Google Tag Gateway for Advertisers: First-Party Tags Without a Server

Every page load asks the browser to fetch two things from a Google domain. The tag library comes from a googletagmanager.com host, and once it runs, the measurement requests go the same way. That arrangement is convenient, and it is also the reason a chunk of your traffic never reaches GA4 or Google Ads.

Ad blockers, tracking protection lists and browser privacy features are built to recognise third-party hosts on sight. A request to a Google domain is an easy target. A request to the visitor's own site is much harder to flag, and that is the idea behind Google tag gateway for advertisers.

The name has changed twice. It arrived in 2025 as first-party mode and became Google tag gateway for advertisers in the Tag Manager release notes for 8 May 2025. The work since then has been plumbing: Akamai support on 29 January 2026, Cloudflare's direct integration as Google's launch partner, guided Akamai and Fastly setups on 14 May 2026, Google Cloud Platform to general availability on 1 June 2026, and Amazon CloudFront on 3 June 2026.

What used to need a subdomain, an origin rule and a transform rule now takes a few clicks in Tag Assistant or the Cloudflare dashboard. That is a good reason to look again, and to be precise about what it does before promising anything to a client.

What the gateway changes on the wire

The standard setup asks the browser for https://www.googletagmanager.com/gtag/js?id=G-12345, then the tag sends hits to Google's collection endpoints. With the gateway in place, the same page loads the tag from a path on your own domain, for example https://example.com/metrics/, and measurement requests go to that path instead. Your CDN or load balancer receives them, rewrites the host to Google's gateway endpoint and forwards the request.

The routing is unglamorous. A standalone tag such as G-12345 forwards to g-12345.fps.goog, and a container forwards to a host named after its ID, so GTM-ABCDEF resolves to gtm-abcdef.fps.goog. The proxy keeps the query string, normalises the Origin and Referer headers, and attaches the country, region and geolocation headers a first-party request cannot carry on its own.

Google's wording is careful here. The gateway serves the tag from your domain and routes some measurement requests through it, which is not a claim that every byte of the session is first-party. What does change is where the script and its cookies live. Because the tag is delivered from your domain, the cookies it sets are created under your domain, which removes one of the signals blockers use to treat a request as third-party.

The other change is the measurement path. Each container or standalone tag needs its own unused path on the site. If everything runs inside one GTM container, one path covers every tag in it, GA4 and Google Ads included. Separate containers, or a mix of a container and an unlinked Google tag, need a separate path each. Pick something boring such as /metrics or /gtm, and check it is not already serving a page.

The four ways to deploy it

The route depends on who controls the CDN. All four produce the same architecture, so choose the one your team can maintain.

Cloudflare, through Google's interface

This is the fastest path and the one most agencies will use. In your GTM container, open Admin and select Google tag gateway, confirm the measurement path, sign in to Cloudflare and pick the domains. The account needs Super administrator, Administrator or Zaraz admin rights, or Domain administrator if you use domain-scoped roles.

Cloudflare describes the feature as free on any plan, and requests routed through the gateway do not count toward CDN, WAF or Bot Management usage. Its beta testers reported an average uplift of about 11% in data signals, which is a vendor figure measured on Cloudflare's own traffic, not a forecast for your client.

Other CDNs, through guided setup

Akamai and Fastly integrations arrived in May 2026, CloudFront in June 2026, and the Google Cloud Platform integration uses a Global external Application Load Balancer. Google detects the CDN zones and injects the routing rules, including the geolocation headers, so nobody has to hand-edit a Fastly VCL snippet or an Akamai property rule.

Manual configuration

Self-service setup is the answer when your provider has no integration, when the CDN account is not compatible, or when infrastructure sits with a client's IT team. Google publishes configuration steps for Cloudflare Snippets, Akamai, CloudFront, Fastly and Google Cloud, plus a generic recipe for any CDN, load balancer or web server that can route by path and forward headers. This route means you own the config, the verification and the monitoring.

Server-side tagging, if you already run it

Server-side Tag Manager already serves the web container from your own domain, so sites running it are not the target audience. The gateway gives most of the same first-party benefit to teams that do not want a server to maintain.

The step agencies skip: re-tagging

An in-UI integration can rewrite the scripts for you, but only on the automatic path. Google's documentation is explicit that automated setup inserts the new script only when a page has no tag, which is typical for a brand new installation and rare on a site that has been measuring for years.

Self-service setup always needs manual work, and the difference is a single attribute. For a standalone tag, the head section changes from the googletagmanager.com source to /metrics/. For a container, the loader's script source changes to /metrics/?id= followed by the container ID. If that edit is skipped on any template, the browser keeps requesting the tag straight from Google, the gateway never sees the request, and the site looks half-migrated with no error anywhere.

Two details cause the most support tickets. If you use consent mode, Google instructs you to turn automated script setup off, so the platform does not drop a tag into a page behind your CMP's back. And old snippets hide in places nobody audits: a hard-coded tag in a WordPress plugin, a landing page builder with its own settings panel, a legacy footer include. Any page still loading the original script bypasses the gateway.

Then verify the route rather than trusting the dashboard. https://example.com/metrics/healthy returns the word ok, and adding ?validate_geo=healthy confirms the geolocation headers are arriving. In Tag Assistant, open Summary, then Output, then Hits sent, and check the hits are routed to the measurement path.

Consent in the UK: what the gateway does not change

This is where clients get the wrong idea, so it is worth stating plainly. The gateway changes where the tag is served from. It does not change what is collected, who receives it, or whether you are allowed to collect it.

Google's documentation says enabling the feature affects tag firing behaviour and tells you to adopt consent mode and review your consent settings if user consent drives your tags. Consent mode still has to be implemented, the default still has to be denied before a decision arrives, and your CMP still has to be wired into it. Routing a request through your own domain does not make the data collection first-party in any legal sense. Google is still the recipient of the analytics and advertising signals, and PECR still governs storing or reading information on a visitor's device. Your privacy notice, your record of processing and your Google processor terms all stay in place.

The honest pitch is measurement recovery on a site that is already compliant. If a client asks whether the gateway removes the need for a consent banner, the answer is no, and it is better to say that in the proposal than after the first complaint.

What the gateway does not fix

• Google tags only. It covers GA4 web, Google Ads conversion and remarketing tags, and Floodlight. Third-party marketing tags on the same page keep loading and sending as they did before.
• It is not an ad-blocker bypass. Independent testing in 2026 found uBlock Origin Lite, DuckDuckGo Privacy Essentials, AdBlocker Ultimate and Ghostery still blocking measurement with the gateway running, while the standard configuration passed. Blockers that match on request patterns rather than domain reputation keep working.
• It does not replace server-side GTM. Server-side gives you control over payloads, transformations, and data going to destinations that are not Google. The gateway gives Google's own tags a first-party route and stops there.
• It does not repair history. Data already lost to blockers stays lost. The gateway affects collection from the moment it goes live.
• It does not promise a percentage. Recovery depends on how much of your audience was blocking. A B2B site with desktop-heavy traffic will see less movement than a consumer site with heavy blocker use.

Where it is worth the afternoon

The gateway fits well when the site already sits behind Cloudflare or another supported CDN, consent mode is implemented properly, and a meaningful share of the audience blocks third-party requests. If the client has asked why Google Ads reports fewer conversions than their CRM, first-party delivery is one of the few fixes that needs no infrastructure to run.

It fits badly when nobody controls the CDN, when consent setup is shaky, or when the site needs control over what leaves the browser. Fix consent first. Measurement recovery on top of a broken consent implementation means more data leaving through a route you have not reviewed.

Monitoring after launch

Once the gateway is live, the Google tag gateway screen in the GTM container is the place to watch. Each domain carries a status: first-party, not started, paused, or pending, where pending means the configuration exists but no diagnostic data has arrived. Tag Manager has shown the active status since the 30 September 2025 release, so it is not a daily check, but it is the first place to look when something stops.

Two configuration facts cause most post-launch confusion. On Cloudflare the setting is zone-level, so enabling it for example.com covers every hostname and subdomain in that zone, and configuration rules cannot exclude one. Per-subdomain behaviour has to be handled with GTM triggers, such as a Page Hostname condition on shop.example.com. Deleting the configuration detaches Cloudflare and disables the gateway for every active domain at once, and reconnecting means a fresh Cloudflare connection.

Give the change a two-week comparison window. Sessions by hostname, conversion counts in GA4 and Google Ads, and a check for duplicate hits if old snippets were left on a template. First-party delivery changes what arrives. It should not change the shape of the reporting, and if it does, the setup is wrong.

The short version

Google tag gateway for advertisers moved from an infrastructure project to a checkbox exercise in 2026, and for sites already behind a supported CDN it is worth doing. It serves Google's tags from your own domain, keeps the tag's cookies on your domain, and recovers measurement that blockers were quietly discarding.

It is not a consent workaround, it does not cover non-Google tags, and a half-finished script replacement leaves you with the dashboard green and the data unchanged. Verify the measurement path, check where the hits actually go, and tell the client what it does not do before you tell them what it does.