Italian consent management company iubenda published a long-form guide to server-side tracking on its blog, dated as updated on October 23, 2026, alongside a 16-page white paper titled "A Deep Dive Into Server-Side Tracking: The Foundation Most Marketers Are Missing." Both documents make the same central argument: routing website events through a tracking server can recover conversions lost to ad blockers and browser restrictions, but it does nothing to remove the legal requirement to obtain consent before tracking a visitor. The white paper itself carries no publication date.

In Short

Websites usually send information about what visitors do straight from the browser to companies like Google and Meta, and ad blockers and browsers stop a lot of it. Server-side tracking sends that information to one server the website controls first, which then passes it on, so less gets lost and the site decides what each company receives. According to iubenda, which sells consent software, none of this changes the rule that you still have to ask visitors for permission before tracking them.

Two documents, one company and a product on a waitlist

The blog guide, written by iubenda content specialist Alice Perseval, runs to 12 sections, from definitions through a platform-by-platform table to an eight-step setup checklist and a list of common mistakes. It links to the white paper as a free download: "No form, no email, just the PDF," according to the page. The PDF sits in iubenda's October 2026 uploads folder, but the document gives no date of its own. A companion article by the same author on server-side Google Tag Manager carries the same October 23, 2026 date.

The commercial context is plain. iubenda sells a cookie consent banner, a privacy and cookie policy generator and related compliance tools, and it is part of team.blue NV, the Belgian group that also owns consentmanager, CookieFirst and Complianz. The final page of the white paper is a pitch for iubenda's own server-side tracking offer, described as "server-side tracking and consent management working as one system." Links from the guide to that product page carry a campaign tag reading "sst_prelaunch."

That label matches the product's status. According to iubenda's server-side tracking product page, the service is marked "Coming soon," early access has not opened, and sign-ups go onto a waitlist. The page lists five destinations at launch: Google Ads enhanced conversions, LinkedIn, Meta (Facebook and Instagram), Pinterest and TikTok. It gives no launch date and no prices, and states that the service "runs on EU infrastructure" with no US provider in the processing path.

The guide and the white paper are therefore best read as the educational groundwork for a product iubenda has not yet released. Much of what they describe is accurate general background. A number of the statistics they rely on, however, carry qualifications the documents leave out.

The problem iubenda describes

Both documents open with signal loss. "Ad blockers, browser restrictions, and consent gaps now intercept a meaningful slice of signals from campaigns before it reaches your analytics or ad platforms," according to the guide. The white paper illustrates the effect with a hypothetical: "You make 100 sales, but Google reports 60." The blog version of the same sentence replaces Google with "your ad platform." Neither document presents the 40% gap as measured data; it is an example.

The white paper cites four figures from the IAB's State of Data 2024 report: 95% of data and advertising decision-makers expect continued signal loss, 61% expect it to be harder to collect demographic, preference and behavioral data from third parties, 73% expect measurement such as ROI and conversion tracking to become more difficult, and 72% expect their ability to use browser history or real-time signals to be reduced.

The figures match the IAB report, which was released on March 14, 2024 and based on a survey of more than 500 advertising and data experts at brands, agencies and publishers, conducted with BWG Strategy. One qualification matters. In the IAB report, the 73% and 72% figures answer a question about what would happen if Google deprecated third-party cookies in Chrome while privacy legislation kept expanding. That premise did not hold. As both iubenda documents themselves acknowledge, "Google confirmed in 2025 that Chrome will not remove third-party cookies after all." Google set out that change of course in April 2025. The survey answers therefore describe expectations under a scenario that was later abandoned.

iubenda argues the reversal does not end the problem. "Safari, Firefox, and Edge already restrict them, ad blockers keep spreading, and privacy regulations are still fully relevant," according to the guide. "The signal loss is real regardless of what any single browser decides."

On ad blockers, the white paper states that 29.5% of internet users worldwide use blocking tools. The figure links to a Backlinko page, which attributes it to GWI data for the second quarter of 2025 and defines the group as people who use an ad blocker at least some of the time. iubenda's product page uses a different framing of the same source, describing roughly one in three people in parts of Europe as ad blocker users. The same product page also states that Chrome "is following" Safari and Firefox in blocking third-party cookies, which sits awkwardly with the correction both of iubenda's longer documents go out of their way to make.

How the architecture works

In conventional client-side tracking, tags, pixels and scripts run in the visitor's browser and each one sends data directly to its vendor. Server-side tracking replaces those many direct connections with one. According to the guide, the browser sends events "to a single tracking server, and that server processes the data and forwards it to your analytics and ad platforms."

The guide lays out four steps. The browser sends an event, such as a click, sign-up or purchase, to the tracking server through a subdomain the site owns. The server receives it, usually inside what iubenda calls "a cloud-hosted environment that ingests events and applies your rules." The server then filters and enriches the event, dropping fields, hashing or removing personal details and adding context such as order value. Finally, it forwards the event server-to-server to destinations including GA4, Meta and Google Ads.

The most common implementation, according to iubenda, is a server-side Google Tag Manager container, shortened to sGTM. Google Tag Manager setups of this kind run two containers: a web container on the site and a server container in the cloud, which can be self-hosted or run by a managed provider. Google launched server-side tagging in Tag Manager in August 2020, at the time requiring a Google Cloud Platform server with a billing account.

iubenda draws a line between two terms that are widely used interchangeably. In the white paper's wording, "tagging describes the setup and tracking describes the goal." Tagging refers to the containers and triggers that process events; tracking refers to the user actions and conversions being measured.

Why the subdomain matters, and where it stops working

The resilience to blockers comes from the address the browser contacts. Because the browser talks only to the site's own subdomain, iubenda writes, "the request looks like first-party traffic rather than a known tracker, and it's less likely to trip the blocklist." The onward handoff to vendors happens server-to-server, "where ad blockers have no visibility."

iubenda presents this as a matter of consent rather than evasion. What survives, the guide argues, "isn't tracking that slipped past the blocker, but first-party measurement the user consented to, which was never what the blocker was built to stop." Both documents add a footnote that qualifies the claim: some blockers "block a tracking subdomain outright once they identify that its purpose is data collection," so server-side tracking "makes signal loss much less likely, but not impossible."

The documents are also specific about Safari. Intelligent Tracking Prevention caps cookies written by JavaScript in the browser at 7 days. Cookies set by a server in the HTTP response can last longer, "though Safari also caps these at 7 days where the tracking subdomain resolves to a third party," according to iubenda. "That means that how the subdomain is configured matters."

That caveat is the subject of recent technical debate. PPC Land reported on October 16 that Safari cuts server-set cookies to 7 days on cloaked tracking subdomains, with WebKit treating a subdomain as unrelated to the main site when the two IPv4 addresses share fewer than 16 leading bits. iubenda's documents do not go into that level of detail, nor do they discuss the path-based alternative, in which tracking requests go to a path on the main host rather than a separate subdomain.

Client-side and server-side compared

Both documents include a comparison table. Client-side tracking is described as offering low data control, accuracy "weakened by ad blockers and browser limits," a heavy load on the browser, a simple code snippet for setup and a cost that is "usually free." Server-side tracking is credited with high data control, accuracy that "holds up against blockers," a light page load, and a setup requiring "server infrastructure or a managed solution." Its cost line reads "hosting costs or a subscription with a dedicated tool."

The benefits claimed, and the evidence behind them

iubenda groups the benefits into four areas: accuracy and attribution, richer data, faster pages and a stronger compliance posture.

On accuracy, the white paper describes a five-step chain running from "complete, accurate data" through better platform optimization and "smarter bidding" to "more conversions, same spend" and "higher revenue and growth." The documents present the chain as a mechanism and offer no figures for how many conversions server-side setups typically recover.

On enrichment, the server can be connected to a CRM or order database to add information before an event is forwarded. According to iubenda, "Google's value-based bidding and conversion value rules are built for exactly this kind of input." The white paper's worked example is an online store running Google and Meta ads that attaches each purchase's profit margin, whether the buyer is new or returning and the customer's lifetime value, so bidding systems can pursue profit rather than top-line sales.

The page speed claim is where the evidence is thinnest. "Speed translates into revenue too: a site that loads in 1 second converts up to 3x better than one that takes 5 seconds," according to the guide. The figure links to research by the agency Portent, published on April 20, 2022, which drew on 20 sites and just over 100 million page views. In Portent's study, the 3x figure applies to business-to-business lead generation sites. For the six ecommerce sites in the sample, the comparable figure was 2.5x. Neither iubenda document mentions that distinction, and Portent's study did not measure the effect of server-side tracking on load times.

On first-party data, the guide states that "71% of brands, agencies, and publishers are increasing their first-party datasets," a figure from the same IAB 2024 report, which says it was nearly double the rate of two years earlier. The documents also cite a 2021 study by Boston Consulting Group, which found that companies linking all their first-party data sources could generate 1.5 times the incremental revenue from a single ad placement and twice the improvement in cost efficiency. The white paper phrases the first figure as "50% more incremental revenue"; the blog guide says "1.5 times." The two are arithmetically equivalent. The BCG research drew on 67 brands in Europe, the Middle East and Africa and is now five years old.

Compliance controls on the server

The compliance argument rests on the server being "the one checkpoint every event passes through." iubenda lists four controls it enables: forwarding only the fields a vendor needs, in line with the GDPR principle of data minimization; stripping, hashing or passing through personal data per destination; preventing third-party scripts from scraping the browser for information "they aren't authorized to collect"; and logging every data flow as an audit trail.

The documents are careful on hashing. "Attention: hashing is pseudonymization, not anonymization," according to the guide. "A hashed email is still considered personal data and needs a lawful basis." They add that each vendor sets minimum requirements for what an event must contain to be accepted and matched, "so how much you can strip depends on the destination."

The section both documents treat as decisive is the one on legal obligations. "Server-side tracking changes where your data is processed, not whether you need permission to process it," according to the guide. "If your tracking required consent when it ran in the browser, it still requires consent when it runs on a server." iubenda calls the opposite belief "the most persistent myth about server side tracking and GDPR."

The legal reasoning comes in two layers. The GDPR requires a legal basis for processing personal data under Article 6, and for most marketing tracking that basis is consent, according to iubenda. Separately, the ePrivacy Directive requires consent for storing or accessing identifiers on a user's device, "no matter where the data travels afterwards."

The white paper anchors this in the European Data Protection Board's Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive. The consent requirement, iubenda writes, "attaches to the moment something reads from or writes to a visitor's device, not to where the data travels afterwards," and the EDPB guidance makes no distinction based on whether a tracking server or an ad platform receives the data. The white paper's summary: "The rule follows the device, not the data."

Cookies do not vanish under this model either. According to the white paper, third-party cookies that vendor scripts used to set in the browser become "largely unnecessary," but sites still typically use first-party cookies to recognize returning visitors, now set by the server and therefore "more durable than browser cookies." Its conclusion: "fewer third parties in the browser, fewer third-party cookies, longer-lived first-party cookies. And because cookies are still in play, consent requirements stay exactly where they were."

In iubenda's description, a consent management platform remains the component that records each visitor's choice, and the consent setup must pass that choice to the tracking server so that it forwards only consented data. Because server-side processing is less visible to users than scripts in a browser, iubenda argues, "transparency matters more, not less." It identifies three requirements: a banner that explains server-side processing and why each vendor receives data, consent passed to every partner with each event, and a logged record of consent proof.

One problem is flagged as unresolved by design. "On a visitor's very first interaction, their consent status isn't known yet," according to the guide, and getting the consent layer and the server to communicate cleanly at that moment "takes careful setup." The white paper adds that failing to do so risks "gaps and lag."

The documents quote iubenda's chief marketing officer, Andreea Mandeal, from a piece she wrote for the IAB Tech Lab: without a reliable consent framework, first-party data "cannot be confidently used by any team downstream."

iubenda pairs server-side tracking with Google's Consent Mode. According to the white paper, "Consent Mode v2 works with 7 signals," of which analytics_storage, ad_storage, ad_user_data and ad_personalization tell each tag what it may do. In the advanced setup, Google tags send limited, cookieless pings when consent is denied, and Google models the conversions it cannot measure directly from patterns among users who did consent.

The division of labor, as iubenda frames it: server-side tracking "captures as much of your consented data as possible," while Consent Mode "covers what's left, filling the gap for users who decline" through aggregate modeling. "Most CMPs already come with Consent Mode built in," the white paper adds.

Platform mechanics and the setup checklist

The guide's platform table maps each destination to its server-side route. GA4 uses a server-side GTM container with a GA4 tag. Meta uses its Conversions API, usually connected via sGTM or a platform integration. Google Ads relies on enhanced conversions and server-side conversion tracking through the same container. TikTok, LinkedIn and Microsoft Advertising receive events through the TikTok Events API, the LinkedIn Conversions API and Microsoft's UET respectively. Shopify, WooCommerce and WordPress connect through sGTM or platform integrations, so purchases are recorded from the store rather than the buyer's browser. Because GA4 and Google Ads share the same server container, iubenda notes, setting up one "usually follows with little extra work" for the other.

The setup sequence differs slightly between the two documents. The white paper lists seven steps; the blog guide lists eight, adding a step to update privacy documentation so the privacy and cookie policy reflects the data flows and receiving vendors. The common steps are: set up the server layer; point a custom subdomain such as analytics.yourdomain.com at it with a DNS record; connect the consent platform "so nothing fires before a visitor has made their choice"; define what gets filtered, enriched or blocked; connect destinations; run client-side and server-side tracking in parallel "for a week or two" to compare numbers; and monitor the setup as platforms and rules change.

The guide also catalogs five common failures. Running a browser pixel and a server connection without deduplication counts the same purchase twice, and "inflated numbers are as misleading as missing ones." Unhashed personal data can end up in server payloads. A misconfigured subdomain can break the connection unnoticed "for weeks." Ignoring consent state in server payloads means that "forwarding unconsented events from a server is still unconsented tracking." And treating server-side processing as invisible to users runs against the transparency obligations described above.

Costs and staffing

The white paper's section on challenges is more candid than most vendor material. "Server-side tracking is not a plug-and-play switch," it opens. Running a server has an ongoing cost, whether that is a managed subscription or hosting and maintenance. Debugging becomes less visible because problems "now live on a server instead of in the browser." Most teams need some developer involvement for infrastructure, the subdomain and routing. And greater access to data "raises the stakes on disciplined data minimization. Collecting everything you can defeats the point."

On staffing, the white paper names five roles across three functions: marketing analysts to scope data and events, performance marketers to tie the setup to campaign goals, developers for setup and integration, data engineers to enrich and monitor data, and legal and compliance staff covering consent, laws and vendors. A managed solution shrinks the technical load "considerably," according to iubenda, "but the same functions still need a voice."

The self-assessment is framed as five questions about ad spend, the gap between reported and actual conversions, whether attribution drives budget decisions, first-party data strategy and whether data is already collected through a consent layer. iubenda's own conclusion is that the investment may not suit organizations with basic analytics needs and no ad spend, or those without a consent layer in place.

What iubenda's product page adds

iubenda's product page goes further than the two educational documents in one respect: it positions the coming service against the architecture the guide calls most common. According to the page, the service routes events "through a first-party gateway" with no server-side GTM container to host or maintain. It claims setup in "minutes" with no setup fee, compatibility with any consent tool, per-event consent records, and rules for GDPR, CCPA and Brazil's LGPD applied per user by location. A comparison table on the page groups rivals including Stape and JENTIS among providers that, in iubenda's characterization, leave consent integration to the customer. These are iubenda's own descriptions of a product that is not yet available, and none has been independently tested.

Why this matters for marketers

Server-side tracking has moved from a specialist analytics topic to a standard recommendation in a few years, and the browser environment has kept shifting under it. Safari blocked all third-party cookies by default in March 2020. An analysis covered by PPC Land in October 2024 estimated that about 129 million users run blockers that stop Google Analytics by default. Google introduced its tag gateway in May 2025 to serve tags from a path on the advertiser's own domain, and the Google Cloud integration reached general availability on June 1, 2026.

At the same time, browsers have begun acting on layers that first-party routing does not touch. A review of the Safari 27 beta found it blocks LinkedIn and Bing ad trackers by IP address, evaluating where a request goes rather than which domain served the script, and when iOS 27 shipped in September, Safari stopped resolving The Trade Desk's ad domain. iubenda's footnote, that subdomains can be blocked once identified as data collection endpoints, points in the same direction: routing changes the odds rather than guaranteeing delivery.

The more durable point in iubenda's documents is the legal one. A large part of the commercial pitch for server-side tracking across the industry rests on recovering data that browsers and blockers would otherwise stop. iubenda, which earns its revenue from consent tools, argues that none of that recovered data is usable without a valid consent record traveling with each event, and it cites the EDPB's reading of the ePrivacy Directive in support. Whether that view is shared by the vendors that sell server infrastructure without a consent layer of their own is a question the documents raise but, as marketing material for a rival approach, cannot settle.

Timeline

Summary

Who: iubenda, a Milan-based consent management company owned by team.blue NV, and content specialist Alice Perseval, author of the blog guide. The documents are aimed at advertisers, agencies and website operators who run paid media.

What: A blog guide and an undated 16-page white paper explaining server-side tracking, its claimed benefits for accuracy, enrichment, page speed and compliance, its costs, and the position that it does not remove GDPR and ePrivacy consent requirements. Several cited statistics carry qualifications the documents omit, and iubenda's own server-side tracking product is still on a waitlist.

When: The blog guide carries an updated date of October 23, 2026. The white paper is undated and sits in iubenda's October 2026 uploads.

Where: Published on iubenda's English-language blog. The legal analysis focuses on the European Union, citing the GDPR, the ePrivacy Directive and EDPB Guidelines 2/2023.

Why: Ad blockers, Safari and Firefox restrictions and consent refusals reduce the conversion data reaching ad platforms. Server-side tracking is widely promoted as a fix, and iubenda, which sells consent tools and is preparing its own server-side product, argues that data recovered this way is only usable when consent travels with every event.