Skip to main content

Google tag gateway and load order

Google tag gateway for advertisers (GTG) serves the Google tag from your own domain instead of googletagmanager.com. It is set up through your CDN (for example Cloudflare or Akamai) or through a Google Cloud load balancer. Google describes it in Enhance your conversion measurement with Google tag gateway for advertisers and in the setup guide.

This page explains what that does to Consent Mode, how to find out whether a tag uses it, and what to change when onePrivacy.debug() reports a late default.

Consent Mode only works when the default command is on the page before any Google tag command runs. On a normal install you control this: the One Privacy snippet goes first in <head>, the Google tag goes after it.

Google tag gateway breaks that control when it is set up with one-click injection. The CDN inserts the Google tag script into your HTML at the edge, usually at the top of <head>, before anything you wrote. The tag then loads and runs before the One Privacy snippet has pushed the default command. Your first page view fires without a consent state, and onePrivacy.debug() reports LATE.

You cannot fix this by moving the snippet. The injection happens outside your page.

Verify whether a tag uses Google tag gateway​

Check in this order.

In the One Privacy debug report. Run onePrivacy.debug() and look at the Google tag scripts on the page table. A script whose host is your own domain and whose gtgCandidate is true is not served by Google directly. The report also prints a GTG_CANDIDATE warning for it. See Debug Google Consent Mode.

In your Google product. Google tag gateway is enabled per Google tag. Open the Google tag settings in Google Ads, Google Analytics, or Google Tag Manager and find the Google tag gateway for advertisers section. A status of Active means the tag is served through the gateway. Google's implementation flow shows where the setting lives in each product.

In the browser. Open DevTools, go to Network, filter for gtag/js or gtm.js, and reload. A request to googletagmanager.com is the standard tag. A request to a path on your own domain, such as yourdomain.com/metrics/..., is the gateway.

In Tag Assistant. Connect Tag Assistant to your page. Under Summary → Output → Hits Sent, gateway hits go to your own domain. Google's troubleshooting guide shows where to look.

What to do when the default is late​

If the late tag is not on Google tag gateway, move the One Privacy snippet above it and stop here. The rest of this page is for tags that do use the gateway.

You have three options. Google recommends the first.

Google's partner material also calls this "U+C". In the advanced implementation, Google tags load when the page opens and adjust their behavior to the consent state as it arrives. Because the tags do not need to be blocked before consent, the injection order no longer decides whether a consent state is honored: the update One Privacy sends after the visitor chooses is applied to the tag regardless of when the tag script loaded. This is why Google recommends advanced consent mode for gateway-enabled tags. It is compatible with the manual gateway setup too.

One Privacy already sends the default and update commands that advanced consent mode needs. Two Google tag settings decide what the tag does before the visitor chooses:

  • Data transmission controls decide what a tag sends while ad_storage is denied. Set them in the Google tag settings in Google Ads, Google Analytics, or Google Tag Manager. See Data transmission controls.
  • Global consent defaults set the starting consent state inside the Google tag settings (in Google Tag Manager: Admin → Container Settings), in addition to the default command from your page. Because the setting lives in the tag itself, it applies even when the tag script loads before your page runs. Google recommends a global default of denied rather than a region-only one, so a later change to where your banner shows does not create a late consent state. Google's setup steps for both implementations are in Set up consent mode.

Set both according to your needs. Google's own description of the two implementations is in Set up consent mode on websites. See also Basic and advanced consent mode below.

Option 2: move every tag into one GTM container and serve GTM through the gateway​

Put gtag.js and all other Google tags inside a single Google Tag Manager container. Load One Privacy with the One Privacy tag template on the Consent Initialization - All Pages trigger. Then enable Google tag gateway for the GTM container instead of for individual tags.

Consent Initialization tags run before every other tag in the container, so the default is set before any tag fires, no matter where the CDN injected the container script.

Option 3: set up the gateway manually​

Google's setup guides let you skip the one-click injection and add the gateway-served script to your HTML yourself. See Set up Google tag gateway for advertisers with your CDN and the Cloudflare setup. When you own the <script> tag, you own its position: put the One Privacy snippet first, then the gateway script.

After any of the three, run onePrivacy.debug() in a fresh browser session and confirm the default reports OK.

Google supports two implementations. One Privacy works with both.

Basic. Google tags are blocked until the visitor interacts with the banner. No data goes to Google before that. When the visitor grants consent, the tags load and run the Consent Mode commands. To use basic mode, gate each Google tag on consent: in Google Tag Manager, set Require additional consent for tag to fire on the tag and add the one-privacy-consent-updated event as its trigger. See GTM dataLayer integration.

Advanced. Google tags load when the page opens. Before consent they run with the default state (denied), sending cookieless pings that Google uses for modeling. After consent they switch to the update state. This is what a plain One Privacy install gives you: the snippet sends default at load and update after the choice, and your tags keep the standard No additional consent required setting.

Google's definitions are in Consent mode overview and About consent mode. Which one you choose depends on your own requirements. Consent Mode is a signaling mechanism for Google tags; it is not a substitute for the consent you collect.

What's next​

Debug Google Consent Mode.

Google Consent Mode v2.

Installing with Google Tag Manager.