How privacy-friendly is server-side tracking really?

Why is server-side tracking seen as a solution?

Server-side tracking gained a lot of attention as browsers and platforms started restricting tracking more and more. Safari and Firefox had already been limiting certain tracking techniques for some time, ad blockers became more effective, and Google announced plans to phase out third-party cookies in Chrome.

For marketers, this meant that less and less measurement data was becoming available. Server-side tracking was therefore increasingly used to make measurement more reliable and to gain more control over the data being sent to external parties.

Google eventually stepped away from its plan to completely remove third-party cookies from Chrome by default and instead chose to give users more control over that choice. By then, however, server-side tracking had already secured a permanent place within online marketing and analytics.

How is server-side tracking marketed?

Server-side tracking is often marketed as a way to recover ‘lost data’. Claims commonly include bypassing ad blockers and browser restrictions, enabling first-party tracking, and providing a more privacy-friendly or even ‘GDPR-proof’ way of measuring.

There is an interesting contradiction here. Ad blockers and browser restrictions are specifically designed to limit tracking and give users more control over their privacy. However, bypassing them does not automatically mean that you are ignoring a visitor’s privacy choices. An ad blocker can, for example, also block a measurement for which the user has already given consent.

The main question is therefore how you use server-side tracking. Are you making an authorised measurement technically more reliable, or are you mainly trying to collect data that a user or browser is deliberately trying to block?

Why is server-side tracking not automatically GDPR-compliant?

Because server-side tracking can run through your own domain, it can easily create the impression that the processing is therefore also ‘first-party’ and privacy-friendly. That is not automatically the case.

A browser may only see this:

website → analytics.yourdomain.com

But behind that server, the data flow can still continue:

analytics.yourdomain.com → Google / Meta / LinkedIn

Server-side Google Tag Manager makes this relatively easy. The browser sends an event to the server-side GTM container, after which GTM determines which data is forwarded to external parties. You can filter or remove data there, but you can also forward almost everything unchanged.

With traditional client-side tracking, you can often see requests to domains such as facebook.com or google-analytics.com directly in the browser. With server-side tracking, the browser may only see a request to your own domain, while the server subsequently forwards the data to external parties. This makes it less immediately visible to a visitor or browser-based scanner what happens to the data behind the scenes.

A first-party cookie or endpoint mainly says something about the technical route the data takes, not about who ultimately receives or processes it. Whether the processing is GDPR-compliant still depends on which data you collect, why you need it, what legal basis you have for processing it and which parties you share it with.

How can you set up server-side tracking in a more privacy-friendly way?

Start by determining which data you actually need and avoid collecting more than necessary. The GDPR and rules around cookies and tracking still apply when using server-side tracking. The fact that data first passes through your own server does not change that.

Then take a critical look at what you send to external parties. Is it really necessary to send a full URL, IP address or other identifiable information? Data that is not needed can be removed, limited or made less identifiable before it is forwarded.

That is where the potential privacy benefit of server-side tracking lies. You gain more control over the data flow and can use that control to deliberately share less data with external parties. The technology itself is therefore not automatically privacy-friendly; that depends on the choices you make about what you collect, process and forward.