Vendors pitch it as the cure for ad blockers, cookie loss, iOS and page speed, and it fixes only part of that list. What changes is ownership: you decide which events survive and how long your records last.
Every standard tag, the Google Ads pixel, GA4, the Meta pixel, runs in the visitor's browser and sends data straight to the vendor. That browser is now a hostile environment: ad blockers drop the requests, Safari and Firefox restrict what cookies can persist, and a dozen third-party scripts fighting for the main thread slow the page.
Server-side tracking moves that collection to an endpoint on your own domain. The browser makes one request to your server, and the server decides what to forward, to whom, and with what cookie. You stop broadcasting from inside the browser and start controlling the pipe.
Free Tracking Audit
On a discovery call we review how your conversions reach Google Ads, from the first click to the closed sale, and tell you what we would fix first.
For advertisers spending $100K+/month. No cost, no obligation. A person reads every submission.
Request a Discovery Call →A server container, most often server-side Google Tag Manager, receives the browser's tracking hit, lets you inspect and reshape it, then forwards it to Google, Meta and other platforms. Google's recommended host is Cloud Run on Google Cloud, with App Engine as the alternative.
Out of the box, the container answers on a Google Cloud domain such as metrics.run.app. Google's docs say that default runs in a third-party context and can only set JavaScript cookies. To set cookies from the server, you map the container to your own domain: a subdomain like sgtm.yourdomain.com, or a path on your main site like yourdomain.com/metrics.
Why first-party matters more every year: cookieless tracking →
Safari's ITP deletes cookies written by JavaScript after 7 days without a visit. A cookie set in your server's HTTP response isn't under that rule, so a click identifier can last a full sales cycle. Safari still caps it at 7 days when the server is a cloaked third party: a CNAME to another company's domain, or an IP address that doesn't match your main site's.
Because every hit passes through your server first, you can strip PII, redact sensitive fields, and enforce consent before anything reaches a vendor. For restricted and healthcare-adjacent accounts, that is the difference between compliant and not.
Move tags off the browser and the main thread has less to do. One first-party request replaces a stack of vendor scripts, which shows up directly in Core Web Vitals and, on ad landing pages, in conversion rate.
Ad blockers and tracking-prevention lists target known third-party endpoints. A first-party collection endpoint on your own domain is far harder to blanket-block, so more of your real traffic is actually measured.
Moving to a server does not recover data a user refused to consent to, and it should not. It does not repair a conversion that was defined wrong in the first place, a form fill counted as a sale is still a form fill on the server. It does not create attribution that was never captured; if you never stored the click identifier, the server has nothing to forward.
And it is not free: a server container is infrastructure to host, monitor, and maintain. Set up carelessly, server-side tracking just relocates the same broken measurement to a more expensive address. The value is entirely in what you do with the control it gives you.
We run the standard setup: a server-side Tag Manager container on Google Cloud, mapped to a first-party subdomain such as sgtm.yourdomain.com. The container sets the click-identifier cookie from the server. Every later event, a qualified call, an SQL, collected revenue, is matched to that identifier and forwarded to Google and Meta through one pipeline that handles hashing, validation and deduplication on a shared order ID.
The subdomain needs only a DNS record, which is why it's the standard. The trade-off is Safari. When the subdomain resolves to Google Cloud IP addresses and your site doesn't, Safari caps the cookies it sets at 7 days, the same limit JavaScript cookies get.
The fix is same-origin serving: a CDN or load balancer routes a path on your main domain, such as /metrics, to the container, so the cookie comes from the same address as the page. It takes more setup, and it's the option Google's docs list as best practice.
The recovery net that rides alongside: enhanced conversions for leads → · The tracking layer we build on: Hyros implementation →
Tracking where the data is collected by a server you control instead of by tags firing in the visitor's browser. The browser sends one request to an endpoint on your own domain; your server then forwards clean, first-party data to Google, Meta, and other platforms, after you have inspected and reshaped it.
It reduces both; it does not defeat them. A first-party endpoint on your own domain is much harder for ad blockers to block than a known vendor URL. A server-set cookie also escapes Safari's 7-day cap on JavaScript cookies, but only when the server shares your site's origin or IP range; a subdomain on a different IP still gets 7 days. It does not override user consent choices.
Server-side Google Tag Manager is the most common way to run it, but the principle is what matters: a first-party server endpoint that receives the hit, controls the payload, and forwards it. The implementation can vary; the control it provides is the constant.
For advertisers at real spend with a sales cycle longer than a week or compliance constraints, yes, the durable cookies, data control, and resilience pay back quickly. For a small, same-session ecommerce store, the added infrastructure may not earn its keep. It is a fit question, not a universal upgrade.
It can. A container served from the same origin as your site, for example a /metrics path routed through your CDN or load balancer, sets cookies Safari treats as first-party and server-set, so click identifiers can outlast the 7-day cap. A subdomain that resolves to a different IP address, such as one mapped straight to Cloud Run, still gets the 7-day cap on Safari and iOS.
WebKit: Tracking Prevention in WebKit. Google Tag Manager server-side docs: Custom domain configuration and Cloud Run setup guide.
Free Tracking Audit
If you are spending $100,000 or more per month on Google Ads and your measurement still lives entirely in the browser, we should talk.
For advertisers spending $100K+/month. No cost, no obligation. A person reads every submission.
Request a Discovery Call →