Stape is the biggest name in server-side GTM hosting, and earned it: paste your container config, they run it on Google Kubernetes Engine, and twenty-one "power-ups" deepen what a container can do. As managed sGTM goes, nobody ships more.
But Stape's own blog says the load-bearing sentence: "Server GTM doesn't yet have a Consent Mode similar to web GTM." Consent enforcement in a Stape setup is a per-tag checkbox you must remember to tick, on infrastructure run by a Delaware corporation on a US hyperscaler by default. HeySignal starts where that sentence ends.
Pick Stape if you are a GTM power user who wants maximum container capability per dollar, global infrastructure, and full ownership of the consent problem.
Pick HeySignal if consent enforcement should be the platform's job, and your lawyers keep using the words "Cloud Act" in meetings.
| HeySignal | Stape | |
|---|---|---|
| What it is | Consent-first tracking gateway, own pipeline | Managed hosting for server-side GTM containers |
| Consent enforcement | Cryptographic, fail-closed, platform-level, per destination | Customer's job: web-GTM consent mode via gcs parameter, opt-in per-tag checkboxes, no fail-closed default |
| Jurisdiction | European providers, no US entity in the chain | Stape, Inc., Delaware; disputes in Delaware courts |
| Default hosting | Bunny.net edge + OVHcloud, France/Frankfurt, always | Google Cloud (GKE); "Stape Europe" on Scaleway as separate opt-in |
| Their own words on EU compliance | Consent verified before processing, per event | "Only using Stape Europe for sGTM won't make your Google Analytics GDPR compliant" (their FAQ) |
| GTM required | Optional | Yes, it is the product |
| Cookie policy | Consent-gated identifier lifetimes | Cookie Keeper restores expired marketing cookies from a master cookie |
| Certifications | None yet; SOC 2 Type II planned Q4 2026 | ISO 27001 (2024-2027); SOC 2 claimed, type and auditor undisclosed |
| Pricing | Early access; pricing at GA | Free 10k req/mo; Pro $17/mo annual (~$20 monthly, 500k); Business $83/mo (5M); Enterprise $167/mo (20M) |
In a Stape setup, consent reaches the server as Google's gcs parameter, and enforcement means either building trigger logic around it or ticking "send data if marketing consent is given" on each individual tag template. Miss one tag, and non-consented events flow to that vendor indefinitely, silently. Nothing in the architecture notices.
HeySignal inverts the default. Consent is verified before any tag-equivalent logic runs, and a destination without satisfied consent categories is simply never called. The failure mode of a misconfigured HeySignal site is blocked data, which you notice immediately, not leaked data, which you notice in a complaint.
Stape Europe on Scaleway is a real offering and honest engineering. It is also an opt-in sub-brand of a Delaware corporation whose default product runs on Google Cloud. The CLOUD Act cares about corporate control, not the sticker on the data center. If EU-jurisdiction processing is a requirement rather than a preference, an American company offering a European option is a different answer than a European pipeline with no American layer to ask.
And on what EU hosting buys you, take Stape's own FAQ over our marketing: it won't make your GA4 compliant by itself. They're right. That is exactly why hosting location was never the interesting layer. Enforcement is.
Stape's power-ups are genuinely impressive container engineering: loaders that dodge ad blockers, cookies restored from a master cookie, user IDs stitched across sessions. Notice the theme: capability, applied uniformly to consenting and non-consenting visitors alike, unless your configuration says otherwise. HeySignal ships fewer knobs and one guarantee. We think the guarantee is the product.
They are the category leader for a reason: the deepest sGTM feature stack in the market, genuinely low pricing, global points of presence, plugins for every major store platform, a huge template library, and a strong agency program. If you want maximum sGTM capability and accept the consent burden as yours, Stape is the honest benchmark.
Stape provides infrastructure; compliance depends on your GTM configuration. Their own FAQ states EU hosting alone won't make your GA4 setup GDPR compliant, and their docs confirm server GTM has no native consent mode.
Yes. Proxy mode keeps your GTM workflow intact behind a first-party domain with consent computed at the edge. You lose the container babysitting, not the container.
Today, Stape publishes prices and HeySignal is in early access, so Stape wins any spreadsheet we could print here. Ask us and we will be straight about where pricing lands at GA.
Some equivalents exist (first-party serving, geo enrichment via the pipeline, bot detection). Others we deliberately don't build, like restoring deleted marketing cookies without consent gating.
FACTS LAST CHECKED: 7 JULY 2026
All Stape claims verified against stape.io (gtm-server-hosting, price, eu-hosting, terms-conditions, consent-mode blog, power-ups docs) on 7 July 2026.
BRAND