server-side-tracking

Server-Side Tracking with Privacy Controls

Overview

Server-side tracking moves data collection from the user's browser to a server-controlled environment, providing greater control over what data is shared with third parties. Instead of loading third-party JavaScript directly in the browser (which sets third-party cookies and sends data to external servers without intermediation), a server-side container receives events from the client, processes them, and selectively forwards data to analytics and advertising endpoints. This architecture enables IP anonymization before data leaves the first-party infrastructure, consent-based routing of events, and reduced reliance on third-party cookies — directly supporting ePrivacy Directive Article 5(3) compliance and data minimization under GDPR Article 5(1)(c).

Architecture

Client-Server Flow

User's Browser
    │
    ├── Client-side GTM container (minimal)
    │   └── Sends events to first-party endpoint
    │
    ▼
First-Party Server Endpoint
(https://data.pinnacle-ecommerce.com)
    │
    ├── Server-side GTM container
    │   ├── Validates consent state
    │   ├── Anonymizes IP address
    │   ├── Strips unnecessary identifiers
    │   ├── Applies data minimization rules
    │   │
    │   ├── [If analytics consent granted]
    │   │   └── Forward to Google Analytics 4
    │   │
    │   ├── [If advertising consent granted]
    │   │   ├── Forward to Google Ads
    │   │   ├── Forward to Meta Conversions API
    │   │   └── Forward to other ad platforms
    │   │
    │   └── [If all consent denied]
    │       └── Log aggregate pageview count only (no PII)
    │
    └── First-party server logs (retention: 90 days)

Infrastructure Setup for Pinnacle E-Commerce Ltd

Server Container Hosting Options:

Pinnacle E-Commerce Ltd Configuration:

Custom Domain for First-Party Context

Using a subdomain of the main site domain ensures:

• Cookies set by the server container are first-party cookies
• Requests to data.pinnacle-ecommerce.com are same-site, avoiding third-party cookie restrictions
• Safari ITP and Firefox ETP do not apply cross-site tracking protections

DNS Configuration:

data.pinnacle-ecommerce.com  CNAME  server-container-abc123.run.app

Consent-Aware Event Forwarding

Consent Validation on the Server

Every event arriving at the server container includes the consent state from the client. The server validates this before forwarding:

Event Payload from Client:

{
  "client_id": "1234567890.1709000000",
  "event_name": "purchase",
  "event_params": {
    "transaction_id": "TXN-2026-0314-001",
    "value": 149.99,
    "currency": "EUR",
    "items": [{"item_id": "SKU-001", "item_name": "Widget Pro"}]
  },
  "consent_state": {
    "analytics_storage": "granted",
    "ad_storage": "denied",
    "ad_user_data": "denied",
    "ad_personalization": "denied"
  },
  "user_agent": "Mozilla/5.0...",
  "ip_address": "203.0.113.42"
}

Server-Side Routing Logic:

IP Anonymization

The server container anonymizes IP addresses before forwarding to any third party:

Anonymization Rules:

Pinnacle E-Commerce Ltd Policy:

• GA4: Forward anonymized IP (last octet zeroed) for geographic reporting
• Google Ads: Forward anonymized IP for conversion geo-attribution
• Meta CAPI: Do not forward IP; send hashed email only (with aduserdata consent)
• Internal logs: Retain full IP for 24 hours for security/fraud detection, then anonymize

Data Minimization at the Server Layer

The server container strips data before forwarding:

Server-Side Tag Configurations

GA4 Server-Side Tag

Meta Conversions API Tag

First-Party Cookie Management

The server container can set first-party cookies via Set-Cookie headers, giving them longer lifetimes than client-side JavaScript cookies (which Safari ITP caps at 7 days):

All cookies above are set only when the corresponding consent category is granted.

Monitoring and Debugging

Server Container Health Checks

Data Flow Audit

Monthly audit of server-side tracking:

1. Compare client-side events sent vs. server-side events received (expect < 2% loss)
2. Verify consent state is correctly parsed for all forwarded events
3. Confirm no PII is forwarded to destinations where consent is denied
4. Check that IP anonymization is applied before all third-party forwarding
5. Validate first-party cookie durations match policy
6. Review server logs for any unexpected outbound connections

Key Legal and Technical References

• ePrivacy Directive 2002/58/EC, Article 5(3) — Consent for device storage/access; server-side cookies still require consent if non-essential
• GDPR Article 5(1)(c) — Data minimization principle; server-side filtering reduces data shared with third parties
• GDPR Article 28 — Data processor requirements for server hosting providers
• GDPR Article 44-49 — Transfer restrictions if server container is outside EEA
• Google Tag Manager Server-Side Documentation — Container setup and tag configuration
• Meta Conversions API Documentation — Server-side event forwarding for Meta advertising
• Safari Intelligent Tracking Prevention (ITP) — Client-side cookie limitations driving server-side adoption
• CNIL Deliberation No. 2020-091 — Server-set cookies still subject to consent requirements