> For the complete documentation index, see [llms.txt](https://docs.didomi.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.didomi.io/integrations/google/google-tag-gateway.md).

# Google Tag Gateway

Google Tag Gateway (GTG) is a feature in Google Tag Manager that changes how Google tags (e.g. `gtm.js` and `gtag.js`) are loaded on your website. Once successfully configured, Google tags will be routed through your organization's content delivery network (CDN) provider via a subdomain that you configure (e.g. `tags.yourdomain.com`).

These tags will be served from your own domain as first-party scripts rather than from `googletagmanager.com` so that they are less likely to be blocked by browsers and extensions that restrict third-party domains. In this article, we will cover:

* [Prerequisites](#prerequisites)
* [Enable Google Tag Gateway (GTG)](#enable-google-tag-gateway-gtg)
* [Google Consent Mode v2 signal verification with GTG](#google-consent-mode-v2-signal-verification-with-gtg)
* [Resolve late consent warning](#resolve-late-consent-warning)

***

### Prerequisites

Before continuing with the steps included in this article, please ensure that your website meets the following criteria:

* Google Tag Manager container
* Google Tag Gateway compatible CDN or load balancer

### Enable Google Tag Gateway (GTG)

{% hint style="info" %}
Additional information on enabling Google Tag Gateway is available [here](https://developers.google.com/tag-platform/tag-manager/gateway).
{% endhint %}

Google Tag Gateway is enabled directly from your organization's Google Tag Manager account for each respective container. 

Navigate to Google Tag Manager and select a container from your organization's list. 

<figure><img src="/files/vlmleZf2Iud25dNK9J1S" alt="" width="563"><figcaption></figcaption></figure>

Click the **Admin** tab for the selected container.

<figure><img src="/files/IIotgXRGLNEy2yqJRAwT" alt="" width="563"><figcaption></figcaption></figure>

From the Admin page of the container, navigate to the right-hand card and select **Google tag gateway**.

<figure><img src="/files/vGb9Uy3stfpJ8iWZFpF7" alt="" width="563"><figcaption></figcaption></figure>

Review the introduction and follow the provided steps to check and configure a platform (e.g. content delivery network or load balancer) that your website utilizes and is compatible with Google Tag Gateway.

<figure><img src="/files/cllJiMn95fCjimxpFUfV" alt="" width="563"><figcaption></figcaption></figure>

Once a compatible platform is configured, Google tag gateway will be set to **Active**.

{% hint style="info" %}
Your organization can check if Google tag manager is active on its website by opening the browser's developer tools and navigating to the **Network** tab. Search for the `gtm.js` request and ensure that they are served from a subdomain of your own domain instead of `googletagmanager.com`.
{% endhint %}

<figure><img src="/files/y9aKCi3QvLjkgJtwYL5m" alt="" width="563"><figcaption></figcaption></figure>

### Google Consent Mode v2 signal verification with GTG

The Didomi Consent Management Platform (CMP) comes with a compliance scanner that checks whether your organization's [Google Consent Mode v2 ](/consent-management-platform-cmp/frameworks-regulations/google-consent-mode-v2.md)signals are correctly set and respond to end-user selections on its pages (if the integration is enabled on the consent notice).

When Google Consent Mode v2 and Google Tag Gateway are both configured on the same website Didomi will check the following:

<table><thead><tr><th width="246.1334228515625">Check</th><th>Description</th></tr></thead><tbody><tr><td>Default Google consent types</td><td><p>Check if the following Google Consent Mode v2 consent types are present in the <code>dataLayer</code>:</p><ul><li><code>ad_storage</code></li><li><code>analytics_storage</code></li><li><code>ad_user_data</code></li><li><code>ad_personalization</code></li></ul></td></tr><tr><td>Google consent type status change</td><td>Check if the consent status for Google Consent Mode v2 consent types reflect the selections made by the end-user on purposes in the consent notice</td></tr><tr><td>Google Consent Mode v2 mode</td><td>Check whether the Google Consent Mode v2 integration is leveraging Basic or Advanced mode</td></tr><tr><td>Consent initialization order</td><td><p>Check that end-user consent is set before tags are fired. </p><div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Note</strong>: Google Tag Gateway can cause tags to fire prematurely before end-user consent is set <strong>regardless</strong> of whether Google Consent Mode v2 is integrated into the consent notice or not. </p><p>While this issue is not specific to Google Consent Mode v2, the Didomi compliance scanner can only warn against late consent while using Google Tag Gateway and Google Consent Mode v2 together to compare signal timing.</p></div></td></tr></tbody></table>

### Resolve late consent warning

A late consent warning from the Didomi compliance scanner on a website where Google Tag Gateway and Google Consent Mode v2 is enabled indicates that Google tags are executing before end-user consent has been set. In this section, we will cover how to diagnose and resolve the Didomi compliance scanner warning regarding a late consent.

* [Validation](#validation)
* [Resolution](#resolution)

#### Validation

Expand the following accordions to validate the late consent warning against each scenario.

<details>

<summary>Google Tag Gateway active in Google Tag Manager container?</summary>

To start, your organization will want to verify whether Google Tag Gateway is involved in the late consent warning by confirming if it is indeed enabled in the container used on the website.

Navigate to Google Tag Manager and select the container deployed on the website from your organization's list.&#x20;

<figure><img src="/files/vlmleZf2Iud25dNK9J1S" alt="" width="563"><figcaption></figcaption></figure>

Click the **Admin** tab for the selected container.

<figure><img src="/files/IIotgXRGLNEy2yqJRAwT" alt="" width="563"><figcaption></figcaption></figure>

From the Admin page of the container, navigate to the right-hand card and check if **Google tag gateway** is active on the container.

<figure><img src="/files/G18MrSPWujpJdTsSKJWI" alt="" width="563"><figcaption></figcaption></figure>

<table><thead><tr><th width="103.86663818359375">Active?</th><th>Description</th></tr></thead><tbody><tr><td>Yes</td><td>Continue to the <a href="#tag-loading-late-via-google-tag-gateway">Tag loading late via Google Tag Gateway</a> validation step</td></tr><tr><td>No</td><td>If Google Tag Gateway is not active on the website then the issue for a late consent warning from the Didomi compliance scanner is most likely attributed to the placement of your Didomi script tag placement.<br><br>The most common fix is to ensure that the Didomi script tag is set before the Google Tag Manager container script in the <code>&#x3C;head></code> tags of your website. Contact Didomi support if the issue persists for your website.</td></tr></tbody></table>

</details>

<details>

<summary>Tag loading late via Google Tag Gateway?</summary>

If Google Tag Gateway is active for the Google Tag Manager container deployed on the website then your organization should then confirm the domain from which the `gtm.js` request comes.

Navigate to your website and open the browser's developer tools and navigate to the **Network** tab and reload the page.&#x20;

<figure><img src="/files/8m61S3m5xpjoql6HQpdU" alt="" width="563"><figcaption></figcaption></figure>

Search for the `gtm.js` request and check the domain from which the request comes.

<table><thead><tr><th width="245.933349609375">Domain</th><th></th></tr></thead><tbody><tr><td><code>googletagmanager.com</code></td><td>Google Tag Gateway is not in the path for this tag.<br><br>The most common fix is to ensure that the Didomi script tag is set before the Google Tag Manager container script in the <code>&#x3C;head></code> tags of your website. Contact Didomi support if the issue persists for your website.</td></tr><tr><td>Your organization's domain (e.g. <code>tags.yourdomain.com</code>)</td><td>Google Tag Gateway is active and routing this tag. See the <a href="#resolution">Resolution</a> section for ways to remediate the problem.</td></tr></tbody></table>

Cross-reference late tag firings identified by the Didomi compliance scanner with requests in the Network tab.

</details>

The following table summarizes potential next steps based on the findings from your validation scenarios:

<table><thead><tr><th width="366.5333251953125">Findings</th><th>Next steps</th></tr></thead><tbody><tr><td>GTG not active </td><td>Late consent warning is caused by load order and not Google Tag Gateway.<br><br>Ensure that the Didomi script tag is set before the Google Tag Manager container script in the <code>&#x3C;head></code> tags of your website. Contact Didomi support if the issue persists for your website.</td></tr><tr><td>GTG active + late tag loads via <code>googletagmanager.com</code></td><td>Google Tag Gateway is not in the path for this tag. There can potentially be another issue.<br><br>Ensure that the Didomi script tag is set before the Google Tag Manager container script in the <code>&#x3C;head></code> tags of your website. Contact Didomi support if the issue persists for your website.</td></tr><tr><td>GTG active + late tag loads from your domain</td><td>See <a href="#resolution">Resolution</a> for options to remediate issue</td></tr></tbody></table>

#### Resolution

In order to remediate a late consent warning your organization will need to ensure correct consent signal timing with Google Tag Manager. There are two methods to remediate this issue depending on your CDN provider and setup:

* [Deactivate Cloudflare "Setup the tag"](#deactivate-cloudflare-setup-the-tag)
* [Manual Google Tag Gateway configuration](#manual-google-tag-gateway-configuration)

{% hint style="info" %}
**Basic Consent Mode**

If your organization utilizes [Google Consent Mode v2 (Basic)](/consent-management-platform-cmp/frameworks-regulations/google-consent-mode-v2/google-consent-mode-v2-basic-gdpr.md), it is recommend to enable **DTCs (Data Transmission Controls)** alongside either method below. DTCs limit what behavioral and configuration data Google receives when end-user consent is not yet established.
{% endhint %}

#### Deactivate Cloudflare "Setup the tag"

If your organization leverages Cloudflare as your Google Tag Gateway CDN provider, deactivating the **Setup the tag** feature deactivates CDN-level automatic script injection. When deactivated, script will load only via your on-page `<script>` tags so that the order your organization defines in your HTML will be respected.

This solution is a low-effort fix for Cloudflare customers who already have Didomi loading before their Google Tag Manager script in the website's `<head>` tags.

{% stepper %}
{% step %}
Navigate to Cloudflare's Google Tag Gateway configuration and deactivate the **Setup the tag** (or equivalent automatic injection) setting
{% endstep %}

{% step %}
Confirm that Didomi script tag is placed before the Google Tag Manager container script in the website's `<head>` tag.
{% endstep %}

{% step %}
Verify the load order resolves the Didomi compliance scanner warning
{% endstep %}
{% endstepper %}

#### Manual Google Tag Gateway configuration

This remediation method configures Google Tag Gateway manually without utilizing your organization's CDN provider's automated tag injection. In order to perform this configuration, you will set up the subdomain routing yourself and update your `gtag` snippet to load from your first-party endpoint. (e.g. `<script async src="/metrics/">`).&#x20;

This solution is a high effort fix for a publisher who wants maximum control over load order and is comfortable with custom CDN configuration.

{% stepper %}
{% step %}
Set up CDN routing rules manually for your `tag.yourdomain.com` subdomain
{% endstep %}

{% step %}
Update `gtag` or `gtm` snippet to reference the first-party endpoint
{% endstep %}

{% step %}
Load Didomi before the Google Tag Manager script, or use an async loader that initializes Didomi first
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.didomi.io/integrations/google/google-tag-gateway.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.