Server-Side Tracking - An Overview

Server-side tracking is the new standard. A key benefit is the control it gives you over data flow, especially when it comes to user data. In this article, we'll dive into server-side tracking using Google Tag Manager as an example, discussing its advantages and exploring which user data actually gets sent.

First, let's tackle the big question:

What is server-side tracking?

In short: Server-side tracking is a method of data collection where tracking information isn't processed in the user's browser, but rather directly through the website operator's server before being forwarded to analytics or marketing tools.

The traditional tracking method is client-side tracking (CST), where a code snippet is embedded into the page—for instance, via Google Tag Manager. This snippet sends event data directly to third-party services like Google Analytics 4, Meta Ads, and others.

With this setup, your control over the sent user data (IP address, demographic data, etc.) is limited to whatever customization options the tool offers.

On top of that, it usually sets a third-party cookie, which often leads to a drop in both data volume and data quality.

Figure 1: Comparison of client-side and server-side tagging

With server-side tracking (SST), on the other hand, all data is first sent to your own server running, for example, the server-side Google Tag Manager. This ensures that no unwanted data transfers occur directly on the website from the user's browser. The transfer only happens inside the server-side Google Tag Manager. Through clear visibility into the data and additional configuration options like transformations, you can easily adapt this process to meet strict privacy standards.

Server-side tracking vs. client-side tracking

Traditional client-side tracking (CST) is still widely used, but it's increasingly hitting its limits. With CST, tracking scripts run directly in the user's browser, sending data like page views, clicks, or conversions to third-party tools. However, this approach is very vulnerable to modern tracking prevention measures like ad blockers, VPNs, Intelligent Tracking Prevention (ITP) in iOS/Safari, and various privacy regulations.

By contrast, server-side tracking (SST) takes a different approach, as described above: Tracking data is no longer sent directly from the browser to external tools, but goes to your own server first. This server acts as a proxy or central data hub through which all tracking requests flow. The server request is handled much like an API request, making it significantly less susceptible to blocking. Plus, all data processing takes place within your own infrastructure, substantially reducing risks when dealing with data protection authorities.

Another key difference is how cookies are used: While client-side tracking relies on third-party cookies—which are increasingly blocked by browsers—server-side tracking favors first-party cookies, which are considered more trustworthy and are much more resilient.

Why has server-side tracking become the standard?

While client-side tracking continues to lose reliability due to growing restrictions, server-side tracking offers a future-proof, high-performance, and privacy-friendly alternative—delivering much higher data quality and better control for businesses.

Here’s an overview of the benefits of server-side tracking:

• More data control: Unlike the rigid settings of external tracking tags, SST gives businesses full control over the data collected.

• Higher data quality: SST can often bypass ad blockers and tracking prevention mechanisms, which typically results in at least 12% more data based on our experience.

• Performance gains: Instead of calling multiple individual tracking tools directly from the browser, only a single server is contacted—saving resources and speeding up website load times.

• Data privacy compliance: Because processing happens exclusively within your own server infrastructure, it's much easier to stay compliant with legal requirements.

Server-side tracking and data privacy regulations

Server-side tracking doesn't just offer technical perks; it also puts you in a much better position regarding privacy laws. The key legal frameworks in Europe include the GDPR, the TTDSG, and the EU-US Data Privacy Framework. 

Here's an overview:

General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) mandates that personal data—information that can be linked back to a real person, such as name, email address, or IP address—may only be collected and processed with the user's explicit consent (e.g., via a cookie banner).

In effect across all EU member states since May 25, 2018, it forms the central legal framework for handling personal data in Europe. The GDPR requires companies to be transparent about what data they collect, for what purpose, and how long it's stored. Additionally, users must be able to object to processing or withdraw their consent at any time. For tracking, this means that without clear, freely given consent, no data may be collected or shared with third parties—even if the technology technically allows for it. GDPR violations can lead to hefty fines. Server-side tracking offers a real advantage here because data collection, storage, and forwarding can be centrally managed and thoroughly documented, making GDPR-compliant implementation much simpler.

Telecommunications Telemedia Data Protection Act (TTDSG)

The TTDSG (Telecommunications Telemedia Data Protection Act) complements the GDPR specifically for online services. It stipulates that no arbitrary user data may be stored or accessed—especially via cookies or similar technologies—without prior consent. The law took effect on December 1, 2021, bringing together core privacy requirements from the GDPR, the German Telemedia Act (TMG), and the Telecommunications Act (TKG). 

For online tracking, this specifically means: Setting any cookie that isn't purely technically necessary requires the user's active, informed consent, typically via a consent banner. Tracking methods that attempt to build user profiles without consent—including technologies like fingerprinting—are not permitted under the TTDSG. This raises the bar for data-driven online marketing activities and highlights the need for transparent, privacy-compliant tracking—something that's much easier to control with server-side tracking.

EU-US Data Privacy Framework

Particularly relevant for international companies is the new EU-US Data Privacy Framework, which facilitates transatlantic data transfers and has been in effect since summer 2023. Previously, sending personal data to US services was problematic because US authorities had broad legal access to it. The new framework provides greater legal certainty when using US services like Google or Meta—provided those services are certified under the new framework.

These are just a few of the laws affecting tracking, which is why having a clear understanding of your user data is so important.

Summary: Why does server-side tracking offer better privacy compliance?

With server-side tracking, your entire data processing pipeline can run through your own server infrastructure first. That means tracking doesn't happen directly on the user's end, but only after explicit consent is granted and with full control over data processing on your own server. This makes it much easier to meet privacy requirements through targeted anonymization, pseudonymization, or by restricting data sharing with third parties.

Overall, server-side tracking enables a much more privacy-compliant way of handling user data, keeping businesses in the driver's seat—which is absolutely vital under today's regulatory landscape.

What user data is sent with server-side tracking?

The good news: the absolute minimum.

What does that look like in practice? Taking Google Tag Manager as an example: When an event is triggered on the page, such as a click, an HTTP request is sent to the server-side Google Tag Manager. Naturally, the standard HTTP header information is included.
This includes things like:

• Timestamp

• IP address

• Page URL

• Approximate location (via IP address)

• Operating system

• Browser

• Screen resolution

• Device

Additionally, there are other parameters related specifically to your configuration. You can find detailed information in the documentation at [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers].

There are also parameters automatically captured by the Google tag for campaign optimization. These include:

• utm_source

• utm_medium

• utm_campaign

• utm_content

• utm_term

• as well as the Click ID

You should also pay close attention to which custom data is being sent along with your Google Tag Manager setup.

In the server-side Google Tag Manager, you can use transformations to specifically configure which data should be passed along, in what format, and which data should be blocked.

For a privacy-conscious implementation, the guiding principle should always be:
“Only track as much data as you genuinely need.”

The real challenge lies in keeping tracking to the essentials without missing out on the insights you need.

We'll set up proper server-side tracking for you

Internetwarriors is a team of experts across all areas of online marketing. One of our core specialties is web analytics and server-side tracking (SST). With extensive expertise and a deep understanding of the latest trends and technologies in digital analytics, we provide tailored solutions to optimize our clients' online presence.

That makes us a reliable partner if you're looking to set up professional tracking that gives you all the data you need for strategic decisions and monitoring your online marketing campaigns.

Feel free to get in touch with us today—no strings attached!