Server-side tagging
Server-side tagging moves the sending of analytics and advertising data from the visitor's browser to a server the website controls, which then forwards the data to vendors such as Google or Meta.In the usual setup, each tag in the browser calls its vendor directly. With server-side tagging, the browser sends one stream of events to a tagging server, often on a subdomain of the site, and that server decides what to forward to each vendor. Google Tag Manager offers server containers for this, and advertising platforms provide server-side APIs that receive events from the site's server, Meta's Conversions API being one example.
The benefits are real: fewer third-party scripts in the page, control over which fields leave the server, the option to strip or truncate IP addresses, and faster pages. What server-side tagging does not change is the law. Article 5(3) of the ePrivacy Directive still applies to any cookie or identifier the browser stores or reads to feed the server, and the GDPR still applies to the data the server forwards. Moving a tracker to a first-party subdomain changes where it runs, not whether it needs consent.
The rule for consent stays the same: the server should forward data only for the categories the visitor accepted. The consent state has to travel with each event, for example through Consent Mode parameters or a flag set by the tag manager. The guide on server-side tagging and consent covers the setup.