If you've ever tried to track a form submission, a video play, or a checkout completion inside an embedded widget, you've probably hit a wall. Your GTM tags don't fire. Your GA4 reports show nothing. The button click that closed the deal is invisible to you.
This is the iframe problem, and it's one of the most common questions we get from TagCompanion users. The good news: in most cases, there's a clean solution. The honest news: in some cases, there isn't one, and we'll tell you upfront which platforms fall in that bucket so you don't waste a Saturday afternoon on it.
Why iframes break tracking in the first place
An iframe is just a window inside your page that loads content from somewhere else. Your booking widget, your embedded form, your payment popup: these are all small webpages running inside your bigger one.
The challenge comes from a browser security rule called the Same-Origin Policy. When the content inside the iframe is hosted on a different domain than your page, the browser refuses to let your page read what's happening inside it. That's a feature, not a bug. Without that rule, any random website could read your Gmail or your bank dashboard the moment you opened it in another tab.
The downside for marketers is real though. Your GTM container lives on your domain. Most embedded widgets live on someone else's. The browser keeps them strictly separated, and your tags can't see the click, the form submit, or the success event happening a few pixels away on your own page.
That's the constraint. Now let's talk about what to do about it.
A new SDK warning when you select elements
Before we get into the three solutions, a quick heads-up about something you'll now see in the TagCompanion SDK. When you use the element selector tool on a page that contains an iframe, you'll get a warning if you hover over it. The warning explains that elements inside the iframe can't be selected from the parent page, and it links back to this article so you have your options in one place.
This isn't a bug. It's the SDK respecting the same browser rule we just covered. The warning is there to save you the frustration of clicking around an iframe wondering why nothing highlights.
Solution 1: You own the iframe domain
This is the easiest case by far, and it's worth checking first because a surprising number of "iframe problems" aren't really iframe problems at all.
If the iframe loads a page on a domain or subdomain you control (your own embedded checkout, a subdomain widget, an internal page you built), you don't need any iframe-specific tricks. Just add that URL as a project in your TagCompanion dashboard and launch the SDK on it directly.
The SDK loads with a session on that page exactly as it would on any standalone page. Element selection works. Behaviour tracking works. Actions, ecommerce events, the full toolkit: all normal.
This covers a large portion of real-world cases: same-domain checkouts, marketing widgets on a subdomain, embedded apps you built yourself. If this is your situation, stop reading and go open the dashboard.
Solution 2: Configure the iframe to redirect to your thank-you page
If you don't own the iframe domain but you're tracking a form submission or a booking, this is the cleanest option.
Most embedding platforms (Typeform, Tally, HubSpot, Calendly, and others) give you a setting in their dashboard: after the user submits, either show a success message inside the iframe, or redirect the user to a custom URL on your own domain.
Pick the redirect option. Send users to a thank-you page on your own site. Once they land there, GTM fires on your page exactly like it would after any other page load, and TagCompanion's existing tools handle the rest. You select the page, define your conversion event, and you're done.
The trade-off: the user leaves the iframe and lands on a new page. For most lead generation and booking flows, that's fine and often preferable (a real thank-you page gives you more room for next-step CTAs anyway). For embedded experiences where the user needs to stay put, you'll need Solution 3.
Solution 3: Listen for postMessage signals from the iframe
When the success has to stay inside the iframe and you don't own the iframe domain, your only client-side option is a browser API called postMessage.
In plain language: postMessage is a controlled doorway in the Same-Origin Policy. Some platforms choose to send a small signal to your page when something important happens inside their iframe (a form was submitted, a video played, a meeting was booked). Your page can listen for that signal and fire a GTM event when it arrives. The platform decides what to send. You can only listen for what they choose to expose.
The catch is that "what they expose" varies wildly. Here's the current reality across the platforms our users ask about most:
| Platform | postMessage support | Notes |
|---|---|---|
| HubSpot Forms | Reliable | Form submission events trackable via GTM |
| Typeform | Reliable | Exposes form submission events |
| Tally | Reliable | Exposes form submission events |
| Paperform | Reliable | Exposes form submission events |
| Vimeo | Reliable | Full player events: play, pause, complete, progress |
| YouTube | Reliable | Full player events: play, pause, complete, progress |
| Calendly | Unreliable | Stripped submission data from embeds in 2026 |
| Stripe | None | Exposes nothing |
| PayPal | None | Exposes nothing |
For Stripe and PayPal, no client-side solution exists. The right approach there is server-side tracking via webhooks, which is a different conversation (and one we'll cover in a future article).
For platforms that do support postMessage, you don't have to build the listener logic yourself. TagCompanion will be releasing ready-made GTM templates for each supported platform. You'll import the container, point it at your iframe, and the events will flow into GA4 like any other event. Watch the dashboard for these as they roll out.
Quick comparison
| Solution | When it applies | Effort | Reliability |
|---|---|---|---|
| 1. Own the iframe domain | The iframe loads your domain or subdomain | Low: same as any TagCompanion project | High |
| 2. Redirect to your thank-you page | Platform supports redirect URLs | Low: a setting change, no code | High |
| 3. Listen via postMessage | Platform supports postMessage events | Medium: GTM template (coming soon) | Depends on platform |
What to do today
Open your site and find the iframe you're trying to track. Then ask, in this order:
Is the iframe loading a page on a domain or subdomain you own? Add it as a TagCompanion project and launch the SDK on it.
If not, log into the platform that hosts the embed and look for a redirect or thank-you URL setting. If it's there, point it at a page on your domain and track from there.
If neither of those works, check the table above. If your platform supports postMessage, watch for the upcoming GTM template. If it doesn't, you're looking at a server-side solution, and that's a problem worth picking up another day.
