Everything marketers should know about server-side tracking

Server-side tracking or tagging offers a number of advantages: The loading time of websites is improved, dependency on cookies is reduced, data quality and data protection compliance are increased.

The focus is on these two challenges:

1. Tracking blockers: 10 to 20 percent of users use browser extensions such as Ghostery or Adblock Plus. Calls from known tracking domains are prevented depending on the blocker settings.
2. Cookie restrictions: In the Safari browser, cookies are limited to 24 hours by Intelligent Tracking Prevention (ITP) for visits from Google or Meta Ads. If visitors convert after this time, the success cannot be attributed to the initial contact.

This is a particular problem in performance marketing. If the algorithms of the ad platforms only receive a few and inaccurate conversion signals, the performance of the campaigns suffers. This means increased cost per action (CPA) and reduced return on ad spend (ROAS).

The more conversions the Google Ads and Meta Ads algorithms receive, the better the campaigns perform. Server-side tracking can attribute up to 20% more conversions and increase ROAS by up to 10%.

How server-side tracking works

The principle of server-side tracking is that a direct connection between the user’s device and the marketing platforms is avoided and the conversion data is passed on via interfaces.

Server-side tracking and duty of consent

The prior consent of users is also required for server-side tracking if

• Data such as the screen resolution is read from the end device,
• cookies are set for statistical or marketing purposes or
• the data processing is not carried out in the mildest form and not in harmony with the natural expectations and protection interests of the data subjects.

This is often misunderstood:

• The use of cookies for analytical and marketing purposes as well as multi-purpose cookies are generally always subject to consent. It does not matter whether necessary purposes such as fraud prevention and the like are also pursued.
• Personal data is always processed during server-side tracking. Anonymizing the data before it is passed on is very complicated in practice and does not automatically protect against the obligation to obtain consent! The European Court of Justice (ECJ) clarified in its ruling of 4 September 2025 (case number C-413/23 P) that the disclosure of data – even in anonymized form – is not permitted without prior consent. The decisive factor for the assessment as personal data is how it was transmitted to the controller, i.e. before any anonymization and transmission to third parties. This means that even data in the so-called consent or essential mode may not be forwarded without checking the legal basis within the meaning of the GDPR.

Problem area server-side Google Tag Manager (GTM):

• The GTM records the screen resolution by default and therefore always requires prior consent.
• Data can only be transformed to a limited extent, so that complete anonymization is not possible.

Problem area Google Analytics:

In case 7125-24 of the Swedish Data Protection Authority, the court ruled with regard to the use of Google Analytics that the anonymization of the IP address is definitely not sufficient, as Google has the possibility to identify individual visitors by reasonable means by combining the collected data with its own data. All unique identifiers that identify the browser or device, as well as other data that Google can access via the user’s Google account, would therefore have to be anonymized.

Only if a web analytics solution that is demonstrably data protection-friendly is used without processing the data for the service provider’s own purposes can the consent requirement be waived. It will be difficult to find a configuration of Google Analytics that meets the requirement of the mildest means for the purpose. Visitors also do not reasonably expect their data to be passed on for advertising purposes (remarketing), which rules out processing on the basis of legitimate interest.

What about conversion data?

The server-side transmission of conversion data to marketing platforms such as Google and Meta Ads, on the other hand, can be justified on the basis of legitimate interest. For this purpose, the transmission of user data and IDs can be dispensed with. The link to the appropriate ads is made via click IDs, which are used exclusively to measure success. Remarketing in the sense of allocation to individual users and their targeted advertising is therefore excluded. According to ECJ judgment C 252/21, 4.7.2023, the following test criteria for the overriding interest must be taken into account:

• The controller has a genuine interest in optimizing bids and monitoring success.
• There is no milder comparable solution: the server-side upload is significantly milder than the use of marketing tags and the transferred data can be reduced to the level required for allocation.
• Reasonable expectations are not violated as there is no critical profiling.

Server-side tracking with etracker

etracker makes server-side tracking particularly simple, legally compliant and comprehensive:

• Conversion data can be forwarded to the ad platforms on the server side using different distribution models.
• Other systems such as affiliate providers can be connected on the server side via a generic REST API.
• Optionally, Google Analytics can (soon) be supplied with data on the server side.
• As cookies are set by your own domain, they are not affected by the ITP restrictions.
• Thanks to its own tracking domain, data loss due to ad and tracking blockers is avoided.
• The integrated tag and consent management prevents errors and simplifies compliance.
• With etracker analytics, consent is no longer required in cookie-less standard mode.
• For social ads, server-side and tag-based tracking can be combined with automatic deduplication.

This allows marketers to control and optimize bids based on the best data. Marketing platforms such as Google Ads can be used as usual. Implementation takes just a few minutes and you can avoid adblocker, iOS and content restrictions in the long term.

---