Setting up server-side tracking

Google Tag Manager server container on your own domain
You decide which data goes to which provider
Setup, tests with and without consent, ongoing support

Server-side tracking enquiry

Customer satisfaction

4.9

Based on 32 reviews

What is server-side tracking?

Server-side tracking: measurement through your own server

With conventional tracking, the browser sends every event directly to Google Analytics, Google Ads, Meta and other providers. With server-side tracking, the event first goes to your own server, usually a Google Tag Manager server container on your domain, as a path or subdomain. Only there do you decide which data goes to which provider and in what form. Until you choose to send it elsewhere, only you have access to the data in the server. If the server runs with a cloud provider, that provider also processes the data on your behalf. Our knowledge article client-side vs server-side tracking explains the difference to tracking in the browser.

How it works

The website still loads a lean tag in the browser. It sends events such as page views, enquiries or purchases to the server container. There, clients process the request and tags forward the data to the destinations, such as GA4, Google Ads enhanced conversions, the Meta Conversions API or the OpenAI Conversions API for ChatGPT ads. Fields a provider does not need can be shortened or removed beforehand.

Where the server runs

The usual choice is Google Cloud Run, which Google recommends in its documentation. Other clouds such as Microsoft Azure or your own server with Docker, for example at a hosting provider in Germany, are also possible. What matters is that the server is reachable on your domain: ideally as a path such as your-domain.com/metrics, as Google also recommends, or as a subdomain such as data.your-domain.com. Which environment fits depends on data volume, data protection requirements and existing IT.

What it costs

For the default configuration on Cloud Run, Google quotes around 45 US dollars per server per month and recommends at least two instances to reduce the risk of data loss if a server fails. Two servers therefore cost around 90 US dollars a month. With more traffic Cloud Run starts additional servers; Google expects 2 to 10 servers to handle 35 to 350 requests per second (Google’s guide as of May 2026, retrieved October 2026). On top come the one-off setup and maintenance: tags, consent and provider interfaces change regularly. We estimate the effort after reviewing your current tracking.

Diagram and comparison

Tracking in the browser and server-side tracking compared

Diagram: with tracking in the browser, the browser sends data to every provider directly. With server-side tracking it sends data to a server container on your domain, where you can shorten and filter the data and pass it only to approved destinations. — Top: the usual route. Bottom: the route via your own server. Both need consent. So that loading the Google tag does not go through Google either, the server container delivers the tag as well.

Comparison	Tracking in the browser	Server-side tracking
Where the browser sends data	to every provider directly	to a server on your domain, as a path or subdomain
Scripts in the browser	usually one script per provider	often only the Google tag
What a provider receives	everything its script collects	only what you approve in the server container
IP address and browser identifier	go to every provider	can be shortened or removed before forwarding, provided the Google tag is also loaded through the server
Cookies in Safari	from scripts, seven days at most	set by the server, longer if the server belongs to the website
Consent	required	required as well
Running costs	no server costs	from a few euros per server (own server), on Google Cloud Run around 90 US dollars a month for two servers, more with a lot of traffic, plus maintenance
Troubleshooting	visible in the browser	also in the server container

Pros and cons

What server-side tracking brings and what it does not

Server-side tracking is not an end in itself. It pays off when data quality matters for bidding strategies and analysis, or when you want precise control over which data goes to third parties. For a small website with few tags the effort is often greater than the benefit.

Better data for bidding strategies

Conversion interfaces such as the Meta Conversions API transmit conversions directly from the server, and Google Ads enhanced conversions add hashed customer data to them. This makes the data for Smart Bidding and analysis more complete and reliable, especially when browsers restrict scripts or delete cookies early.

Control over the data

The server acts as a checkpoint: you see what goes to each provider and can shorten IP addresses, remove parameters or switch off individual destinations entirely. This helps with data protection but does not replace consent. Whatever is already in the browser’s data layer is visible there anyway.

Flexibility

A server container can enrich data, for example with margins or stock data from your system, combine events and serve several destinations from one request. Destinations without a browser script can be connected as well.

Fewer scripts in the browser

When tags move from the browser to the server, the page loads less third-party code. How much this helps loading speed depends on the starting point. We measure it before and after the switch instead of promising a number.

Limits and effort

A server container has running costs, needs maintenance and has to keep up with every change by the providers. It does not make tracking without consent permissible and is not a tool for circumventing your visitors’ decisions. We discuss these limits openly before we start.

Do you have questions?

Wondering whether server-side tracking pays off for you? We look at your current tracking and tell you honestly what it brings.

Contact person:
Ahmed Badia
0228 243 313 54

Server-side tracking enquiry

Cookies and Safari

Cookie lifetimes: what Safari limits and what the server changes

Safari limits cookies set by a script in the browser to seven days. If a visitor comes from a website that Safari classifies as a tracker and the link contains parameters such as a click ID, it is only 24 hours. That is how the WebKit team behind Safari has set it. Anyone who returns after eight days then counts as a new visitor, and the cookie can no longer link an order to an earlier click.

A server container can set cookies in its response. Safari keeps these cookies longer, but only if the server really belongs to the website. If the subdomain points to a third-party provider via CNAME, or if its IP address is in a different network from the website (for IPv4, the first two number blocks already differ), Safari limits these cookies to seven days as well. Google recommends running the server container on the same address as the website anyway, for example at your-domain.com/metrics. If the requests then go through the same server or CDN as the website, Safari’s rule does not apply.

This does happen in practice. In one project we reviewed, the server container ran with a different hosting provider from the website, with an IP address from a different network. Under this rule, the identifier the server was meant to set for two years lasts only seven days in Safari. That is why we check how the subdomain and server relate to the website before every setup.

What the server does not change: Chrome still allows third-party cookies. Google abandoned the planned phase-out in July 2024 and in April 2025 also dropped a separate prompt for it. Firefox separates cookies per website. In private browsing, Safari removes known tracking features from links, and what the browser has already removed cannot be read by a server either.

Data protection

Data protection: what your own server changes and what it does not

Your own server does not make tracking exempt from consent. What matters is what happens in the browser: the script, the cookie, reading an identifier. The European Data Protection Board treats delivering a tracking script as an instruction to the device and considers collecting the identifiers the script sends back to be access (Guidelines 2/2023, para. 51). The guidance of the German supervisory authorities on digital services (as of November 2024) does not mention server-side tracking specifically and makes no exception for it.

What the server improves is control: you decide which data each provider receives and can shorten or remove the IP address, browser identifier or URL parameters before forwarding. We clarify these points with you and your data protection adviser:

Consent for all cookies and scripts that are not strictly necessary, even if the server sets them.
A legal basis under the GDPR for each purpose, usually consent.
A data processing agreement with the hosting provider, and whether it also uses data for its own purposes.
Server location and links to third countries. Certified US providers are covered by the EU-US Data Privacy Framework, against which an appeal is pending at the Court of Justice of the European Union (as of October 2026).
Data minimisation in the container: filter the IP address, browser identifier, URL parameters and free text.
Respect consent on the server as well. Google tags take the consent status into account themselves. For Meta, LinkedIn and others the check has to be set up and tested for each tag.
Server logs: by default, Google Cloud Run stores every request with path and parameters. Switch this off or limit retention.
Set cookie lifetimes and name them, together with the hosting provider, in the privacy policy.

This does not replace legal advice. But it makes sure your data protection adviser gets an answer to every technical question.

Hosting

Where the server container can run: options and costs

There are three ways to run the server. Prices are from the providers, as of October 2026.

Hosting	Cost per month	Suits you if	Keep in mind
Google Cloud Run	around 45 US dollars per server, Google recommends at least two	you already use Google Cloud or have a lot of traffic	billing account with Google, choose a region in the EU, configure logging
Specialised host, e.g. Stape	20 US dollars for up to 500,000 requests, 100 US dollars for up to 5 million, the same amount in euros in the EEA; free for testing up to 10,000 requests	you want to start quickly and run little yourself	billed by requests to the server, choose the location when creating it, cannot be changed later
Your own server with Google’s Docker image	a few euros per server, several plus a preview server are needed, plus operation	your IT wants to run the server itself, for example in Germany	several servers plus a preview server, updates, certificates and monitoring

What this costs in our projects: For live operation, our server containers run on Google Cloud with two or three fixed servers, each with one processor core and 0.5 GB of memory. Based on Google’s price list for Frankfurt, that is around 50 US dollars per server per month, 100 to 150 US dollars in total (as of October 2026).

We have set up server containers on all three routes. Which one fits depends on data volume, your IT’s requirements and your data protection requirements. More important than the price is that the server belongs to the website, as a path or as a subdomain in the same network, otherwise Safari applies seven days again.

Experience

Experience from three projects

Online retail with several shops: A server container supplies several shops with GA4, Google Ads and Meta. Over twelve months we reconciled more than ten thousand orders from one of the shops individually against Google Analytics. For the orders found, the value matched to the cent. That not every order appears in Analytics was mainly due to visitors without consent and orders created by customer service. Server-side tracking makes the figures verifiable, it does not invent additional conversions.

Mail-order retailer: Since 2024, GA4, Google Ads, Meta and the affiliate programme have run via a server container in Google Cloud, each tag bound to consent for its provider. Even after a change of shop system, orders kept arriving in the affiliate programme without interruption.

ROMA: At the manufacturer of roller shutters and sun protection, GA4, Meta and Google Ads have run via a server container on its own subdomain since December 2025, plus dealer enquiries as a separate event.

Individual solutions and transparent communication

Technical cooperation with Rheinwunder

We set up server-side tracking so that your team understands it and can continue it. We test every change with and without consent and document it. The result is reliable data for Google Ads, web analytics and your other channels.

Initial consultation

At the start we clarify goals, channels and framework conditions: which data do you need for what, which providers are connected, what does your data protection require? This phase forms the basis for the entire project.

Technical analysis and concept

We review your existing tracking: which tags run, which data goes to which provider and where the measurement gaps are. This results in a concept for which tags move to the server and which data each provider receives.

Implementation and configuration

We set up the server container, on Google Cloud Run, in another cloud or on your own server, connect it to your domain, as a path or subdomain, and move the tags. The consent from your consent tool controls which data goes to which provider.

Test phase and quality assurance

Before going live, browser and server tracking run in parallel. We compare the figures per provider, test with and without consent and fix any differences.

Go-live and monitoring

After the switch we monitor data quality and server load and report any deviations to you.

Continuous support and optimisation

On request we keep the server container up to date when Google, a provider or your consent tool changes something.

From our projects

Server-side tracking in practice

Two women in business wear work at a computer in a bright office, smiling.

Two observations from projects, anonymised: at one client, a review of the server container showed that confidential details were already in the browser’s data layer. A server container does not change that, data minimisation starts on the website. For a brand manufacturer we connected the OpenAI Pixel and the Conversions API for ChatGPT ads so that conversions from the new ad channel can be measured alongside Google Ads and Meta.

Server-side tracking enquiry

Data control instead of promises

We show you which data goes to which provider today and set up the server container so that only what you want is passed on. Whether you need consent depends on Section 25 of the German TDDDG for cookies and other access to the device, and on the GDPR for any further processing of the data. Your own server does not change that.

Conversion interfaces from one source

We connect Google Ads enhanced conversions, the Meta Conversions API and the OpenAI Conversions API through the same server container. That way all channels count by the same rules, together with our tracking switch.

Measuring loading speed, not claiming it

Fewer scripts in the browser can improve loading speed. Whether and by how much, we measure before and after the switch so that you can see the effect.

Technology and marketing in one team

Whoever sets up your server container works with the colleagues who use your campaigns and reports. That way we decide with you which data is really needed.

Prepared for change

Browsers keep restricting scripts and cookies, and Google keeps changing Tag Manager. We keep your server container up to date and check after every change that the data is still right.

Switching in parallel operation

Your existing tracking keeps running during the switch. Browser and server tracking measure in parallel for a while, and we only switch over once the differences are explained.

Frequently asked questions

Server-side tracking: the key questions

The most common questions on how it works, data protection, costs and the switch.

Does server-side tracking need consent?

As a rule, yes. Anyone who stores or reads information on the device, such as a cookie or an identifier, needs consent under Section 25 of the German TDDDG, unless it is strictly necessary for a service the user has explicitly requested. That does not change if the data then runs through your own server. The server helps to pass on only the data that is needed.

How does server-side tracking work with Google Analytics (GA4) and Google Tag Manager?

The website sends events to a Google Tag Manager server container. A client accepts the request, and tags forward the data to GA4, Google Ads and other destinations. A lean Google tag remains in the browser and sends the data to your own domain instead of directly to Google. So that loading the tag no longer goes through Google either, the server container delivers it as well.

What does server-side tracking cost?

For the server, Google quotes around 45 US dollars per server per month on Cloud Run and recommends at least two instances; with a lot of traffic it costs more. With specialised hosts such as Stape, the smallest paid plan costs 20 US dollars a month for up to 500,000 requests, 20 euros in the EEA, your own server at a few euros, plus the effort of running it. In our own projects, live operation with two or three fixed servers costs 100 to 150 US dollars a month. On top come setup and maintenance. We estimate the effort after reviewing your current tracking.

Does server-side tracking bypass ad blockers?

Partly. Some blockers do not filter requests to your own subdomain. We do not set up the server container to get around blockers and we do not disguise requests. Consent remains decisive: tags that need consent stay off without it. Server-side tracking is meant to reduce measurement losses from technical browser restrictions, not to get around your visitors’ decisions.

How complicated is the transition to server-side tracking?

That depends on the number of tags, channels and systems. We start with a review, set up the server container and run browser and server tracking in parallel for a while until the differences are explained. Only then do we switch over.

Who is server-side tracking suitable for?

For companies with several paid channels, conversion-based bidding strategies or strict requirements on which data may go to third parties, such as online shops, portals and providers with many enquiries. For small websites with few tags, well set-up tracking in the browser is often enough.

Does server-side tracking extend cookie lifetimes in Safari?

Only if the server belongs to the website. Safari limits cookies set by a script to seven days. Cookies set by the server may last longer as long as the subdomain does not point to a third-party provider via CNAME and its IP address is in the same network as the website. Otherwise seven days apply to them as well.

Where should the server container run?

On a subdomain or path of your website, with a location in the EU. Whether Google Cloud Run, a specialised host or your own server fits depends on data volume, your IT’s requirements and budget. The costs of the three routes are in the comparison above.

Does server-side tracking also work with Matomo or Piwik PRO?

Yes. Matomo and Piwik PRO do have their own tag manager, but it works in the browser. For server-side tracking, both providers describe the route via a Google Tag Manager server container with their own templates. Matomo can also be self-hosted as a Docker container, so that analytics and the server container run on your own servers. More on this in our knowledge article Docker.

Let us talk about server-side tracking

How much data are you losing today?

In an initial conversation we clarify where you stand today, which goals you are pursuing and how we can support you with server-side tracking. No obligation and with an honest assessment.

Customer satisfaction

4.9

Based on 32 reviews

Reviews from our Google Business Profile. We check every review against our client projects.

Server-side tracking enquiry

Ahmed BadiaSenior Software Developer Team LeadCall: 0228 243 313 54