Google Tag Gateway (GTG) integration

Last updated 12 October 2026

Google tag gateway for advertisers (Google tag gateway, or GTG) lets you load Google tags through your own first-party infrastructure instead of www.googletagmanager.com. This article explains what Google tag gateway is and what it changes for consent, how to check whether a tag is served through it, and what to do when Kukie.io reports late consent on such a tag.

What is Google tag gateway?

Google tag gateway serves Google tags from your own domain, through your CDN, load balancer or web server. Instead of loading from www.googletagmanager.com, the tag loads from a measurement path on your own site, for example example.com/metrics/?id=G-XXXXXXXXXX or cdn.example.com/gtag/js?id=G-XXXXXXXXXX. Google offers it with Cloudflare, Google Cloud and other providers, or as a manual setup.

There are two ways to set it up:

One-click CDN integration

A partner CDN, such as Cloudflare, adds the Google tag gateway loader to your pages when you turn the feature on in the CDN dashboard. The tag loads from a path on your own domain that the CDN controls. One-click CDN injection often takes away your control over load order: the CDN decides where the tag sits in your HTML, and there is usually no setting to change it. Your Kukie.io script and the Google tag can end up in an order you did not choose, which is why late consent is common with one-click integrations.

Manual setup

You set up Google tag gateway yourself on your own web server, reverse proxy or load balancer, following Google's setup guide. You then control where the tag sits in your HTML, including whether the Kukie.io script comes before it.

Google tag gateway does not replace Consent Mode or a consent banner. Consent signals still reach the tag through gtag('consent', 'default', ...) and gtag('consent', 'update', ...). Google tag gateway changes where the tag loads from. With a one-click integration it can also change when the tag runs relative to the Kukie.io script, which is what decides whether the consent default arrives in time.

How to check whether a tag is served through Google tag gateway

Any one of these checks is enough. Running more than one gives you more confidence.

Check 1: The host of the tag in the Network tab

Open DevTools (F12 on Windows and Linux, Cmd+Option+I on macOS).
Go to the Network tab and reload the page.
Filter for your tag ID (for example G-, AW- or GTM-), or for gtag/js and gtm.js.
Look at the host of the request.

www.googletagmanager.com: a standard install, not Google tag gateway.
A host on your own domain, for example example.com or cdn.example.com: Google tag gateway.

Check 2: The address of the tag

A tag served through Google tag gateway keeps its tag ID in the address. Look for one of these on your own domain:

/gtag/js?id=G-XXXXXXXXXX or /metrics/?id=G-XXXXXXXXXX: Google Analytics or the Google tag
?id=AW-XXXXXXXXX: Google Ads
/gtm.js?id=GTM-XXXXXXX or ?id=GTM-XXXXXXX: Google Tag Manager

The path before the query is the measurement path you or your CDN chose, so it varies from site to site.

Check 3: Your CDN or Google tag settings

If you use Cloudflare, open the Google tag gateway setting in the Cloudflare dashboard: when it is on, your tags are served through it. Other providers show an equivalent setting. The Google tag gateway section of your Google tag settings lists the measurement path. You can also connect Tag Assistant to the page and open Summary > Output > Hits Sent: hits sent to a path on your own domain come through Google tag gateway.

Check 4: Kukie.io's debug mode

Add ?kukie_debug=1 to any page where Kukie.io is installed and open the browser console. The debug report lists each Google tag it finds. A tag served from your own domain with a tag ID in its address is marked [GTG].

Tag address	Debug report badge	Verdict
`www.googletagmanager.com/gtag/js?id=G-...`	none	Not Google tag gateway
`example.com/metrics/?id=G-...`	`[GTG]`	Google tag gateway
`cdn.example.com/gtm.js?id=GTM-...`	`[GTG]`	Google tag gateway

A gateway whose address carries no tag ID is not marked, so a report without [GTG] does not rule it out. Check 1 is the most reliable.

How Kukie.io works with tags served through Google tag gateway

Kukie.io signals consent to a tag served through Google tag gateway exactly as it does to a tag from www.googletagmanager.com:

When the page loads, the Kukie.io script sets gtag('consent', 'default', {...}) with every consent type denied and wait_for_update: 500. In regions where your rules let data flow before a choice, it adds region-specific defaults that grant it there.
When the visitor chooses, Kukie.io sends gtag('consent', 'update', {...}) with their choice. While its banner is on screen it sends no update.
The tag reads these signals the same way, wherever it loads from.

What Google tag gateway can change is the order: the consent default has to be set before the tag reads consent.

Auto-block Scripts and Google tag gateway

While Google Consent Mode v2 is on, Kukie.io's Auto-block Scripts (Banner Editor > Behaviour) does not hold Google tags: Consent Mode controls what they do instead. The auto-blocker also recognises tags by their host, so it would not recognise a tag served from your own domain anyway. You can leave Auto-block Scripts on for your other trackers. It does not affect when a tag served through Google tag gateway runs.

When late consent is reported on a tag served through Google tag gateway

Kukie.io's debug mode (?kukie_debug=1) reports ✗ FAIL - Google tags fired BEFORE Kukie set consent defaults. when a Google tag read consent before the consent default was set, and Compliance Tools reports the same finding. If you have checked, as described above, that the late tag is served through Google tag gateway, the consent default arrived after the tag had already run. When Data Transmission Controls or Global Consent Defaults are turned on for the tag, measurement data from those page views is dropped or modelled incorrectly.

Choose one of three paths:

This is the recommended path for tags served through Google tag gateway. It works with manual Google tag gateway and with one-click CDN integrations, so you can keep your current setup.

In advanced consent mode (U+C), Google tags are not blocked before consent. They load, read the consent default and later the update, and adjust what they send. Data Transmission Controls and Global Consent Defaults then decide what each tag may send while consent is denied.

In Kukie.io:

Open your site's Banner Editor and go to the Integrations tab.
Turn on Google Consent Mode v2 if it is off, and save.
If Kukie.io loads your Google Tag Manager container for you, turn on Load the container before consent in the same tab. The container then loads with every signal denied instead of waiting for a choice.

In Google:

Turn on Data Transmission Controls for each tag that needs them. See Data transmission controls (Google Ads).
Set Global Consent Defaults in your Google tag settings according to your measurement needs. See About Consent Mode (Tag Manager).

Option 2: Move your tags into a Google Tag Manager container and serve it through Google tag gateway

Move every Google tag (gtag.js, Google Ads, Floodlight) into one Google Tag Manager container, and serve the container through Google tag gateway. The container has one entry point, and the Kukie CMP template sets the consent default on the Consent Initialization trigger, before any tag in the container runs.

Create a Google Tag Manager container if you do not have one.
Add the Kukie CMP template to the container and fire it on the Consent Initialization - All Pages trigger. See Install Kukie via Google Tag Manager.
Move any gtag.js snippets, Google Ads conversion tags and Floodlight tags from your pages into tags in the container.
In your CDN, point Google tag gateway at the container (gtm.js) instead of individual tags. See Set up Google tag gateway for advertisers in Google Tag Manager with Cloudflare.

Option 3: Set up Google tag gateway manually and control the script order

Turn off the one-click integration and set up Google tag gateway on your own infrastructure, where you decide the order of the scripts in your pages.

Turn off Google tag gateway in your CDN dashboard if it is on.
Follow Google's Google tag gateway setup guide to set it up on your own server, load balancer or proxy.
Place the Kukie.io script above the tag in the <head> of your pages, as in the example below.
Reload a page with ?kukie_debug=1 and check that the timing check shows ✓ PASS.

<head>
  <!-- Kukie.io first -->
  <script src="https://cdn.kukie.io/s/{your-site-key}/c.js" async></script>

  <!-- Then the Google tag from your measurement path -->
  <script async src="https://example.com/metrics/?id=G-XXXXXXXXXX"></script>
  <script>
    window.dataLayer = window.dataLayer || [];
    function gtag(){dataLayer.push(arguments);}
    gtag('js', new Date());
    gtag('config', 'G-XXXXXXXXXX');
  </script>
</head>

Replace {your-site-key} with the site key from the Kukie dashboard, example.com/metrics/ with your measurement path, and G-XXXXXXXXXX with your Google tag ID.

Which path is recommended?

Advanced consent mode (U+C) is the recommended mechanism for tags served through Google tag gateway, because it is compatible with manual Google tag gateway as well as with one-click CDN integrations, and it does not depend on where the tag sits on the page. Option 2 suits you if you want all your tags in one Google Tag Manager container. Option 3 suits you if you need full control over the script order.

The debug report reads Google's own consent state (google_tag_data.ics), which records whether the consent default arrived after a Google tag had already read consent. It does not depend on the tag's address, so the verdict holds for a tag served through Google tag gateway even when the report's tag list does not show it. Before any Google tag has loaded, the report reads the order of the commands waiting in window.dataLayer instead.

For every section of the report, see Consent Mode debug mode.

Troubleshooting

Symptom	Likely cause	Fix
`✗ FAIL` timing, and the tag list shows no tag	A tag on your own domain whose address the report did not recognise	Check the Network tab (Check 1). If the tag is served through Google tag gateway, choose one of the three paths above.
`✗ FAIL` timing on a site with a one-click CDN integration	The CDN adds the tag at a position you cannot change	Adopt advanced consent mode (Option 1), move your tags into Google Tag Manager (Option 2) or set up Google tag gateway manually (Option 3)
`✓ PASS` timing but measurement is still dropped	The update does not reach the tag, or Data Transmission Controls restrict it	Check that Google Consent Mode v2 is on in Banner Editor > Integrations, and that the consent state in the debug report shows `granted` after you accept
`? Unable to determine timing`	No Google tag has read consent yet	Reload the page and wait a few seconds before reading the report: tags served through Google tag gateway can load late

Dedicated support

If Google tags are not getting Consent Mode signals, or you run into another Consent Mode setup, timing or measurement problem, email Kukie.io's Google client support at google-support@kukie.io first, before you contact Google. We answer within 1 business day.

For a Google tag gateway issue, or a late-consent verdict the three paths above do not resolve, include:

The affected site URL
Output from ?kukie_debug=1 showing the FAIL verdict
Which check (see How to check whether a tag is served through Google tag gateway) showed that the tag is served through it
Which path you have tried or are considering

To copy Google's Consent Mode support team, add cmp-support-helper@google.com to your email, or choose the Google Consent Mode topic in the contact form and select the box.

Official Google documentation

Consent Mode debug mode

Google's banner requirements for Consent Mode

Follow this guide in your own account

Create a free account to follow this guide: add your site, scan it for cookies and publish your consent banner.

Start free

Was this helpful?