Server-Side Tagging and Consent: What Marketers Need to Know
Server-side tagging is the biggest shift in marketing technology since Google Tag Manager launched in 2012. By moving tag execution from the browser to a server, marketers gain better data quality, faster page loads, and more control. But there is a dangerous misconception spreading: "If tags run on the server, I don't need consent." This is wrong — and could cost you millions in fines.
What Is Server-Side Tagging?
In traditional (client-side) tagging, JavaScript tags run in the visitor's browser. Each tag makes requests to third-party servers, slowing the page and exposing data to multiple parties. In server-side tagging, a single tag sends data to your own server, which then forwards it to Google, Meta, and other platforms. The browser makes fewer requests, pages load faster, and you control the data flow.
The Consent Misconception
Myth: "Server-side tags don't run in the browser, so they don't need consent."
Reality: GDPR regulates the processing of personal data, not the location of the code. If you collect and send a user's IP address, click behaviour, or purchase data to Google Analytics — it does not matter whether the JavaScript runs in the browser or on your server. The personal data is still being processed, and you still need consent.
How Consent Works with Server-Side GTM
- Step 1: CMP collects consent in the browser (this always happens client-side)
- Step 2: Consent state is passed to the server-side container via the data stream
- Step 3: Server-side tags check consent state before firing
- Step 4: Google Consent Mode V2 parameters (ad_storage, analytics_storage, ad_user_data, ad_personalization) are respected server-side
Benefits of Server-Side + Proper Consent
- Better data quality: Server-side reduces data loss from ad blockers by 15-25%
- Faster pages: Fewer client-side scripts improve Core Web Vitals
- First-party context: Data flows through your domain, treated as first-party
- Consent Mode compatibility: Google's server-side container natively supports Consent Mode V2
- Enhanced Conversions: Server-side enables hashed first-party data for better attribution
Common Mistakes
- Skipping consent entirely — the most dangerous mistake; server-side does not exempt you
- Not forwarding consent state — your server container must receive and check consent signals
- Firing all tags regardless — each server-side tag must respect the same consent rules as client-side
- Ignoring TCF for programmatic — SSPs still need valid TC Strings, whether tags are client or server
FlexyConsent + Server-Side GTM
With Consent Mode on, FlexyConsent sends Google's consent signals before your tags fire and again when the visitor decides. They travel on the Google tag's requests to your server container, and Google's own server-side tags (Google Analytics 4, Google Ads conversion tracking and remarketing, Floodlight) act on them. Tags from other vendors, such as the Meta Conversions API or the TikTok Events API, do not read consent on their own: add a consent check to each one in the server container, and test with Accept all, Reject all and no choice.