Privacy and consent: what server-side tracking may do

When does tracking require consent?

In the EU, the ePrivacy Directive governs when information may be stored on or read from a user's device. Each member state has transposed it into national law, Germany for example in Section 25 of the TDDDG. Without consent, this is only permitted where it is strictly necessary for the service the user has requested. Analytics and marketing cookies, visitor IDs and pixels do not fall into that category. The subsequent processing of the data is also subject to the GDPR. The UK has comparable rules under PECR and the UK GDPR.

The key point: these rules are tied to access to the device and to the data, not to where the processing takes place. Whether a visitor ID is set by a Google script or by your own server makes no difference to the need for consent. A guide that promises otherwise promises too much. This guide is not legal advice; for an assessment of your specific setup, a data protection expert is the right person to ask.

What does the Digital Omnibus change?

As of November 2026: nothing yet. In November 2025, the European Commission proposed moving the cookie rules into the GDPR, requiring a one-click option to decline and creating exemptions, for example for simple audience measurement. In October 2026, the Council agreed on a negotiating position in which the cookie rules remain in the ePrivacy Directive. The European Parliament has not yet set out its position. For store owners, existing law applies until further notice. Marketing tracking remains subject to consent under every version that has been discussed.

What is Google Consent Mode?

Consent Mode passes the visitor's consent status to Google tags. Since March 2024, Google has required version 2, with additional signals for user data and personalization, for users in the European Economic Area and the UK. Without these signals, Google restricts features such as remarketing and conversion measurement for these users. A cookie banner that does not output Consent Mode V2 correctly is therefore not only a legal problem but a commercial one.

There are two variants:

• Basic: Google tags only load after consent. Without consent, nothing is sent.

• Advanced: Tags load immediately but, without consent, only send cookieless pings from which Google models missing conversions. Data protection authorities take different views on whether these pings are permissible without consent. The choice of variant should therefore be made deliberately and documented.

What does data protection gain from server-side tracking?

This is the real benefit, and it is substantial. With browser tracking, every script transmits whatever its provider has designed it to, including IP address and browser data. On your own server you can:

• truncate or remove IP addresses before data goes to third parties,

• filter out personal fields or transmit them only in hashed form,

• define per platform which parameters it receives,

• evaluate the consent status on the server and not trigger tags at all without consent.

This turns data protection from a hope into a configuration you can verify. Server-side tracking is not a way around consent; it is the way to get the most out of every consent that is given while staying demonstrably compliant.

Where are the servers located?

For a GDPR assessment, what matters is where the data is processed and who has access. Hosting in the EU, a data processing agreement and documented data flows are the minimum standard. TAGGRS operates its servers in the EU, which simplifies the documentation. Transfers to US platforms such as Google or Meta must be described in your privacy policy regardless.

What applies in Switzerland and outside Europe?

Swiss stores are subject to the revised Federal Act on Data Protection (revFADP). For cookies, Switzerland generally requires information and an option to object rather than a blanket opt-in. Anyone who also serves customers in the EU must follow the EU rules for them, which is why many Swiss stores use an EU-standard consent banner in practice. Outside Europe, the rules differ considerably; several US states, for example, follow an opt-out model. If you sell internationally, the strictest market you serve usually sets the standard for your setup.