Conversion tracking that stays GDPR-compliant.
And still measures completely.

For years, conversion tracking has been caught between two requirements that appear to contradict each other. The law demands consent before any non-essential access to the user’s device. The ad platforms demand data that is as complete as possible to steer bids sensibly. The contradiction dissolves as soon as tracking is planned as an architecture rather than a collection of scripts.

What the law in Austria requires

Two sets of rules interlock. § 165 (3) of the Austrian Telecommunications Act (Telekommunikationsgesetz, TKG 2021) governs access to the device: cookies and comparable technologies that are not technically necessary require consent [1]. The GDPR governs the subsequent processing of personal data and sets the standard for valid consent: freely given, informed, unambiguous. A pre-ticked checkbox is not enough, as the Court of Justice of the European Union (CJEU) ruled back in 2019 [2].

Then there is the question of transfers to third countries. In 2022, the Austrian data protection authority objected to a specific use of Google Analytics because data flowed to the USA without adequate safeguards [3]. Since July 2023, the EU-US Data Privacy Framework has again provided a legal basis for transfers to certified US companies [4]. It does not change the consent requirement for cookies.

Why tracking still has gaps

Even a legally clean setup loses data if it runs only in the browser. Safari limits cookies set by scripts to seven days [7]. Someone who clicks an ad on a Monday and buys on the Wednesday of the following week is a new visitor as far as the ad account is concerned. Ad blockers suppress known pixel domains completely. And without countermeasures, every declined consent is missing from the statistics altogether.

The result is ad accounts that see fewer conversions than actually happen. For reporting, that is annoying. For steering, it is expensive: Smart Bidding allocates budget according to the conversions it sees. If the purchases from one channel are systematically missing, that channel is systematically undervalued.

What server-side tracking delivers

With server-side tracking, the website does not send events directly to Google or Meta but to the company’s own server container on a company subdomain [8]. This server sets first-party cookies with a stable lifetime, checks the consent status and decides which fields are passed to which platform. IP addresses can be truncated, URL parameters removed and sensitive fields discarded.

Three effects matter: measurement is more robust against browser restrictions, control over outgoing data rests with the company, and the website loads faster because fewer third-party scripts run in the browser.

Consent Mode v2: modelling instead of guessing

For visitors without consent, a gap remains that technology cannot close and should not close. Google’s Consent Mode v2 passes the consent status to Google tags. Without consent, they only send cookieless signals without identifiers, from which Google extrapolates missing conversions statistically [6]. Since March 2024, Consent Mode v2 has been a prerequisite for using personalisation and remarketing features for users in the European Economic Area.

Where data protection and data quality meet

The strongest signals arise where consent exists and the company holds its own data. Enhanced Conversions and the Meta Conversions API transmit hashed customer data, such as a buyer’s email address, so that the platform can attribute the purchase to an ad. This only works on a sound legal basis, and then it is considerably more effective than any cookie. Transmitting order values instead of mere counts also gives Smart Bidding the information it is actually meant to optimise for: revenue.

How such a server container is set up technically is described in the guide Setting up server-side tracking. A detailed comparison of both approaches is available in Server-side vs. client-side tracking. Further solutions build on the same data foundation, such as a revenue forecast or lead scoring.