancer, server-side Google Tag Manager, or a manual setup on any CDN. See About Google tag gateway for advertisers and the implementation flow.

Consent Mode only works when the default consent state is set before any Google tag runs. Conzent normally guarantees this by loading first in your page's <head>.

The one-click CDN integration changes that. The CDN deploys and serves the Google tag at the infrastructure level, outside your page's HTML, which often prevents you from controlling the order scripts load in. The Google tag can then start before Conzent has set the consent defaults. Google flags this as a "late" consent signal, and Google's own setup documentation notes that enabling the gateway affects tag firing behavior and that consent settings should be reviewed (set up Google tag gateway with Cloudflare).

How to check if your tag is enrolled in GTG

  1. Google tag settings. Open your Google tag's admin screen: in Google Ads under Tools > Data manager > Google tag > Admin, in Google Analytics under Admin > Data streams > your stream > Configure tag settings > Admin, or in Tag Manager under Admin. The "Google tag gateway" section lists each domain with a status: First-party (active), Not started, Paused, or Pending. "Manage domains" also shows gateways activated from the CDN side, so you can see enrollment even if it was switched on in Cloudflare rather than in Google's interface.
  2. Browser developer tools. With GTG active, the Google tag and its hits load from your own domain under the measurement path instead of googletagmanager.com and google-analytics.com. In the network tab, look for requests like yoursite.com/<path>/g/collect.
  3. Health check. If you know the measurement path, https://yoursite.com/<path>/healthy returns "ok" when the gateway is live (setup guide).
  4. Your CDN. In Cloudflare, check Tag Management > Google Tag Gateway for your domain.
  5. Tag Assistant. On tagassistant.google.com, the Hits Sent output shows whether hits route through your measurement path.
  • Tag Assistant warns when a tag fired before the consent default was set, and its Consent tab shows whether the default arrived before the first tag.
  • Tag Diagnostics, found under your Google tag's settings in Google Ads, Analytics, or Tag Manager, reports "Consent mode installation out of order". See Tag Diagnostics and troubleshoot consent mode.

If you have verified GTG enrollment and see a late consent signal, use one of these three configurations:

1. Advanced consent mode with data transmission controls (recommended). Advanced consent mode, sometimes written U+C (unconditional load plus consent mode), loads Google tags immediately with every consent signal denied by default. Until the visitor consents, only cookieless pings are sent; full measurement starts after consent. Because the denied defaults are enforced by the tag itself, the load order problem disappears. Pair it with two settings in your Google tag configuration, according to your needs: data transmission controls, which restrict what the tag transmits while consent is denied, and global consent defaults in the Google tag settings, which set denied defaults per region centrally instead of relying on on-page code.

2. Move every tag into Google Tag Manager and deploy GTM through GTG. With all tags in one container, your consent configuration applies uniformly inside it, and the container itself is served through the gateway.

3. Set up GTG manually and keep control of the load order. The manual setup keeps the tag snippet in your page, pointed at your measurement path. You decide the script order: Conzent first, then the Google tag.

Advanced consent mode (U+C) is the mechanism Google recommends for GTG-enabled tags. It is compatible with every GTG deployment method, including the manual setup, so you are not locked into one way of serving the tag. And because consent defaults are applied by the tag itself rather than by script order, it keeps your consent signals correct even when the gateway loads the tag before your page scripts run.

Conzent supports advanced consent mode out of the box. See Google Consent Mode v2 for the exact consent signals Conzent sends, or contact support if you want help checking your setup.

Google documentation