Google Tag Gateway

Google Tag Gateway (GTG) is a feature in Google Tag Manager that changes how Google tags (e.g. gtm.js and gtag.js) are loaded on your website. Once successfully configured, Google tags will be routed through your organization's content delivery network (CDN) provider via a subdomain that you configure (e.g. tags.yourdomain.com).

These tags will be served from your own domain as first-party scripts rather than from googletagmanager.com so that they are less likely to be blocked by browsers and extensions that restrict third-party domains. In this article, we will cover:

Prerequisites

Before continuing with the steps included in this article, please ensure that your website meets the following criteria:

Google Tag Manager container
Google Tag Gateway compatible CDN or load balancer

Enable Google Tag Gateway (GTG)

Additional information on enabling Google Tag Gateway is available here.

Google Tag Gateway is enabled directly from your organization's Google Tag Manager account for each respective container.

Navigate to Google Tag Manager and select a container from your organization's list.

Click the Admin tab for the selected container.

From the Admin page of the container, navigate to the right-hand card and select Google tag gateway.

Review the introduction and follow the provided steps to check and configure a platform (e.g. content delivery network or load balancer) that your website utilizes and is compatible with Google Tag Gateway.

Once a compatible platform is configured, Google tag gateway will be set to Active.

Your organization can check if Google tag manager is active on its website by opening the browser's developer tools and navigating to the Network tab. Search for the gtm.js request and ensure that they are served from a subdomain of your own domain instead of googletagmanager.com.

The Didomi Consent Management Platform (CMP) comes with a compliance scanner that checks whether your organization's Google Consent Mode v2 signals are correctly set and respond to end-user selections on its pages (if the integration is enabled on the consent notice).

When Google Consent Mode v2 and Google Tag Gateway are both configured on the same website Didomi will check the following:

Check

Description

Default Google consent types

Check if the following Google Consent Mode v2 consent types are present in the dataLayer:

ad_storage
analytics_storage
ad_user_data
ad_personalization

Google consent type status change

Check if the consent status for Google Consent Mode v2 consent types reflect the selections made by the end-user on purposes in the consent notice

Google Consent Mode v2 mode

Check whether the Google Consent Mode v2 integration is leveraging Basic or Advanced mode

Consent initialization order

Check that end-user consent is set before tags are fired.

Note: Google Tag Gateway can cause tags to fire prematurely before end-user consent is set regardless of whether Google Consent Mode v2 is integrated into the consent notice or not.

While this issue is not specific to Google Consent Mode v2, the Didomi compliance scanner can only warn against late consent while using Google Tag Gateway and Google Consent Mode v2 together to compare signal timing.

A late consent warning from the Didomi compliance scanner on a website where Google Tag Gateway and Google Consent Mode v2 is enabled indicates that Google tags are executing before end-user consent has been set. In this section, we will cover how to diagnose and resolve the Didomi compliance scanner warning regarding a late consent.

Validation

Expand the following accordions to validate the late consent warning against each scenario.

Google Tag Gateway active in Google Tag Manager container?

To start, your organization will want to verify whether Google Tag Gateway is involved in the late consent warning by confirming if it is indeed enabled in the container used on the website.

Navigate to Google Tag Manager and select the container deployed on the website from your organization's list.

Click the Admin tab for the selected container.

From the Admin page of the container, navigate to the right-hand card and check if Google tag gateway is active on the container.

Active?

Description

Yes

Continue to the Tag loading late via Google Tag Gateway validation step

If Google Tag Gateway is not active on the website then the issue for a late consent warning from the Didomi compliance scanner is most likely attributed to the placement of your Didomi script tag placement. The most common fix is to ensure that the Didomi script tag is set before the Google Tag Manager container script in the <head> tags of your website. Contact Didomi support if the issue persists for your website.

Tag loading late via Google Tag Gateway?

If Google Tag Gateway is active for the Google Tag Manager container deployed on the website then your organization should then confirm the domain from which the gtm.js request comes.

Navigate to your website and open the browser's developer tools and navigate to the Network tab and reload the page.

Search for the gtm.js request and check the domain from which the request comes.

Domain

googletagmanager.com

Google Tag Gateway is not in the path for this tag. The most common fix is to ensure that the Didomi script tag is set before the Google Tag Manager container script in the <head> tags of your website. Contact Didomi support if the issue persists for your website.

Your organization's domain (e.g. tags.yourdomain.com)

Google Tag Gateway is active and routing this tag. See the Resolution section for ways to remediate the problem.

Cross-reference late tag firings identified by the Didomi compliance scanner with requests in the Network tab.

The following table summarizes potential next steps based on the findings from your validation scenarios:

Findings

Next steps

GTG not active

Late consent warning is caused by load order and not Google Tag Gateway. Ensure that the Didomi script tag is set before the Google Tag Manager container script in the <head> tags of your website. Contact Didomi support if the issue persists for your website.

GTG active + late tag loads via googletagmanager.com

Google Tag Gateway is not in the path for this tag. There can potentially be another issue. Ensure that the Didomi script tag is set before the Google Tag Manager container script in the <head> tags of your website. Contact Didomi support if the issue persists for your website.

GTG active + late tag loads from your domain

See Resolution for options to remediate issue

Resolution

In order to remediate a late consent warning your organization will need to ensure correct consent signal timing with Google Tag Manager. There are two methods to remediate this issue depending on your CDN provider and setup:

Basic Consent Mode

If your organization utilizes Google Consent Mode v2 (Basic), it is recommend to enable DTCs (Data Transmission Controls) alongside either method below. DTCs limit what behavioral and configuration data Google receives when end-user consent is not yet established.

Deactivate Cloudflare "Setup the tag"

If your organization leverages Cloudflare as your Google Tag Gateway CDN provider, deactivating the Setup the tag feature deactivates CDN-level automatic script injection. When deactivated, script will load only via your on-page <script> tags so that the order your organization defines in your HTML will be respected.

This solution is a low-effort fix for Cloudflare customers who already have Didomi loading before their Google Tag Manager script in the website's <head> tags.

Navigate to Cloudflare's Google Tag Gateway configuration and deactivate the Setup the tag (or equivalent automatic injection) setting

Confirm that Didomi script tag is placed before the Google Tag Manager container script in the website's <head> tag.

Verify the load order resolves the Didomi compliance scanner warning

Manual Google Tag Gateway configuration

This remediation method configures Google Tag Gateway manually without utilizing your organization's CDN provider's automated tag injection. In order to perform this configuration, you will set up the subdomain routing yourself and update your gtag snippet to load from your first-party endpoint. (e.g. <script async src="/metrics/">).

This solution is a high effort fix for a publisher who wants maximum control over load order and is comfortable with custom CDN configuration.

Set up CDN routing rules manually for your tag.yourdomain.com subdomain

Update gtag or gtm snippet to reference the first-party endpoint

Load Didomi before the Google Tag Manager script, or use an async loader that initializes Didomi first

Last updated 15 days ago