Privacy ComplianceWeb Tracking
What Is Server-Side Tracking, and What Does It Mean for Website Consent?
With server-side tracking, businesses collect information about website visitors on servers that they control before sending it to advertising and analytics companies. Many businesses are adopting it because browser-based tools such as pixels have become less reliable. However, the change in method does not remove the need to give notice and obtain consent.
By Alex Proctor
Published October 12, 2026
Summary
Server-side tracking shares information about website visitors with advertising and analytics companies through servers that businesses control, rather than through visitors' browsers. This method does not necessarily change what is shared or who receives it, so the same privacy requirements apply. Notably, many consent banners only block scripts in browsers, so visitors' choices may not be honored unless they are also applied on those servers. I recommend that businesses confirm whether server-side tracking is in use on their websites, and whether visitors' consent choices carry through to it.
What Is Server-Side Tracking?
Most website tracking has traditionally run in visitors' browsers. Pixels and tags load with each page and send information about the visit directly from browsers to companies such as Meta and Google.
With server-side tracking, businesses collect that information on servers that they control, or that vendors run for them. These include the servers that run their websites and online stores, as well as separate servers set up for tracking. Much of the information arrives in the ordinary course of business, because browsers contact those servers each time visitors load pages, submit forms, or complete purchases. Businesses can also add scripts that send other activity, such as button clicks, to those servers.
Those servers then forward the information to advertising and analytics companies. Businesses can also send records such as purchases and sign-ups from their sales and customer systems, without involving browser-side tracking at all.
Meta's Conversions API and Google's server-side tagging are two widely used examples. Meta describes the Conversions API as a connection between advertisers' marketing data and the Meta systems that target and measure ads. E-commerce platforms such as Shopify offer these connections as built-in settings. Specialized tools such as Stape and Elevar also facilitate server-side tracking for businesses.
Why Are Businesses Adopting It?
Browser-based tools have become less dependable. Ad blockers can stop them from loading. Some browsers also limit the cookies that they rely on to recognize returning visitors. Meta says that data shared through the Conversions API "may be more reliable than browser-based methods alone."
Meta recommends that advertisers send events through both the pixel and the Conversions API. As a result, websites often run both methods at once. Server-side tracking also gives businesses more control over what each company receives.
What Changes, and What Stays the Same?
Moving tracking onto servers that businesses control changes how the information travels. It does not necessarily change which third parties may ultimately receive the information, or which privacy rules apply to it.
| What Changes | What Stays the Same |
|---|---|
|
|
What Does It Mean for Consent?
Server-side tracking is subject to the same notice and consent requirements as any other form of web tracking. State privacy laws regulate what personal information is disclosed and to whom, regardless of the method used to send it.
For example, California defines a sale as communicating personal information to a third party "orally, in writing, or by electronic or other means" for valuable consideration. That definition covers information that businesses send from their own servers, as well as information sent by pixels.
Many consent banners work by blocking scripts in browsers. That does not necessarily stop businesses from sending the same information from their own servers. Visitors' choices have to be passed to those servers and applied there. This includes opt-out requests and opt-out preference signals.
The major platforms provide ways to do this. For example, Google says that its tag "sends the user's preferences to the server container" and that its own tags there are "consent-aware." Tags from other vendors do not necessarily behave the same way, so each one may need its own consent rule.
Does It Reduce Litigation Risk?
While some claim that server-side tracking limits vulnerability to wiretapping "interception" claims, this question is largely unsettled. California's wiretapping law applies to communications that are read or intercepted "in transit." Defendants have argued that information forwarded from their own servers was not intercepted on its way to the website.
In January 2026, a federal court in California dismissed a wiretapping claim against a shoe retailer that was based on server-side tracking. The complaint did not say how soon the retailer's server forwarded the information, so it did not allege an interception in transit. The claims based on browser-side tracking continued at that stage.
However, the court did not decide whether server-side tracking can violate the law when it operates in real time. It also noted that California courts apply the statute to new technologies in a "functional rather than hyper-technical" way. Separately, server-side tracking definitely does not mitigate regulatory compliance obligations, which do not depend on interception at all.
What Should Businesses Do?
Server-side tracking is a legitimate way to measure advertising, but it does not remove notice and consent requirements. Whether to adopt it is a marketing and architectural decision that leadership and counsel should make deliberately, while accounting for the necessary privacy controls.
If uncertain, I recommend that businesses confirm whether server-side tracking is in use on their websites. This includes any connections that marketing agencies, e-commerce platforms, or other vendors may have set up. Businesses should confirm that visitors' consent choices and opt-out requests reach those connections, and that their privacy notices describe the practice accurately.
Questions
Does server-side tracking require a cookie banner?+
Generally, yes. Server-side tracking does not remove the need for a cookie banner. Websites that send visitor information to advertising or analytics companies need a way to give notice and honor visitors' choices, whichever method is used. The banner also has to be connected to the server-side tools, so that those choices are applied there.
Does the Global Privacy Control apply to server-side tracking?+
Yes. The Global Privacy Control is a request to opt out of the sale and sharing of personal information. It applies no matter how the information would be sent. Browsers send the signal with each request, so businesses can read it on their own servers and apply it to what they send.
Is server-side tracking better for privacy?+
It can be, depending on how it is configured. It lets businesses decide which details each company receives, while pixels send what they are built to send. However, it can also be used to send more information than before, including records from sales and customer systems.
Briefings are informational and do not constitute legal advice.
Running analytics or marketing tools?
I'll trace what leaves the browser, and when.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.