Server-side describes any part of an advertising system that runs on a machine the operator controls rather than on the device in front of the user. The opposite is client-side: JavaScript executing in a browser, a software development kit inside a mobile app, a player rendering video on a television set. The work itself does not change when it moves. A conversion is still counted, an auction still resolves, a commercial still plays. What changes is who holds the code, who can read the data, and who is in a position to block it.

The vocabulary is inherited from the client-server model of computing, in which one machine asks and another answers. Advertising adopted it because almost every function in the business started in the browser, where the audience was, and has since been pushed onto infrastructure operated by a publisher, an advertiser or a vendor. Tagging, auctions, conversion reporting and video insertion have each made that journey, at different speeds and for different reasons.

What each side can see

The two positions have different views of the same user. A browser reads the page, the screen dimensions, local storage and whatever a consent banner has recorded. A server sees only what reaches it: the HTTP headers of the incoming request, the originating IP address, the user agent string, cookies scoped to its own domain, and whatever payload the caller chose to send.

The server compensates with data the browser never had. Order values after refunds, subscription status, margin, lifetime value and offline purchases all live in back-office systems. Once a measurement pipeline runs on a company's own infrastructure, those fields can be attached to an event before anything is transmitted, and fields the company would rather not share can be stripped.

Tagging on the server

The largest single implementation is server-side Google Tag Manager, in which a server container receives measurement requests and fans them out to vendors. Google's documentation describes the tagging server as a Node.js application distributed as a Docker image, provisioned automatically on Cloud Run or manually anywhere Docker runs, with each instance configured through two environment variables, CONTAINER_CONFIG and PREVIEW_SERVER_URL. A separate preview server handles debugging and is not meant to scale beyond one instance. Google recommends a minimum of three instances per container for redundancy.

Inside the container, a client parses incoming requests into events and tags transform and forward them. The endpoint is meant to sit on a subdomain of the site being measured, which is the architectural point: cookies written by a server response on a first-party domain are not subject to the seven-day cap Safari's Intelligent Tracking Prevention applies to cookies written by JavaScript in a third-party context.

Auctions on the server

Header bidding began as a browser script and quickly ran into the cost of running dozens of parallel requests on a phone. Prebid Server moved the auction off the device: the page sends one request, the server calls the bidders, and the result returns in time for the ad server. The documented configuration names an account, a bidder list and a timeout, with 300 milliseconds in the reference example.

The transfer is not free. Bidders identify users by their own cookies, which a server cannot read, so Prebid Server maintains a uids cookie populated through a /cookie_sync endpoint and a /setuid endpoint, with stored identifiers treated as stale after seven days. Index Exchange's documentation states plainly that its browser adapter tends to achieve a better cookie match rate than the server-side route. Prebid's own guidance notes that the software does not add itself to the supply chain object by default, describing the deployment as a proxy rather than a participant in the money flow. The IAB Tech Lab has been positioning its Trusted Server framework alongside Prebid Server since March 2024, separating signal packaging and identity under publisher control from auction execution.

Conversions on the server

Platforms rebuilt conversion reporting on the same principle. Meta's Conversions API, launched as the Server-Side API before its rename, accepts events from an advertiser's systems and processes them like pixel events. Microsoft Advertising documented an equivalent endpoint mirroring the Universal Event Tracking model, with reference material dated August 4, 2026 and access restricted to a per-account pilot. OpenAI shipped the same pattern for ChatGPT advertising, pairing a browser pixel with a server route that sends purchase data straight from an advertiser's backend.

Running both paths at once creates a counting problem solved by a shared event identifier, which is why deduplication is a standing requirement rather than an optimisation. The proliferation of one-off integrations is what the IAB Tech Lab's ECAPI specification sets out to collapse into a single event schema.

Insertion on the server

In video the term means something more physical. Server-side ad insertion splices commercials into a stream before it reaches the device, producing continuous playback on hardware that cannot run a measurement kit. The cost is the beacon: counting moves to the stitching service, and the Media Rating Council's August 2021 guidance held that client-initiated counting remains the requirement, noting that server-to-server tracking arriving from a single address is vulnerable to invalid traffic filtration. IAB Europe's April 2026 connected television guide asked publishers to disclose whether impressions are measured server-side, client-side or through a hybrid.

Origin and evolution

Browser policy set the timetable. Vendors were arguing that client-side tracking had run out of road as early as December 2018, after Safari and Firefox tightened their protections. Intelligent Tracking Prevention 2.1, released on February 21, 2019, capped persistent JavaScript-written cookies at seven days and pushed whole channels onto server infrastructure.

Auctions moved earlier for performance reasons, with Prebid Server reaching Accelerated Mobile Pages through an integration with the format's real-time configuration in February 2018. Google opened server-side tagging in public beta on August 12, 2020 and declared general availability on September 23, 2021, the same announcement extending support to any provider running Docker. Five years later the company added first-party script serving through content delivery networks, a lighter architecture documented in full as the tag gateway for advertisers.

Why the industry moved

The case is signal recovery. Google reported an 11% uplift in observed signals for advertisers configuring first-party tag serving, and in its 2021 announcement cited a Danish grocer improving page load time by 7% and Square recording a 46% increase in reported conversions. All three are figures published by the platform. The performance argument is more durable than the measurement one: moving vendor code off the page removes requests from the critical rendering path regardless of what browsers do next.

Consolidation followed. Google began routing Shopify purchase events into Analytics server to server on an opt-out basis in July 2026, and Meta shipped a one-click Conversions API setup requiring no developer on April 27, 2026. Server-side is becoming a default configuration rather than an advanced project.

Limitations and disputes

The blocking argument has weakened. Filter lists began naming server-side Tag Manager subdomains individually in May 2026, with one AdGuard list carrying more than 3,400 rules against first-party tracking hostnames, 83 matching a gtm prefix and 42 matching sgtm. A diagnostic tool published weeks later showed named subdomains belonging to prominent practitioners already on lists shipped by default in uBlock Origin. Google's response was obfuscation, hiding container identifiers behind randomised serving paths documented on May 11, 2026.

Claims about recovered data come mostly from parties selling the infrastructure. A consultant at a server-side tagging vendor put the gap created by blocked subdomains at 5% to 40% depending on audience, a range wide enough to describe almost any outcome. A separate vendor analysis argued that server-side setups sidestep Safari 27's network-level blockingentirely, again from a company that sells the architecture.

Legal exposure does not move with the code. The Verwaltungsgericht Hannover ruled on March 19, 2025 that Google Tag Manager may not operate before explicit consent, an obligation attached to the processing rather than the hostname. Reliability is a further issue: two defects documented in September 2025 produced duplicate Analytics hits in server containers alongside misleading export estimates.

Not the same as

Client-side is the mirror term, not a legacy one. Most consent interfaces, viewability measurement and creative rendering still have to happen on the device.

Server-side rendering is a web development technique for generating HTML before it reaches the browser. It shares the adjective and nothing else.

First-party serving, including tag gateway and similar proxy arrangements, changes where a script loads from while leaving execution in the browser. The distinction matters because the two are routinely conflated, and a proxy sitting on an eTLD+1 does not process or transform anything.

Server-guided ad insertion marks breaks on the server but leaves the player to fetch and render the advertisement, a hybrid described in its own explainer.

Recent developments

Coverage through 2026 points in two directions at once. Adoption is widening, with four further Shopify events added to the Analytics mapping on August 17, 2026, only the purchase event travelling server to server. Resistance is widening too, as filter lists and browser network policies reach past the first-party boundary that made the architecture attractive. Microsoft's gated pilot, documented in September 2026, shows even large platforms rationing access to server endpoints rather than opening them.

Timeline

  • February 2018: Prebid Server reaches Accelerated Mobile Pages through the format's real-time configuration
  • June 2018: Safari ships Intelligent Tracking Prevention 2.0, tightening third-party cookie handling
  • October 2018: Firefox enables Enhanced Tracking Protection
  • February 21, 2019: Intelligent Tracking Prevention 2.1 caps persistent JavaScript-written cookies at seven days
  • 2020: Facebook renames its Server-Side API the Conversions API
  • August 12, 2020: Google opens server-side tagging in public beta on Google Cloud Platform
  • August 2021: The Media Rating Council publishes guidance holding that client-initiated counting remains the requirement under server-side ad insertion
  • September 23, 2021: Server-side tagging reaches general availability and gains support for any provider running Docker
  • March 2024: IAB Tech Lab announces the Trusted Server initiative
  • October 2024: Google launches first-party mode in beta
  • March 19, 2025: The Verwaltungsgericht Hannover rules that Google Tag Manager may not run before explicit consent
  • May 8, 2025: Google tag gateway for advertisers reaches general availability with Cloudflare as launch partner
  • September 18, 2025: Two defects in Analytics and server-side Tag Manager are documented, producing duplicate events
  • April 2026: IAB Europe publishes connected television guidance calling for disclosure of server-side impression measurement
  • April 27, 2026: Meta ships one-click Conversions API setup
  • May 11, 2026: Google documents randomised serving paths that conceal Tag Manager container identifiers
  • May 2026: AdGuard and EasyPrivacy filter lists begin naming server-side Tag Manager subdomains individually
  • July 2026: Shopify purchase events begin reaching Google Analytics server to server on an opt-out basis
  • August 4, 2026: Microsoft Advertising publishes Conversions API reference documentation
  • August 17, 2026: Four further Shopify events join the Google Analytics mapping, one of them server-side

Summary

Who. Advertisers, publishers and their engineering teams operate the infrastructure. Google, Meta, Microsoft, OpenAI and Amazon expose the server endpoints that receive the data. Prebid.org and the IAB Tech Lab maintain the open specifications. Ad blocker projects, browser vendors and data protection authorities constrain what the architecture achieves.

What. Any advertising function executed on a machine the operator controls rather than on the user's device, covering tag execution in a server container, header bidding auctions run server to server, conversion events sent through platform APIs, and commercials stitched into a video stream before delivery.

When. Auctions moved first, for performance reasons, with server-side Prebid deployments documented from 2018. Measurement followed browser restrictions from 2019, with Google's server-side tagging entering beta in August 2020 and general availability in September 2021. Adoption became close to automatic across 2026 as platforms shipped one-click and opt-out configurations.

Where. In cloud containers on a subdomain of the publisher or advertiser domain, in exchange infrastructure between the page and the bidders, in stitching services between the video origin and the player, and increasingly at content delivery network edges.

Why. Browser privacy features, tracking protections and blocklists reduced what client-side code could collect or transmit, while page performance suffered from the weight of vendor scripts. Moving execution to the server restored control over the data and shortened the critical path, at the cost of infrastructure, cookie match rates, client-initiated measurement and, in several documented cases, accuracy.