Documentation

Google Tag Gateway Mode

What Is Google Tag Gateway Mode?

Google Tag Gateway Mode is a parent-level toggle that changes where gtag.js is loaded from. With the toggle off, the library loads from googletagmanager.com. With it on, each configured Google tag ID loads its library from a first-party URL on your own domain, which your CDN reverse-proxies to Google.
Serving the tag first-party improves resilience against ad blockers and browser restrictions on third-party script sources, and gives cookies written by the tag a first-party origin.
Gateway Mode governs script serving only. The gtag('config', <id>) initialisation is unchanged in both modes, and Gateway Mode does not by itself restore view-through or engaged-view attribution — that is controlled separately by VTC/EVC Support.

One Path Per Tag ID

Google Tag Gateway requires a distinct first-party path for each tag ID. A single shared path is not sufficient. Four Google Ads accounts and three Floodlight advertisers need seven paths:

https://www.example.com/metrics-1   ->  AW-12345678
https://www.example.com/metrics-2   ->  AW-98765432
https://www.example.com/metrics-3   ->  DC-12345678
https://www.example.com/metrics-4   ->  G-12345678

Values are verbatim absolute URLs, not relative paths. Gateway only functions first-party on the site's own origin, so the host in each URL must be your own domain.
URLs are validated when the file is built, not at runtime. They must use https and must include at least one path segment — a bare origin is rejected. The host is checked for shape, not ownership: a URL pointing at a domain you do not control passes validation and fails silently in the browser.
Paths are configured per destination entry rather than once at the parent. Each entry in Google Ads Conversions and CM360 Advertisers accepts an optional script-source key alongside its tag ID. GA4 uses the parent-level Gateway path for the parent property; additional GA4 properties are configured through the GA4 destinations array.

Partial Gateway Is a Supported State

A destination entry with no configured URL falls back to googletagmanager.com while other entries continue loading first-party. This is supported, not an error, and produces a single console warning naming the affected tag ID. Entries sharing the same URL load one script between them rather than duplicating it.
If every configured script fails to load — an ad blocker intercepting all of them, for example — no tag is configured and no suppression markers are written. The page behaves as though the Google tag were absent rather than partially initialised.

What Happens When Gateway Mode Is Off?

When Gateway Mode is "off", every tag ID loads from googletagmanager.com and no first-party value has any effect. What happens to the configured values differs by sync:

  • GA4: removed from the built configuration. The sync-level ReSync URL and both per-destination fields are stripped at build time, so they do not appear in the delivered bundle.
  • Google Ads, CM360, and the parent tag: retained but unused. Configured gateway URLs remain in the built configuration and are ignored at runtime. If you inspect your delivered bundle you will still see them.
    With Gateway Mode off, GA4 ReSync beacons go to Google's default collect endpoint regardless of any ReSync URL previously entered. Turning Gateway Mode on activates the whole first-party set together.

Prerequisites

  • A CDN with Google Tag Gateway configured. Google offers one-click setup with some providers and a self-service routing path for others.
  • Paths created and serving before you configure them here. Gateway is a reverse proxy to Google, not file hosting, and a configured URL is not verified as live.
  • Required geolocation headers attached at the CDN, per Google's specification.
  • Paths you supply yourself. They are not generated or auto-numbered for you.

Updated 3 days ago