Server-side tracking that keeps delivering under GDPR

Server-side tracking is not a universal prerequisite for lawful GA4 use. The legal basis, required consent, data scope and contracts must fit the actual setup. Data controls and operating requirements determine whether a server container is useful. Consent can also be checked in the browser with Tag Assistant.

One possible cause is a browser pixel and Conversion API running in parallel without suitable deduplication. Check the event or transaction IDs required by each destination, tags firing more than once and reconciliation with orders.

Yes, following the same pattern: capture the click ID, send events from the server container, consent signal in front. The six core platforms (Google, Meta, TikTok, LinkedIn, Criteo, Outbrain) are documented in the catalog; further destinations are added per project through the same server container.

Consent Mode V2 communicates user choices to Google tags, which adjust their behaviour. Basic blocks Google tags until consent; Advanced can send limited, cookieless measurement when storage consent is denied. This is not automatically anonymous or legally permitted. The CMP and checks for other destinations remain necessary.

A Google Tag Manager container that processes events on a server. It provides an additional place for data filters and destination controls. Your own endpoint guarantees neither immunity from blockers nor longer cookie lifetimes.

A server-to-server interface that reports conversions directly to Meta, Google and others, independent of the browser pixel and therefore more robust.

We first identify the technical losses that actually occur. Your own endpoint can improve the transmission path but browsers and blockers can still restrict it. We configure data filters and consent rules for each destination and inspect outgoing requests. This does not replace required consent.

Consent Mode V2 controls how Google tags react to the consent state, it does not replace a full CMP implementation. Used correctly they work together: the CMP owns the consent decision, Consent Mode V2 transmits the state correctly to Google services. Without a CMP behind it, Consent Mode V2 is just an API.

Pure event tracking is not affected by the EU AI Act. The Act becomes relevant the moment analytics data drives automated decisions: BigQuery ML for lookalike audiences, custom LLMs for content personalisation, predictive scoring in the CRM. Those pipelines need risk classification, data-provenance documentation and, in the high-risk case, an external audit. The EU AI Act takes effect in phases: many central obligations become relevant from 2 August 2026, with further rules into 2027. We document this in the Measurement Blueprint from day one.

The Frankfurt region on Google Cloud keeps data inside the EU legal space. Third-country transfer becomes the exception rather than the default, and Standard Contractual Clauses cover those exceptions. The residual risk stays: Google is a US parent company and therefore within CLOUD Act reach. Where that matters we harden with CMEK and external key management, described on the [Marketing Data Lakehouse](/en/services/marketing-lakehouse/) page.

A measurement blueprint connects business questions with event definitions, sources, destination mappings and acceptance criteria. A data contract adds quality targets, permitted usage, ownership and versioning. Tests and runtime checks enforce the agreed rules. Guide and template: [Measurement Blueprint](/en/blog/measurement-blueprint-tracking-projects/).

Your dev team implements the tracking, against our Measurement Blueprint. We write the spec, stay available for questions, and take over full QA and everything after implementation. Deliberate stance against vendor lock-in: the code stays with you.

Yes, apps use Firebase Analytics as the foundation, websites use GA4 or Plausible. Event schemas differ, consent architecture differs (app consent vs. browser consent), and QA methodology is technically different. We cover both worlds.

Audit Sprint: €1,490 net, report in 3 working days. One website, one GA4 property, one web GTM container, one CMP, one ads account and up to three conversion paths. Evidence, action plan and a 45-minute review. From the agreed start with complete access and documents. Scope and delivery date are agreed before commissioning. Implementation is separate, with no follow-up obligation. Larger tracking setups: Audit Sprint Plus: from €2,900 net, report in 5–7 working days. One brand, up to two domains and GA4 properties, one web and one server GTM container, one CMP, two ads platforms and five conversion paths; one existing shop or CRM export. Evidence, action plan and a 60-minute review. From the agreed start with complete access and documents. Scope and delivery date are agreed before commissioning. Implementation is separate, with no follow-up obligation.

Yes, the Usercentrics certification (CMP Expert tech track, since June 2026) gives us direct escalation paths and early sight of product changes, not an obligation to recommend. Cookiebot stays our default for SMB setups, OneTrust fits group-wide privacy suites, and where a stack runs without consent-requiring services, we advise a banner-free architecture. All partnerships are listed openly on /en/integrations/.

OneTrust is technically usable at any company size, but the license cost and configuration overhead are usually oversized for SMBs. For smaller companies we typically recommend Usercentrics (DACH market leader) or Cookiebot. We recommend what fits, not what we happen to know best.

Yes, migrating from an existing agency setup is the standard case. We usually start with an Audit Sprint: inventory of the current setup, prioritised defect report, migration plan. Depending on the depth of the existing issues, we decide together whether cleanup or rebuild is more economical. Vendor lock-in is never an argument: all GTM containers, BigQuery exports and CMP configurations stay in the client's ownership.