Server-side tracking that keeps delivering under GDPR

Yes, GA4 remains legally usable in 2026; running it without server-side just gets thinner on data every quarter. Three forces argue for the move: Safari ITP caps JavaScript-set cookies at 7 days, adblockers filter a substantial share of GA4 calls depending on your audience, and Consent Mode V2 signals purely client-side, so only the server container lets you verify that signal before data leaves the building. Server-side is our recommendation, not a Google requirement. Without sGTM you are optimising on filtered data.

Almost always the pixel and the Conversion API run in parallel without both paths carrying the same event ID. The platform cannot deduplicate and counts both reports. The shared event ID is therefore the first checkpoint in every tracking audit.

Yes, following the same pattern: capture the click ID, send events from the server container, consent signal in front. The six core platforms (Google, Meta, TikTok, LinkedIn, Criteo, Outbrain) are documented in the catalog; further destinations are added per project through the same server container.

A Google standard that checks before every tag whether consent exists. When it is missing, only modelled, aggregated data flows, nothing personal. Mandatory for Google Ads in the EEA.

A Google Tag Manager container that runs on your own server rather than in the browser. Signals are sent first-party, past adblockers and ITP.

A server-to-server interface that reports conversions directly to Meta, Google and others, independent of the browser pixel and therefore more robust.

A first-party subdomain (analytics.client.com) routes requests to a stape.io server container. Tags run server-side, the browser only sees your own domain. This is not a trick, it is an architectural shift: PII is filtered before it reaches Google, Consent Mode V2 runs in front, the audit log stays with you.

Consent Mode V2 controls how Google tags react to the consent state, it does not replace a full CMP implementation. Used correctly they work together: the CMP owns the consent decision, Consent Mode V2 transmits the state correctly to Google services. Without a CMP behind it, Consent Mode V2 is just an API.

Pure event tracking is not affected by the EU AI Act. The Act becomes relevant the moment analytics data drives automated decisions: BigQuery ML for lookalike audiences, custom LLMs for content personalisation, predictive scoring in the CRM. Those pipelines need risk classification, data-provenance documentation and, in the high-risk case, an external audit. The EU AI Act takes effect in phases: many central obligations become relevant from 2 August 2026, with further rules into 2027. We document this in the Measurement Blueprint from day one.

The Frankfurt region on Google Cloud keeps data inside the EU legal space. Third-country transfer becomes the exception rather than the default, and Standard Contractual Clauses cover those exceptions. The residual risk stays: Google is a US parent company and therefore within CLOUD Act reach. Where that matters we harden with CMEK and external key management, described on the [Marketing Data Lakehouse](/en/services/marketing-lakehouse/) page.

A complete technical spec doc that defines what gets measured, how events are named and which parameters carry which values. The foundation for dev-team implementation and downstream QA validation. Not a concept paper for the drawer.

Your dev team implements the tracking, against our Measurement Blueprint. We write the spec, stay available for questions, and take over full QA and everything after implementation. Deliberate stance against vendor lock-in: the code stays with you.

Yes, apps use Firebase Analytics as the foundation, websites use GA4 or Plausible. Event schemas differ, consent architecture differs (app consent vs. browser consent), and QA methodology is technically different. We cover both worlds.

Audit Sprint at a fixed price of €2,400 net, 2 weeks delivery. Includes prioritised defect list, concrete action plan and a 90-minute walkthrough call. Complex setups across multiple brands or app + web + shop run through Audit Sprint Plus at €3,900. No follow-on contract.

Yes, the Usercentrics certification (CMP Expert tech track, since June 2026) gives us direct escalation paths and early sight of product changes, not an obligation to recommend. Cookiebot stays our default for SMB setups, OneTrust fits group-wide privacy suites, and where a stack runs without consent-requiring services, we advise a banner-free architecture. All partnerships are listed openly on /en/integrations/.

OneTrust is technically usable at any company size, but the license cost and configuration overhead are usually oversized for SMBs. For smaller companies we typically recommend Usercentrics (DACH market leader) or Cookiebot. We recommend what fits, not what we happen to know best.

Yes, migrating from an existing agency setup is the standard case. We usually start with an Audit Sprint: inventory of the current setup, prioritised defect report, migration plan. Depending on the depth of the existing issues, we decide together whether cleanup or rebuild is more economical. Vendor lock-in is never an argument: all GTM containers, BigQuery exports and CMP configurations stay in the client's ownership.