Google Tag Gateway: first-party tag serving in two days.
Google Tag Gateway serves the Google tag from your own domain through a CDN you already pay for. It recovers a meaningful share of blocked requests and extends cookie lifetime, without the infrastructure, cost or operational surface of a full server container. For a lot of teams it is the right first move — and it does not become wasted work if you build the container later.
What it actually does
Both the tag script and the outbound measurement requests are routed through a first-party path on your domain, so blocking lists that match on hostname stop matching. Identifiers are set server-side rather than by JavaScript, which is what takes them out of Safari's seven-day cap.
What it does not do
The gateway forwards; it does not process. There is no payload transformation, no PII redaction, no enrichment, and nothing for Meta, TikTok or LinkedIn — those need a real server container. If those are your main channels, skip the gateway and go straight to the build.
- Cloudflare integration, or the equivalent path on Fastly, Akamai, CloudFront or your own proxy
- Measurement requests routed first-party, not just the tag script
- Verification that identifiers are genuinely server-set and surviving ITP
- Two weeks of before-and-after measurement, so the recovery is a number
- A written view on whether a full container is worth it for your traffic
- Meta, TikTok or LinkedIn as your main channels — the gateway does nothing for those
- Anyone needing transformation, enrichment or PII redaction. The gateway forwards; it does not process
- Teams already running a healthy server container — there is little left for this to add
Tell us what your stack looks like.
You will get a reply from the engineer who would do the work, usually within one business day, and it will contain an actual opinion rather than a calendar link.