A common misunderstanding is that server-side tracking is a way around consent. It is the opposite. Because collection happens on your own server or edge, you can enforce consent and regional rules before any data is stored or sent, more reliably than a browser tag can. Done right, server-side is the more compliant option, not the sneakier one.
Consent is a decision, made per visitor
Every event carries a consent state. What happens next depends on where the visitor is and what they chose:
- EU, UK and Switzerland: opt-in. Nothing that requires consent is sent unless the visitor has agreed.
- United States and most other regions: opt-out. Data flows unless the visitor opts out, and opt-out signals are honored.
Resolving this at the edge, rather than trusting a tag to fire correctly in the browser, means the rule is applied the same way every time.
Global Privacy Control (GPC)
GPC is a signal your browser can send that means "do not sell or share my data." Under laws like California's CCPA and CPRA, honoring it is not optional.
When a GPC signal is present, delivery switches to a limited, privacy-safe mode: platform features that depend on sharing personal data are turned down, and the event is handled accordingly. This is applied automatically, so you do not have to wire it per campaign.
What actually leaves, and in what form
Compliance is also about minimizing what you send:
- Ad platforms receive only hashed identifiers. Email and phone are hashed with SHA-256 before they leave, so platforms can match without receiving raw personal data.
- Plaintext stays in your first-party layer. Your own profiles and your CRM can hold the real values, with consent. The ad platforms do not.
- Warehouse export excludes personal data by default, and only includes it when you explicitly enable it, and only with consent.
| Signal | What happens |
|---|---|
| Consent granted (opt-in region) | Full delivery, identifiers hashed |
| No consent (opt-in region) | Nothing consent-dependent is sent |
| GPC / opt-out (US) | Limited, privacy-safe delivery |
Why enforce it at the edge
A browser consent banner can be blocked, mis-configured, or fire too late. Enforcing the decision at the edge, in the same place the event is collected, makes consent a property of the pipeline instead of a script that might not run.
Server-side does not mean consent-free. It means the consent decision is applied consistently, before anything leaves, with only hashed data reaching the ad platforms. This is not legal advice; confirm your obligations with your own counsel.