1. What Google Tag Gateway is, and how it affects consent
Google Tag Gateway (GTG) — officially Google tag gateway for advertisers — lets you serve Google tags such as gtm.js and gtag.js from your own first-party domain instead of from googletagmanager.com. It runs through your existing Content Delivery Network (CDN), load balancer, or web server, and is available for Google Tag Manager, Google Ads, and Google Analytics 4. Because the tag is served from your domain, browsers treat it as first-party, which Google positions as a way to recover measurement signal and improve conversion completeness.
GTG does not introduce new data collection and it does not replace consent mode. It changes where the tag is served from and, critically, when it loads relative to your consent banner. That timing is where the consent impact lives.
The one-click CDN injection problem
GTG can be set up two ways: an automated in-UI / one-click setup (offered for CDNs such as Cloudflare, Akamai, and Fastly), or a manual / self-service setup where you configure the routing yourself.
With the one-click option, Google injects routing rules directly into your CDN configuration and the Google tag is served from your domain automatically. The convenience comes at a cost: you no longer control the order in which scripts load on the page. The CDN can deliver and initialise the Google tag before the Complianz consent stub has run. For consent mode to work, your consent defaults must be set before any Google tag fires. Google’s own guidance is explicit on this point:
“The order of the code is vital. If your consent code is called out of order, consent defaults won’t work.” Google also warns: “Don’t set default consent states asynchronously.”
When the one-click CDN injection delivers the Google tag ahead of the Complianz stub, the tag can fire before any consent('default', ...) command exists. That is a late consent signal: the default command and/or the TCF stub load after Google tags have already fired. The banner looks correct, the tags look correct, but the race condition between the CDN-injected tag and the consent stub silently undermines measurement and consent enforcement.
2. How to verify whether a tag is enrolled in GTG
Before changing anything, confirm whether GTG is actually active. There are two reliable checks.
Check A — GTG status in your Google tag interface
Open the Google tag gateway section of your Google tag UI (in Google Ads, Google Analytics, or Google Tag Manager) and look at the enrollment status next to each website domain:
| Status | Meaning |
|---|---|
| First-party / Active | GTG is enrolled and serving tags from your domain. |
| Pending | GTG is enabled but no diagnostic data has been received yet. |
| Paused | GTG was enrolled but is currently paused. |
| Not started | GTG has not been activated for this domain. |
Check B — confirm the serving domain with Google Tag Assistant
- Open Google Tag Assistant and enter your website URL.
- Start a session and allow the page to load fully.
- In the Summary panel, open Output → Hits Sent and inspect where the tag and its hits are served from.
- If the request comes from
yourdomain.com/<measurement-path>rather than fromwww.googletagmanager.comorwww.google-analytics.com, the tag is enrolled in GTG.
If both checks confirm GTG is active and you have also detected a late consent signal (next section), proceed to the remediation in section 4.
3. What a late consent signal looks like
A late consent signal means the consent('default', ...) command and/or the TCF stub load after Google tags fire. You detect it using debug mode and/or a diagnostic tool — typically Google Tag Assistant’s Consent tab, which renders a consent timeline and flags tags that fired before defaults were set. Complianz debug output and the Consent Mode Inspector will surface the same ordering problem.
The contrast is easiest to see side by side.
Correct order
- Complianz stub loads → calls
consent('default', { ad_storage: 'denied', ... }). gtm.js/ Google tag loads → tags respect the denied default.- User interacts with the banner →
consent('update', ...)fires → tags adjust to the choice.
Late consent signal (one-click GTG CDN injection)
gtm.js/ Google tag loads via CDN injection.- Tags fire — no consent state exists yet.
- Complianz stub loads → calls
consent('default', ...)— too late.
In the debug/diagnostic timeline this appears as “tag fired before consent default was set,” or as a consent state of unknown at the moment the tag fired. When you see this and GTG enrollment is verified, follow the remediation below.
4. If a late signal is detected and GTG is confirmed: what to do
You have three valid remediation paths. Choose based on how much control you want over load order and how your tags are organised. Option A is recommended — see section 5 for why.
Option A — Adopt Advanced Consent Mode (U+C) and enable Data Transmission Controls + Global Consent Defaults Recommended
Advanced Consent Mode (also called U+C, “Update and Collect”) lets Google tags load immediately but send cookieless pings while consent is denied, switching to full measurement the moment the user accepts. Because tags are never fully blocked, the load-order race condition introduced by one-click GTG injection stops mattering — measurement continuity is preserved either way.
- Enable Advanced Mode in Complianz. In the Complianz wizard, when asked “Do you want to block all Google Tags before consent?”, select No. This is Complianz’s Advanced (U+C) configuration: Google tags load on page load and adapt their behaviour to the consent signal rather than being blocked. Ensure the WP Consent API plugin is installed, as it is required for Google Consent Mode compatibility.
- Enable Data Transmission Controls in your Google tag. Available in Google Ads, GA4, and Campaign Manager 360, these independently govern what data tags may send while consent is denied — advertising data, behavioural analytics, and diagnostics — so configure each according to your needs.
- Enable Global Consent Defaults. In your Google tag configuration, set a baseline denied consent state per region. This overrides any in-page
consent('default')command and protects you precisely when you cannot guarantee the Complianz stub loads first — the exact situation GTG one-click injection creates.
Option B — Migrate all tags into a GTM container and deploy GTM via GTG
If every Google tag lives inside a single Google Tag Manager container, GTM’s built-in consent mode support ensures tags respect the consent state set by Complianz. GTG then serves the GTM container itself from your domain rather than injecting individual tag scripts.
- Consolidate Google Ads, GA4, Floodlight, and any other directly-placed Google tags into one GTM container.
- Configure GTG to serve that container (
gtm.js) from your first-party domain. - Place the Complianz stub before the GTM snippet in the page
<head>so consent defaults are set first.
Option C — Set up GTG manually so you control script load order
Instead of one-click CDN injection, configure your CDN or load balancer routing manually using Google’s self-service setup. This returns control of load order to you, so you can guarantee the Complianz stub fires consent('default', ...) before the Google tag is requested.
- Do not use the automated one-click GTG setup — it removes your control over load order.
- Configure your CDN (Cloudflare, Akamai, Fastly, etc.) routing rules manually, following Google’s self-service instructions.
- Order the page
<head>so the Complianz stub snippet sits above the Google tag snippet.
5. Why Advanced Consent Mode (U+C) is the recommended path
For GTG-enabled tags, Advanced Consent Mode (U+C) is the recommended mechanism because it is compatible with manual GTG and with one-click CDN injection alike — it works regardless of how GTG was set up:
- It removes the dependency on load order. Tags load immediately and send cookieless pings while consent is denied, so a late-loading stub no longer means lost measurement.
- It preserves conversion modelling under denied consent by continuing to send privacy-safe signals, then upgrading to full measurement on acceptance.
- It is fully compatible with manual GTG (Option C) as well as the automated CDN setup (Option A), so you keep the first-party measurement benefits GTG was enabled for.
Basic Consent Mode blocks Google tags entirely until consent is granted. Under GTG one-click injection, if the consent stub loads late there is no measurement at all for that page load. Advanced (U+C) avoids this failure mode, which is why it is the recommended path for any site running Google Tag Gateway. You should not need to roll back GTG to resolve a late consent signal — rolling back forfeits the first-party benefits, whereas U+C fixes the timing problem while keeping them.
Reference documentation
- Google — Google tag gateway for advertisers (overview)
- Google — Get started / choose a setup method
- Google — In-UI (one-click) CDN setup and self-service (manual) setup
- Google — Set up GTG with your CDN · GTG with Cloudflare · GTG with Google Cloud Load Balancer
- Google — GTG with server-side tagging
- Google — Consent mode overview · Set up consent mode on websites
- Google — Troubleshoot consent mode with Tag Assistant · About consent mode (Google Ads Help)
- Google — Set up Complianz to obtain user consent
- Complianz — Simplified guide to Google Consent Mode v2 · Consent Mode for 7.0