Google tag gateway on Cloudflare: what does it actually change, and what does it leave alone?
Short answer
It moves Google's tags and measurement through your domain. It does not add bot filtering, consent, CRM sales or other ad platforms.
It changes where Google's own tags load from, and nothing else. The gateway serves Google's tags from your domain and passes measurement requests through your domain on the way to Google. It does not add bot filtering, consent, CRM sales or sends to other ad platforms. It is a transport fix for Google tags.
Here is the mechanism, from Google's and Cloudflare's own documentation. Normally a Google tag script loads from a Google domain, and measurement requests go to Google domains. With the gateway, the script and the requests go through a path on your own domain, and the gateway forwards them to Google. To a browser or a blocker that filters by domain, the requests look like your own site.
Setup can be done from inside the Google tag or Tag Manager screens for sites on Cloudflare, and other routes exist for other CDNs or for server-side tagging with a custom domain. Cloudflare documents it as free, and says the requests are not billed to CDN, WAF or Bot Management.
The benefit is that fewer Google tag requests are lost to domain-based blocking. Google has published a figure for the uplift in data signals for early testers. Treat that as Google's number for its testers, not a promise for your site, and measure your own before and after.
What it does not do matters just as much. It only handles Google's tags, so Meta, TikTok and LinkedIn are untouched. It does not tell you whether a visit was a bot, so bot visits are forwarded as before. It is not a consent manager. And it does not carry your CRM's sale back to the ad.
People sometimes ask whether it means giving Google control over Cloudflare. I would read Google's and Cloudflare's setup pages for the exact permissions requested before you approve anything, and ask whoever owns your DNS.
So when is it enough? For an account that advertises only on Google, has clean traffic and sells on the website, it can be a sensible, cheap step. As soon as you have other platforms, offline sales or junk traffic, it is one piece of a bigger job.
DataCops covers the rest: one script and one DNS record on your own domain, a bot verdict on every visit with a Real people only switch per platform, the sale from your CRM or Shopify sent back to Meta, Google Ads, TikTok and LinkedIn, and a delivery log. It can sit alongside the gateway if you want Google's own tags served that way too.
Which platforms do you advertise on, and where do your sales happen?
DataCops in short
For this question: DataCops covers what the gateway leaves out: a bot verdict, CRM sales and Shopify orders sent back to four ad platforms, and a delivery log, and it can run alongside the gateway.
DataCops is a tool that does the ad-conversion job without a container, warehouse or plugin: one script and one DNS record on your own domain, a bot verdict on every visit with a Real people only switch per ad platform, the real sale from your CRM or Shopify sent back to your ads, new campaigns warmed up with the customers you already have, and a log of every send.
How DataCops does it
- First-party collection, no extra tool. One script and one DNS record put collection on your own subdomain; with DNS on Cloudflare, the free Worker reads the click at the edge before the page loads. A signed server-set cookie lasts up to 400 days where enabled.
- Real people only. Every visit gets a bot verdict, with a Real people only switch per ad platform, off by default. Every form email is checked for disposable providers, domains with no mail server and an email risk score.
- Every ad platform. Conversions go server-side to Meta, Google Ads, TikTok and LinkedIn, counted once against the pixel by event ID.
- The sale after the form. HighLevel natively, any CRM by webhook, Shopify through the DataCops Shopify app.
- A log you can read. A delivery log row per conversion, with the reason when it did not go. A TCF 2.2 consent banner and first-party analytics (a GA4 alternative) come from the same script.
Best for: teams who want better ad conversions without building or maintaining the pipe: lead gen, ecommerce, clinics, home services, B2B and agencies.
Ads Warmup: tell the ads who pays
Ads Warmup, DataCops' flagship feature, sends customers you already have to Meta, Google Ads and TikTok before a new campaign spends: upload a CSV (only email is required, up to 20,000 rows), see a 0 to 10 match score per person, pick the event, and send. Rows are dated when you send, and Google Ads credits only people who clicked a Google ad. Preview is free; sending needs a paid plan. Check your own consent basis for the list first. See Ads Warmup.
Ways to do this job
| Option | Best for |
|---|---|
| DataCops | One script, a bot verdict, CRM sales and a delivery log |
| Hosted server GTM (such as Stape) | A team that already owns a GTM container |
| The platform's own pixel | Basic browser tracking on one platform |
| Self-hosted server GTM | Engineering teams who want full control |
When not to use DataCops
- You need custom tag logic or non-ad destinations. DataCops sends to ad platforms and is not a Google Tag Manager container.
- You want a reporting dashboard. DataCops fixes what goes into your ads. It does not replace the reports you already read.
Sources and further reading
More on this: Google tag gateway alternatives, and the complete guide to offline conversion tracking.
Measure before and after: compare Google Ads conversions with your real orders for two weeks on each side of the change.