Server-Side Tagging and Tracking: Why GDPR Consent Still Applies

Tag managers are moving to the server. Google Tag Manager's server container, Tealium EventStream, Adobe Event Forwarding, Segment and hosted services such as Stape all let you send events to a server you control and forward them from there, either on a subdomain such as data.example.com or on a path of your main domain such as example.com/metrics. None of this changes what the GDPR and the ePrivacy rules ask for: consent before analytics and advertising cookies, and a legal basis for every piece of personal data you send to an ad or analytics platform.

What changes is the route consent has to take. The banner still runs in the browser, but the decision to send data to a vendor is now made on your server, so the visitor's choice has to travel with every event.

Server-Side Tagging and Tracking: Why GDPR Consent Still Applies

Two ways to run tags on your own domain

	Subdomain	Path on your main domain
Example	data.example.com	example.com/metrics
How it's set up	A DNS record points the subdomain to your tagging server	Your CDN or reverse proxy routes the path to your tagging server
What it changes	Requests and cookies are first-party	Requests are same-origin, so tag scripts and events load like the rest of your site
Still needs consent	Yes	Yes

Safari limits the lifetime of cookies set by a subdomain that points to a different IP address than your main site, which is one reason more setups now use a path on the main domain. For consent, the choice makes no difference: in both cases the tags and cookies are yours, and so is the responsibility.

Why server-side tagging doesn't remove consent

Four assumptions come up often, and none of them holds.

• "Server cookies aren't cookies." A cookie set by your server is still stored on the visitor's device. The ePrivacy rules cover storing and reading information on a device, whatever sets it.
• "First-party means exempt." There is no first-party exemption. A first-party cookie used for analytics or advertising needs consent just like a third-party one. The EU's Digital Omnibus may exempt some first-party measurement in future, but it is still a negotiating text, not law.
• "The browser never talks to the vendor, so it's fine." The GDPR applies to the personal data you forward, such as IP addresses, hashed emails and order details, whether it leaves from the browser or from your server.
• "Ad blockers can't see it, so it doesn't count." Hiding requests from blockers doesn't change the legal requirement. The visitor's choice in your banner still decides what you may collect.

Server-side tagging is still worth doing. You decide what leaves your infrastructure: you can drop IP addresses, shorten user agents and remove fields a vendor doesn't need before forwarding, which supports data minimisation under the GDPR. It just needs the same consent signal as browser tags, delivered in a different way.

Where server-side setups leak

The server forwards events without checking consent

A server container or event pipeline forwards what it receives. Google's tags read Google Consent Mode and adjust what they send, but most other connectors, such as the Meta Conversions API, TikTok Events API, LinkedIn and the OpenAI Conversions API used for ChatGPT Ads, don't check consent on their own. Left on default settings, they send every event, including events from visitors who refused.

Scripts from your own domain run before the banner

When your tag manager or CDN serves tag scripts from your domain and adds them to your pages, you may no longer control the order they load in. If they run before your CMP has set consent, they can set cookies and send data before the visitor has seen the banner. This is known as a late consent signal. Google Tag Gateway's one-click CDN setup is a common example.

Domain-based checks stop working

Script blockers and simple tag audits recognise trackers by their domains. Once everything loads from your own domain, they can't tell a tracker from your own code, so check consent against the requests your site actually sends.

Server-set cookies are missing from the cookie policy

Cookies set by your tagging server carry your domain and are easy to miss. They still have to be listed in your cookie policy and covered by the banner. A cookie scan finds first-party cookies too.

How to pass consent to server-side tags

1. Load the CMP first. If your tags load from your own domain, serve the banner the same way so it isn't slower than the tags: UniConsent supports a first-party CMP domain.
2. Send the choice with every event. Add the consent state to each event the browser sends to your server: Google Consent Mode values for Google, the IAB TCF string for ad vendors that read it, and purpose or vendor flags for everyone else.
3. Check consent on the server before forwarding. Each vendor connector fires only when the matching purpose or vendor is allowed.
4. Keep a record. Send the consent ID with each event so you can show which choice every forwarded event was based on.

In server-side Google Tag Manager, the most common setup, Google's own tags pass Consent Mode to the server container for you, so Google Analytics and Google Ads follow the visitor's choice. Other tags in the container don't. Forward the consent value you need from the web container and add it to the trigger of each Meta, TikTok, LinkedIn or OpenAI tag.

How UniConsent fits any server-side setup

UniConsent works with whichever tag manager you run on the server. It collects the visitor's choice once and makes it available to your tag manager's browser client:

• through the Consent Ready API and the JavaScript API, including the consent ID;
• as Google Consent Mode v2 values, set to denied for EU, EEA, UK and Swiss visitors before any Google tag runs;
• as IAB TCF and GPP strings for ad vendors that read them;
• by purpose, category and vendor in the data layer, for every other tag.

UniConsent is a Google-certified CMP and IAB TCF registered CMP. It comes with ready-made consent tags for the Meta Pixel, TikTok Pixel and Microsoft UET, and custom vendors for platforms outside the IAB TCF, such as OpenAI. Consent Logging keeps a record of every choice. For Google's own server-side tools, see the setup guides for server-side GTM and Google Tag Gateway.

Start a free trial or check your site now with the free Consent Mode Checker.

Server-side tagging consent checklist

• The CMP loads before any tag, including scripts served from your own domain.
• Every event sent to your server carries the visitor's consent state.
• Every vendor connector on the server fires only with the matching consent.
• Fields a vendor doesn't need are removed on the server before forwarding.
• Cookies set by your server are listed in your cookie policy.
• Refusing on the banner stops all ad platform traffic from your server. Test it before you go live.

FAQ

Does server-side tagging make my site GDPR compliant?

No. It gives you more control over the data you send, which helps, but consent is still needed for advertising and analytics cookies and for sharing personal data with ad and analytics platforms.

Do I need a cookie banner if my tags run on my own domain?

Yes, if you use cookies or similar technology for analytics or advertising and have visitors in the EU, EEA or UK. Cookies set from your own domain are still cookies.

Is a subdomain or a path on my main domain better for consent?

Neither changes the consent rules. A path on the main domain avoids Safari's cookie limit for subdomains on a different IP address, but scripts served that way can load before the banner unless you control the order.

Can my server read the IAB TCF string?

Yes. Send the TC string with each event. Your server can check purposes and vendors before forwarding, and vendors that support the TCF can read it themselves.

Does Google Tag Gateway bypass consent?

No. The tags still follow Google Consent Mode, as long as your CMP sets consent before they run. UniConsent is built to do that.