Approach 1 — Google Tag Gateway

Tag Gateway Sandbox

Click a button to fire an event. Watch DevTools → Network — the HTML loads from www.googletagmanager.com but Cloudflare intercepts and serves it from your own first-party domain automatically.

How to verify in the meeting:
Open DevTools (F12) → Network tab → reload the page.
The HTML snippet says www.googletagmanager.com — but in the Network tab the gtm.js request resolves to YOUR domain (Cloudflare intercepted it).
GA4 collect hits also route through your domain — no direct browser-to-Google connection.