What is server side tracking, and is it GDPR compliant?

With ordinary tracking, client side, every tag runs in your visitor's browser. The Meta pixel, the Google Analytics tag and the Google Ads tag each send data straight to their own servers, and you cannot see exactly what leaves. With server side tracking the browser sends a signal to a server you own, on your own domain, and that server decides what goes further: which fields, to which service, and what gets filtered out.

What is client side tracking, and how server side differs

What it fixes

Three things. Pages load faster, because one request to your server replaces five heavy scripts. You keep control: you can shorten an IP address, drop an email address or hash a field before it leaves your server. And your data gets more complete, because fewer signals get lost on the way.

Is server side tracking GDPR compliant?

Not by itself, and this is where it is often oversold. Server side tracking is sometimes pitched as a way to measure without a cookie banner. It is not. The EU cookie rule covers anything stored on or read from the visitor's device, also through your own domain. And for marketing purposes, such as retargeting or conversions sent to Meta, the GDPR requires a legal basis, which in practice means consent. Whether you need a cookie banner depends on what you measure, not on where the code runs.

What does change: you can do more with less data. A server that only counts how many people viewed a page, without storing anything on the device and without passing anything to a third party, sits in a different category from a pixel building an advertising profile. The full checklist for a site serving EU visitors is in GDPR compliant website.

What is server side tracking in Google Ads and Meta?

The best-known route is a Google Tag Manager server container hosted on Google Cloud or a specialised host. Your browser container sends everything to the server container, which hands it on to Google Analytics, Google Ads and Meta. For Google Ads that means conversions measured through your server, often with enhanced conversions. On the Meta side the server channel is called the Conversions API; the Meta pixel and the Conversions API work best together, with a shared event ID so Meta does not count twice. How Analytics itself handles consent is in Google Analytics 4 setup.

Measuring without cookies: our own example

vbsmarketing.eu runs no Google Analytics and no pixel. A small function on AWS (Lambda) receives the page, the source and the UTM code of each visit, and counts clicks to book a call, to phone or to email, and submitted forms. It all lands in a database (DynamoDB) inside the EU, in Stockholm. No cookie sits on the visitor's device and nothing goes to a third party. The Business Centrum site measures the same way. It is a form of server side measurement that shrinks the privacy question rather than moving it.