Server-side tracking in 2026: why and how
How to set up server-side GTM, Meta CAPI and Google Enhanced Conversions. Recover 15-30% of tracking lost to adblockers, Safari ITP and Firefox privacy.
Server-side tracking recovers 15-30% of conversions lost in 2026 due to: (1) adblockers (uBlock, AdBlock Plus), (2) Safari ITP (limits third-party cookies to 7 days), (3) Firefox privacy (blocks fingerprinting). The 3 key components are: server-side GTM (Cloud Run), Meta CAPI (Conversion API) and Google Enhanced Conversions with SHA-256 hash of personal data.
What is server-side tracking?
Server-side tracking is the technique of sending conversion events from an owned server (instead of the browser) toward ad platforms (Meta, Google, TikTok, LinkedIn). This avoids adblocker blocks, Safari ITP restrictions and Firefox limitations.
It is composed of: (1) server-side GTM container deployed on Google Cloud Run (or AWS, direct GCP), (2) Meta CAPI (Conversion API) that receives server-side events, (3) Google Enhanced Conversions with SHA-256 hash of email/phone. Measurable impact on eXprimeNet-managed accounts: 22% average recovery of "invisible" client-side conversions.
5-step implementation method
- Deploy server GTM on Cloud RunGoogle’s official Docker container, deployed on Cloud Run with 512MB minimum memory. Cost: €5-30/month for medium traffic (500K-2M events/month).
- Configure metrics.yourdomain.com subdomainPoint CNAME of metrics.yourdomain.com to the Cloud Run container. Using an owned subdomain (not a Google domain) is critical so cookies are considered first-party.
- Migrate GA4 and Meta CAPI tags to serverIn the client container (browser), replace direct GA4 tags with "GA4 client + server proxy". On the server, GA4 tag to measurement_id and Meta CAPI tag to pixel_id.
- Google Enhanced Conversions with hashOn each conversion event, include user_data with SHA-256 hashed email and phone. Google uses these hashes for offline matching without exposing PII. Recovers 10-18% additional conversions on Google Ads.
- Validate in Meta Events Manager and GA4 DebugMeta Events Manager: check server-side events arrive with unique event_id (deduplication with browser) and match quality > 6/10. GA4 Debug View: check events are correctly attributed to source.
Frequently asked questions
How much tracking is recovered with server-side?
Average measured in eXprimeNet-managed accounts: 22% additional conversions. Typical range: 15-30% depending on % Safari traffic + % adblocker users.
Does it replace browser tracking?
No. Server-side complements, not replaces. Browser continues sending events and server-side deduplicates with common event_id. Both are necessary.
How much does implementation cost?
Cloud Run: €5-30/month depending on traffic. Technical implementation (one-time): 30-80 hours of specialised work (€3,000-8,000 in consultancy).
Is it GDPR-compliant?
Yes, if implemented with proper Consent Mode v2. Server-side events also respect user consent status; without consent, they are not sent.
Is Meta CAPI mandatory?
Meta strongly recommends it and has penalised accounts without CAPI in the algorithm since 2023. In critical accounts it is de facto mandatory to maintain performance.
Technical implementation of server-side GTM, Meta CAPI and Google Enhanced Conversions in 2026
Server-side tracking is the #1 lever to recover "invisible" conversions in 2026. Without it, between 15% and 30% of conversions are not properly attributed and campaigns optimise with incomplete data. At eXprimeNet we implement this layer in over 60 managed accounts.