← Back to Writing
2 min read

Server-Side GTM Is Not Optional Anymore

Browser-based tracking is dying. Safari kills cookies in 7 days. Ad blockers hit 30% in tech audiences. Here's what to do about it.

  • server-side-gtm
  • tracking
  • privacy

Let me be direct: if you’re still running 100% client-side tracking, you’re operating on borrowed time.

I’m not saying this because server-side is trendy. I’m saying it because the browsers have made their position clear, and the trajectory is unmistakable.

What’s Actually Happening

Safari and Firefox already limit client-side cookies to 7 days (Safari) or block third-party cookies entirely (Firefox). Chrome’s third-party cookie deprecation keeps getting delayed, but the writing is on the wall.

When that happens—and it will—client-side tracking loses:

  • Reliable user identification across sessions
  • Accurate attribution windows beyond a week
  • Most cross-device journey data
  • Campaign measurement for anything but same-session conversions

Why Server-Side Changes This

Server-side tracking doesn’t magically bypass consent or privacy rules. That’s not the point.

The point is reliability and control:

  1. First-party context. Your server sets the cookie, from your domain. Browser restrictions that target third parties don’t apply.

  2. Data enrichment. Match client events with backend data before sending to platforms. Get the revenue figure right. Include the order ID. Send the actual LTV.

  3. Platform integration. Server-to-server connections (Meta CAPI, Google Ads API) trust your data more than browser pixels. They give you better match rates and signal quality.

  4. Consent orchestration. One place to enforce rules about what gets sent where, based on what the user actually consented to.

The Common Objections

“It’s too complex.” It’s more complex than pasting a script tag, yes. But so is any infrastructure that actually works.

“We don’t have engineering resources.” You have resources to fix broken attribution every quarter. You just call it “agencies” and “analytics consultants.”

“We’ll lose data in the migration.” You’re already losing data. At least this is intentional.

The Minimum Viable Implementation

Start here:

  1. Google Cloud Run container with GTM server-side
  2. First-party subdomain (sst.yoursite.com)
  3. Client-side container fires to your server endpoint
  4. Server container forwards to GA4 and one platform (start with your biggest spend)
  5. Deduplication logic to avoid double-counting

Cost: $50-200/month infrastructure. Weekend of engineering time if you know what you’re doing.

The hard part isn’t the technology. It’s reorganizing how you think about data collection.

Stop waiting for permission. The client-side era is ending whether you’re ready or not.