Google Tag Gateway: first-party Google tags without a server container

What changed

Serving Google tags from your own domain used to mean one thing: standing up a server-side GTM container — a Cloud Run service or equivalent, a custom subdomain, and an ongoing hosting bill. That wall just came down. Google tag gateway for advertisers, the general-availability graduation of last year’s first-party mode beta, routes both the tag script and its measurement requests through your own domain using infrastructure you already have: a CDN integration (on Cloudflare it is close to one-click), a load balancer, or your own web server.

The positioning is Google’s own: “deploy a Google tag using your own first-party infrastructure, hosted on your website’s domain,” with the claimed benefits of conversion uplift, fewer third-party interactions, and automatic setup. For the “most durable” setup, Google recommends combining it with a server container — the gateway is a complement to sGTM, not a replacement — but the point is that it no longer requires one.

The three ways to first-party your Google tags

Approach	First-party hostname	Works for non-Google tags	Transform / filter events	Infra you run	Effort
Client-side tags (status quo) googletagmanager.com, google-analytics.com	○ No	● Yes	○ No	○ No	● Yes
Tag gateway your CDN / LB / web server	● Yes	○ No	○ No	◐ Minimal	● Yes
Server-side GTM your container, your rules	● Yes	● Yes	● Yes	● Yes	○ No

○No●Yes◐Minimal

The gateway column is the new option: first-party serving with near-zero infrastructure, but Google-tags-only and with none of sGTM's transformation control. If your first-party ambitions end at 'keep Google measurement durable', the gateway now does that for a fraction of the effort.

Source Google's gateway and dependency-serving documentation Capabilities as documented at verification date; the gateway carries Google tags, not arbitrary vendors.

What it does not change

Your consent obligations. Where the tag is served from has no bearing on whether you need consent to run it. A gateway-served GA4 tag under GDPR or a US universal-opt-out regime carries exactly the obligations the third-party-served one did — and because the requests now blend into first-party traffic, proving your consent gating works becomes more important, not less. Our Consent Checker reads the signals regardless of where the tag loaded from.

The measurement math. Ad-blocker and ITP resilience is real (first-party requests are much harder to filter by hostname), and that is precisely Google’s pitch. But “more of the data survives” is a change in coverage, not accuracy — expect step-changes in your trends when you switch it on, and annotate accordingly.

The auditability cost

This is the part our data measures. Every blocker, DNS filter, and third-party audit — including most of our own report — identifies tracking by its third-party hostname. The gateway removes that signal for Google tags. In the June 2026 crawl, §11 of the report found first-party GA4 collection on just 0.91% of GA4 pages (default paths) — the baseline from before the gateway’s general availability. If the one-click Cloudflare path gets the adoption Google clearly wants, that number is about to move, and a growing share of Google measurement will be invisible to hostname-based tooling.

That doesn’t make the traffic undetectable — it makes detection a content and path problem instead of a hostname one. It is exactly the shift our first-party endpoint signatures exist to track, and the next quarterly crawl will report the gateway’s footprint directly.

What to do

If you implement tracking:

1. Needs limited to Google tags surviving blockers/ITP? Evaluate the gateway before building sGTM — the setup cost difference is an order of magnitude.
2. Already on sGTM? Google’s recommended end-state is custom domain + gateway plus the container. Test on a staging property; watch for the coverage step-change.
3. On Cloudflare, the in-UI setup is the shortest path; the dependency-serving docs cover load-balancer and web-server variants for everyone else.

If you govern or audit tracking:

1. Inventory by hostname is no longer sufficient — add path-signature checks (our Pixel & Tag Scanner approach) to any internal tag audit.
2. Re-verify consent gating on any property that enables the gateway; the legal surface is unchanged while the visual surface shrinks.
3. Expect analytics coverage jumps in properties that adopt it and annotate them, or someone will read the trend as organic growth.