Server-side tracking that keeps delivering under GDPR

GA4 itself remains usable, but keeping it defensible under GDPR without server-side gets harder every quarter. Three forces effectively make server-side mandatory: Safari ITP 2.3 caps client-side cookies at 7-day TTL, ML-based adblockers filter 25 to 40 percent of all GA4 calls, and Google Consent Mode V2 expects a server-validated consent state. Without sGTM you are optimising on filtered data.

Almost always the pixel and the Conversion API run in parallel without both paths carrying the same event ID. The platform cannot deduplicate and counts both reports. The shared event ID is therefore the first checkpoint in every tracking audit.

Yes, following the same pattern: capture the click ID, send events from the server container, consent signal in front. The six core platforms (Google, Meta, TikTok, LinkedIn, Criteo, Outbrain) are documented in the catalog; further destinations are added per project through the same server container.

A Google standard that checks before every tag whether consent exists. When it is missing, only modelled, aggregated data flows, nothing personal. Mandatory for Google Ads in the EEA.

A Google Tag Manager container that runs on your own server rather than in the browser. Signals are sent first-party, past adblockers and ITP.

A server-to-server interface that reports conversions directly to Meta, Google and others, independent of the browser pixel and therefore more robust.

A first-party subdomain (analytics.client.com) routes requests to a stape.io server container. Tags run server-side, the browser only sees your own domain. This is not a trick, it is an architectural shift: PII is filtered before it reaches Google, Consent Mode V2 runs in front, the audit log stays with you.

Consent Mode V2 controls how Google tags react to the consent state, it does not replace a full CMP implementation. Used correctly they work together: the CMP owns the consent decision, Consent Mode V2 transmits the state correctly to Google services. Without a CMP behind it, Consent Mode V2 is just an API.

Pure event tracking is not affected. The Act becomes relevant the moment analytics data drives automated decisions: BigQuery ML for lookalike audiences, custom LLMs for content personalisation, predictive scoring in the CRM. Those pipelines need risk classification, data-provenance documentation and, in the high-risk case, an external audit. The EU AI Act takes effect in phases: many central obligations become relevant from 2 August 2026, with further rules into 2027. We document this in the Measurement Blueprint from day one.

The Frankfurt region on Google Cloud means data stays within the EU legal space. That sidesteps the US CLOUD Act transfer problem before any anonymisation step. Standard Contractual Clauses then exist for the exceptions, not the default. This is the reading EU DPOs sign off on without discussion.

A complete technical spec doc that defines what gets measured, how events are named and which parameters carry which values. The foundation for dev-team implementation and downstream QA validation. Not a concept paper for the drawer.

Your dev team, against our Measurement Blueprint. We write the spec, stay available for questions, and take over full QA and everything after implementation. Deliberate stance against vendor lock-in: the code stays with you.

Yes. Apps use Firebase Analytics as the foundation, websites use GA4 or Plausible. Event schemas differ, consent architecture differs (app consent vs. browser consent), and QA methodology is technically different. We cover both worlds.

Audit Sprint at a fixed price of €2,400 net, 10 working days delivery. Includes prioritised defect list, concrete action plan and a 90-minute walkthrough call. Complex setups across multiple brands or app + web + shop run through Audit Sprint Plus at €3,900. No follow-on contract.

Yes. The certification (CMP Expert tech track, since June 2026) gives us direct escalation paths and early sight of product changes, not an obligation to recommend. Cookiebot stays our default for SMB setups, OneTrust fits group-wide privacy suites, and where a stack runs without consent-requiring services, we advise a banner-free architecture. All partnerships are listed openly on /en/integrations/.

OneTrust is technically usable at any company size, but the license cost and configuration overhead are usually oversized for SMBs. For smaller companies we typically recommend Usercentrics (DACH market leader) or Cookiebot. We recommend what fits, not what we happen to know best.

Standard case. We usually start with an Audit Sprint: inventory of the current setup, prioritised defect report, migration plan. Depending on the depth of the existing issues, we decide together whether cleanup or rebuild is more economical. Vendor lock-in is never an argument: all GTM containers, BigQuery exports and CMP configurations stay in the client's ownership.