Server-side tracking and Consent Mode v2: how to measure with first-party data and consent

Server-side tracking, or server-side tagging, is an architecture in which events from a website or app pass through a server controlled by the company before going on to analytics tools and media platforms. In the traditional client-side model, each tag runs in the visitor's browser and sends data directly to its vendor. With server-side, the company receives the data first and decides what to pass on, to whom and in what format.

Consent Mode v2 is Google's mechanism for passing each person's consent choice to the tags. Together with a company-owned server and conversion APIs, it forms the foundation of measurement that uses first-party data and respects what the user has authorized. This guide explains each piece and what marketing and data leaders need to decide before implementing.

What server-side tagging is and how it differs from client-side

With client-side, the browser loads the code of each tool, such as analytics and media pixels, and each script sends what it reads from the page to its own destination. The company sees little of what actually leaves.

With server-side, the server container, according to the Google Tag Manager documentation, does not run in the user's browser or phone but on a server under the advertiser's control, and the data that reaches it remains accessible to the company until it decides to send it elsewhere. The documentation also recommends setting up this server on a first-party domain before it receives production traffic.

In practice, fields can be removed or transformed before each send, and the server becomes infrastructure with a cost and an owner. Server-side does not replace consent: the gain is control and governance, not a shortcut.

The Google Tag Manager server-side container

Server-side GTM uses the same model of tags, triggers and variables as the web container. The new piece is clients: adapters that receive the requests arriving at the server and turn them into events, which server tags forward to Google Analytics, media platforms or the data warehouse.

The server can run on Google Cloud or in another environment the company chooses. The Cloud Run setup guide recommends a minimum of two instances to reduce the risk of data loss during outages, along with a cost estimate and billing alerts. It is a recurring cost that grows with traffic and needs a budget and an owner.

Conversion APIs: the server talking to the platforms

Platform conversion APIs send events from the company's server directly to the media platform, without relying solely on the browser.

The Meta Conversions API sends marketing data from the advertiser's server and accepts website, app, messaging and offline conversion events. According to the documentation, server events linked to a dataset are processed the same way as those sent by the Meta Pixel.

Google Ads enhanced conversions supplement conversion tags with first-party customer data, such as email or phone number, hashed with SHA256 before being sent. There is one variant for conversions on the website and another for leads that close outside it.

The most useful data for optimizing media, such as the sale recorded in the ERP or the qualified opportunity in the CRM, originates outside the browser. The article on CRM and revenue explains how to define these stages.

Deduplication between browser and server

When the same event is sent by both the browser and the server, which Meta calls a redundant setup, the platform needs to recognize the two copies as a single event. Meta's deduplication documentation recommends sending the same event name and the same event ID from both sources, and states that deduplication by ID applies to events received within 48 hours of the first. Without that key, a purchase can be counted twice.

Consent Mode v2: what it is and why it matters

Consent Mode passes the user's choices about cookies and identifiers to Google, and the tags adjust their behavior accordingly. It does not display a banner and works with the consent tool the company already uses, as the Google Ads Help Center explains.

The developer documentation notes that the feature was updated in November 2023 with two additional parameters. The main consent types became ad_storage (cookies for advertising), analytics_storage (storage for analytics), ad_user_data (sending user data related to advertising to Google) and ad_personalization (personalized advertising).

Google's page on consent management adds that ad_user_data is required for measurement such as enhanced conversions and tag-based conversions, and that personalized advertising depends on ad_user_data and ad_personalization being granted.

Basic mode and advanced mode

• Basic: Google tags do not load until the person interacts with the banner. Without consent, no data is transferred to Google, not even the consent status.
• Advanced: tags load when the page opens, with consent denied by default. While consent is denied, they send cookieless measurements; once consent is given, they send full measurement.

According to Google's conceptual overview, advanced mode enables an advertiser-specific conversion model, while basic mode uses a general model. The choice involves privacy and risk and should be made together with the legal team.

Why Europe drove the issue and why Brazilian companies are adopting it too

Google's EU user consent policy requires advertisers to obtain legally valid consent from users in the European Economic Area, the United Kingdom and Switzerland for cookies, where the law requires it, and for ad personalization, and to keep records of that consent. The Consent Mode documentation links the 2023 update to the reinforcement of this policy.

In Brazil, the Lei Geral de Proteção de Dados (Brazil's General Data Protection Law, LGPD, Law 13.709/2018) defines consent as a free, informed and unambiguous expression of will for a specific purpose (Article 5). Among the principles in Article 6 is necessity, which limits processing to the minimum required. Article 7 lists the legal bases that authorize processing, including consent and legitimate interest, and Article 8 deems generic authorizations void.

That is why Brazilian companies are also adopting consent-aware measurement: the banner, the signals sent to the tags and what the server passes on need to tell the same story. The legal basis for each processing activity is a decision for the legal team and the data protection officer (DPO), and this article is not legal advice.

First-party data: what it is and where it fits

First-party data is the data a company collects directly through its relationship with customers and visitors: website and app events, registrations, purchases, customer service and CRM. Third-party data, by contrast, is collected by another organization.

The company's own server is where this data gets its rules: it receives events on a company domain, applies consent and minimization, and feeds platforms and the data warehouse. The article on marketing data governance covers who is responsible for this work.

Governance: who owns the server and the data

• Server owner: the responsible department, cloud contract, recurring budget and monitoring.
• Change control: who publishes container versions, with review and history.
• Minimization: allowed fields per destination and removal of personal data that appears by accident, such as emails in URLs.
• End-to-end consent: the banner signal reaches the web tags, the server and the APIs.
• Roles and contracts: who is the controller and who is the processor in each flow, with contracts reviewed by the legal team.

Step-by-step implementation

• Inventory the current tags: what each one collects and where it sends it.
• Define purposes, legal bases and behavior by consent category with the legal team and the DPO.
• Design the event plan and the data dictionary.
• Set up the server on a first-party domain, with a test environment.
• Migrate destinations in waves and compare the numbers in parallel with the old collection.
• Connect the conversion APIs with deduplication and CRM events.
• Implement Consent Mode v2 and validate the signals in each consent state.
• Monitor event volume by source, discrepancies and server cost.

Common mistakes

• Treating server-side as a way to get around blockers or consent refusals.
• Sending the same event from the browser and the server without a shared ID.
• Passing everything the browser used to collect to the server, without reviewing the fields.
• Setting up the server without an owner, a budget or cost alerts.
• Configuring Consent Mode with categories different from those the banner shows.
• Comparing before and after without a parallel period, attributing market fluctuations to the architecture.

Hypothetical example: an implementation in three waves

The following case is hypothetical and illustrative, with no client or market data. Imagine an equipment manufacturer with an e-commerce store for resellers, leads from key accounts and traffic in Brazil and Portugal.

In the first wave, the team sets up the server on a first-party subdomain and routes analytics events through it, keeping the old collection running in parallel for a few weeks. Along the way, it finds forms that were sending emails in URL parameters, which are now removed on the server.

In the second, it connects the Meta Conversions API and Google Ads enhanced conversions, with an ID per event sent through both paths. The CRM starts sending the qualified opportunity back to the platforms, in addition to the completed form.

In the third, the legal team and the DPO define the behavior by region: for Portugal, consent denied by default; for Brazil, the configuration that follows the chosen legal basis. In the end, the company has a map of who sends what, where and under which authorization, and a conversion count that platforms and the CRM can reconcile.

Frequently asked questions about server-side tracking and Consent Mode v2

What is server-side GTM?

It is the use of Google Tag Manager with a container that runs on a server controlled by the company, not in the visitor's browser. The browser sends events to this server, which receives them through clients, applies rules and forwards each event to analytics tools and media platforms, according to what the company decides.

Does server-side tagging remove the need for consent?

No. Changing where the tag runs does not change the obligations regarding personal data: if collection depends on consent in the browser, it still depends on consent on the server. Server-side helps with compliance, because it allows fields to be removed and destinations to be controlled, but it is not a way to get around a user's refusal. Legal bases are defined by the legal team and the DPO.

What is the difference between basic and advanced Consent Mode?

In basic mode, Google tags do not load until the person responds to the banner; without consent, nothing is sent to Google. In advanced mode, tags load with consent denied by default and send cookieless measurements until consent is given. According to Google, advanced mode enables an advertiser-specific conversion model. The choice should be made together with the legal team.

Do companies operating in Brazil need Consent Mode v2?

Google's consent policy covers users in the European Economic Area, the United Kingdom and Switzerland, so Brazilian companies with traffic from those regions need to take it into account. For the Brazilian audience, the LGPD requires a purpose, necessity and a legal basis for each processing activity. Using Consent Mode to reflect the banner in the tags is a decision for the legal team and the DPO.

What is first-party data?

It is the data a company collects directly through its relationship with customers and visitors: website and app events, registrations, purchases, customer service and CRM. It differs from third-party data, which is collected by other organizations. To serve media and analytics, it needs a clear purpose, consent where required and someone accountable for its quality.

To structure this measurement layer, learn about the Data area.