Server-side tracking and GDPR: what changes and what doesn't

The European Data Protection Board (EDPB) adopted Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive, version 2.0, on 7 October 2024¹. The guidelines apply their analysis to a non-exhaustive list of use cases: URL and pixel tracking, local processing, tracking based on IP only, intermittent and mediated IoT reporting, and unique identifiers¹.

We do not summarise the legal analysis here. The practical point is narrower. Pixel tracking is on the EDPB's list, and a vendor page saying "server-side" does not take it off. A tracking pixel sends visitor actions from the browser to an ad platform. Moving the next hop to your server does not change what the browser did first.

Whether a particular setup of yours falls under Article 5(3) is a legal judgement. We describe the technique. Your counsel decides.

A browser tag runs on the visitor's device and sends what it likes to the vendor. A server container receives the event first, on infrastructure you control, and then forwards it. That gives you real levers:

• What leaves. You can drop or trim fields before they reach an ad platform.
• Where it goes. You decide which vendors receive which events.
• What you can show. You have one place to inspect what is actually sent.
• Your own data. It makes it easier to work with first-party data, meaning data you collect from your own orders, accounts and sign-ups.

Meta's server route is the Conversions API (CAPI), which sends events from an advertiser's server to Meta.

What a server container does not do is create permission. It is a pipe. Control over the pipe is useful. It is not consent.

Short version for GTM server-side and EEA consent with the Google tag: the consent state is still set in the web container, in the visitor's browser, and then passed on. Google's developer documentation on server-side Tag Manager says you set up consent in the web container, and that server containers support both basic and advanced Consent Mode². The Google tag adds the consent state to the request it sends to the server container, and Google's own server-side tags adjust what they send to it². The page does not cover other vendors' tags, so check how each of them reads the consent state.

In practice, that means three things:

1. The consent banner (your consent management platform, or CMP) has to record the visitor's choice.
2. The web container has to pass that choice on to the tags.
3. The server container has to respect it when it forwards events.

If any link breaks, the server happily forwards data it should not, or silently forwards nothing. Both are tracking problems and one may be a legal one.

Google also has its own EU user consent policy. Its help page names two consent signals for EEA users: one for sending user data to Google for advertising and one for ad personalisation³. Moving tags to a server does not remove the need to pass them.

Watch for these:

• "GDPR-compliant tracking." Compliance is a legal assessment of how you process data, not a feature of a tool.
• "Server-side means no consent needed." The guidelines above look at what happens on the device. See the first section.
• "First-party means exempt." First-party describes who runs the endpoint. Whether consent is needed is a legal question, and the label does not answer it.
• "Google Tag Manager is GDPR compliant." That is the question behind searches for Google Tag Manager GDPR compliance. A tag manager is a container for tags. What the tags do, and what you tell the user, decides the outcome. Vendor guides on this topic are sales material until your counsel agrees.

Our view: treat "compliant" on a vendor page as marketing. Ask what the claim covers and who carries the risk.

Bring a short list, and get answers in writing:

• Which tags and events need consent in your markets, and on what basis?
• What the banner must say and offer. That includes cookie walls: banners that block access unless the visitor accepts. A law firm's blog (Hunton) reported in May 2020 that the EDPB had updated its guidelines on consent under the GDPR (Guidelines 05/2020), and that they address cookie walls and scrolling as consent⁴. What they mean for your banner is for your counsel.
• Which fields the server container may send to which vendor.
• How long you keep event data, and how deletion requests reach the server side.
• Who owns the decision when the answer changes.

One more topic belongs on the list: the Digital Markets Act (DMA). Agencies have written about it for Google advertisers, for example Incubeta's article "What the Digital Markets Act (DMA) Means for Google Advertisers"⁵. We do not summarise it. Whether and how the DMA affects your setup is for your counsel.