Server-Side Tracking is currently described in many places as the new basic equipment for serious web tracking. Those who still measure traditionally on the client side, according to the tenor of many expert articles, lose data and risk legal disadvantages. This assessment is only half true. Server-Side Tracking does indeed solve a technical problem: data loss due to ad blockers and browser restrictions.
However, it does not automatically solve the legal problem that many operators are actually concerned about, namely how to obtain reliable numbers without cookie banners and consent procedures.
This very confusion leads to misjudgments in practice. Those who set up Server-Side Tracking and believe that the consent issue is resolved end up facing the same cookie banner as before, just with an additional server component in the background.
This article realistically categorizes the disadvantages of Server-Side Tracking and presents a second approach that is often closer to the actual goal for smaller and medium-sized websites: a data-saving analysis approach with less dependence on consent-based analytics.
What Server-Side Tracking technically means
In classic client-side tracking, the browser sends events directly to Google Analytics, Meta, or other providers. Each of these services communicates independently with the visitor's device, making tracking susceptible to ad blockers and browser restrictions like Safari's ITP.
Server-Side Tracking adds an additional step in between. The browser first sends data to a first-party domain under its own control, usually via a Server-Side Google Tag Manager or a comparable solution.
From there, the data is enriched, partially hashed or anonymized, and then forwarded server-to-server to the actual target systems. Because the first contact point is a first-party domain, many blocking mechanisms no longer apply that target third-party domains.
The strengths of Server-Side Tracking – and their limits
The technical advantage is real. Setups that switch from Client-Side to Server-Side regularly report noticeably more measured conversions because previously lost events due to ad blockers and tracking preventions are now received. With properly configured setups, more of the already lawfully collected events can be technically processed and delivered to the target systems.
However, this is also where the limit lies, which is repeatedly mentioned as the most common practical mistake in current expert articles: Server-Side Tracking does not change the obligation to obtain consent. Server-Side Tracking is primarily a technical architecture, not a legal assessment in itself.
Anyone transmitting consent-required analysis or marketing data server-side to Google, Meta, or other providers without valid consent does not eliminate the legal violation by interposing their own server.
Whether consent is actually required in individual cases depends, among other things, on the type of data transmitted, the purpose of processing, the involved recipients, the chosen legal basis, and the consent configuration. The website operator remains legally responsible for data protection and is responsible for compliant integration.
Depending on the role of the involved provider, data processing agreements, agreements on joint responsibility, or other data protection regulations may be required. A server in the EU does not automatically solve the problem of international data transfers: if the processing chain ultimately ends up with a US provider, the last step remains a third-country transfer, even if the first step was European.
Additionally, there is a technical detail that is often overlooked in implementation. Many teams set up Google Consent Mode v2, but do not consistently check the consent status on the server side. If a visitor declines in the browser, the server container does not know this status and continues to forward the data, resulting in a violation that often goes unnoticed until a review uncovers it.
The implementation effort in practice
Besides the legal boundary, server-side tracking brings an effort that is often underestimated in the initial excitement over better data quality. A functioning setup typically requires its own server infrastructure or a managed provider, expertise in handling tag servers, a clean connection to the consent management platform, and ongoing maintenance that is at least equivalent to that of an existing client-side setup.
Smaller teams without their own DevOps resources therefore usually rely on managed solutions, which means additional ongoing costs.
For companies with a complex ads stack, multiple brands, or a high proportion of campaign attribution, this effort can be worthwhile. For an online shop with a manageable range of products, a service provider, or an agency that mainly wants to know where visitors come from and which pages work, the effort is often not proportional to the benefit.
The other way: cookie-less client-side tracking
In addition to server-side tracking, there is a second approach that addresses the actual problem in a different way. Instead of technically securing data transmission, cookie-less client-side tracking completely dispenses with cookies from the outset and reduces the processing of personal data to the extent necessary for analysis.
Tools like Trackboxx capture visitor behavior instead via a hash formed from the IP address and other parameters, stored for a maximum of 24 hours and then automatically deleted. The IP address itself is not stored in plain text according to the provider's information.
The legal difference to Server-Side Tracking lies in the justification, not just in the technology. § 25 TDDDG does not exclusively concern cookies, but fundamentally the storage of information on the user's end device and access to information already present there.
The renunciation of cookies can significantly reduce the requirements according to § 25 TDDDG, but alone it is still not a guarantee for consent-free use. Crucial is whether the deployed script additionally reads information from the end device or makes comparable accesses.
Even with the hash method that Trackboxx claims to use, a detailed examination is worthwhile. A hash is not automatically anonymous: As long as a reference to a person can be established again under certain circumstances, it is a pseudonymous and thus still personal data. The short storage duration of a maximum of 24 hours and the renunciation of a plain text IP address can reduce the data protection risk, but do not automatically eliminate the personal reference.
The processing therefore still requires a traceable legal basis. Trackboxx relies on the legitimate interest according to Art. 6 para. 1 lit. f GDPR for this. Whether this classification holds in the specific application depends on the actual technical implementation and does not replace a legal examination of the individual case.
The practical advantage lies in the simplicity of implementation. Instead of a dedicated server, a tag management infrastructure, and ongoing maintenance, a single script in the header of the website is sufficient. Depending on the technical and legal design, such an approach can be used without prior consent, and the dependence on blockable third-party cookies is eliminated.
However, a client-side, cookie-free script is also not completely immune to ad blockers: Some blockers recognize known analytics scripts or tracking domains regardless of whether cookies are set.
Comparison: Server-Side Tracking and cookie-free Client-Side Tracking
Server-Side and cookie-free describe different levels and are not direct opposites. Server-Side Tracking refers to the technical transmission path, cookie-free describes certain characteristics of data collection. A Server-Side setup can also be designed to be cookie-free and data-saving, and data collected cookie-free is ultimately transmitted to a server.
In practice, however, two typical scenarios usually stand against each other: complex Server-Side Tracking for advertising platforms and extensive marketing stacks on one side, data-saving web analytics for basic website metrics on the other.
| Criterion | Server-Side Tracking | Cookieless Client-Side Tracking (e.g. Trackboxx) |
|---|---|---|
| Technical effort | High: own server or managed provider, tag management, ongoing maintenance | Low: a script in the header |
| Data loss due to ad blockers | Can reduce data losses, depending on setup, consent, and target systems | Can be less susceptible, but remains fundamentally blockable as a client-side script |
| Duty of consent | Depends on data, purpose, recipients, and technical implementation; Server-Side alone does not eliminate consent obligation | Can be used without consent if the specific technical implementation and the chosen legal basis allow it |
| AVV obligations | Depending on the role of the involved providers and the specific processing chain | Also dependent on the role of the analytics provider and other involved service providers |
| Suitable for | Complex ads stacks, high attribution requirements, existing DevOps resources | Websites focused on core metrics without complex advertising platform integration |
| Ongoing costs | Server or provider costs in addition to existing tools | Usually a single monthly rate |
The table shows primarily one thing: Both approaches answer different questions. Server-Side Tracking answers the question of how to technically deliver as many already permitted data as possible. Cookie-less Tracking answers the question of how to create less consent area from the outset.
For whom is which approach worthwhile
Those who operate a complex campaign stack across multiple advertising platforms, need granular attribution, and already have technical resources benefit from Server-Side Tracking despite the effort. The additional data quality often justifies the investment here.
On the other hand, those who primarily want to know how many visitors come through which channels, which content works, and where users drop off, without having to maintain an elaborate tag management system, are often better served with a cookie-less approach.
For agencies, service providers, and smaller online shops that primarily seek reliable core metrics without cookie banners, it is Trackboxx an example of this second path, without implying a claim to completeness compared to more complex advertising attribution systems.
FAQ
Does Server-Side Tracking replace the Cookie Banner?
No, not automatically. If consent-required analysis or marketing data is transmitted to providers like Google or Meta, the required consent remains in place even with a server-side setup.
Is cookie-free tracking automatically GDPR-compliant?
No. § 25 TDDDG covers not only cookies but fundamentally any storage and retrieval of information on the end device. The waiver of cookies can significantly reduce these requirements, but a completely consent-free use does not automatically result from this. Whether the specific implementation actually works without consent depends on the technical design and the chosen legal basis and should be legally reviewed in case of doubt.
Can one combine server-side tracking and cookie-less tracking?
Yes, both approaches are not mutually exclusive. Some websites use a cookieless tool for the core metrics and supplement it with a server-side setup for specific advertising platform integrations if needed.
Why does classic client-side tracking lose data at all?
Multiple effects work together: Ad blockers not only block third-party cookies but also partially recognize known analytics scripts, block tracking domains, or prevent requests based on certain patterns. Browsers like Safari additionally limit the lifespan of first-party cookies, and a significant portion of visitors reject tracking on cookie banners. These effects together lead to noticeable gaps in the analytics data.
External sources
- § 25 TDDDG (Legal text, storage and access to end devices)
- Art. 6 GDPR (Legal bases for processing, in particular para. 1 lit. f – legitimate interest)
- Server Side Tracking & GDPR: Compliance guide for companies, tobiasbatke.com, as of March 2026
- Server-Side Tracking 2026: The complete guide, meixner-tobias.com, as of April 2026
- Advantages and disadvantages of Server Side Tracking, digital-motion.de
- What is Server-Side Tracking?, jentis.com, as of January 2026
Deutsch
English (UK)
Français
Italiano
Español
Nederlands
Polski
Svenska