# Server-side tagging and consent: why sGTM still needs a banner

> Server-side Google Tag Manager moves tags to your server, not the consent requirement. How consent reaches the server container and which tags respect it.

Source: https://cookiequiet.com/guides/server-side-tagging-and-consent
Published: 2026-10-21
Publisher: Cookiequiet

## Steps

1. **Keep the banner first in the browser** Load the consent banner before the Google tag so that Consent Mode defaults of denied are set before any request reaches the tagging server.
2. **Point the web tag at your tagging server** Set the server container URL on the Google tag in the web container, on a subdomain of your site.
3. **Check that consent travels with requests** In preview mode, confirm that requests to the tagging server carry the consent state before and after the visitor's choice.
4. **Review Google tags in the server container** Keep the Conversion Linker for Google Ads and confirm that GA4, Ads and Floodlight tags behave as expected with consent denied.
5. **Add conditions to non-Google server tags** Make tags for Meta, TikTok, LinkedIn or other vendors fire only when the consent state for their category is granted.
6. **Strip what vendors do not need** Remove or truncate IP addresses, user agents and identifiers before forwarding, where the vendor does not require them.
7. **Test the three paths** Before any choice, after Reject all and after Accept all, check browser cookies, requests and the server container preview.

Server-side tagging does not remove the need for consent. With server-side Google Tag Manager, the visitor's browser still runs a script and sends a request with information from the device, now to a tagging server on your own subdomain instead of straight to Google or Meta. The ePrivacy rule is about that access to the device, so analytics and advertising still need consent in the EU and the UK. What server-side tagging changes is where the data goes after it leaves the browser, which can help you send less of it, as long as consent travels with every request and every tag in the server container respects it.

## What is server-side tagging?

In a classic setup, the web container in the browser loads each vendor's tag, and each tag sends data directly to its vendor. With server-side tagging, Google describes a server container that runs on a server you control, such as your own Google Cloud project, and does not run in the visitor's browser. The website sends events to the container's URL, which Google recommends placing on your first-party domain (for example metrics.example.com). Inside the container, clients receive the requests and turn them into events, and server tags forward those events to Google Analytics, Google Ads or other vendors. Google's introduction notes that only you have access to the data in the server until you choose to send it elsewhere.

## Why does it still need consent?

Three reasons.

1. **The browser still does the collecting.** A script on the page reads information (page, referrer, identifiers, device details) and makes the browser send it. Article 5(3) of the [ePrivacy Directive](/laws/eprivacy-directive) covers storing or accessing information on the device, and the EDPB's Guidelines 2/2023 on its technical scope apply it to techniques such as tracking pixels and URL tracking, not only to cookies.
2. **Cookies are still cookies.** A first-party cookie set by your tagging server on your domain is stored on the visitor's device like any other. The domain changes, the rule does not.
3. **The purpose is unchanged.** If the server forwards the event to an advertising platform, the processing is advertising, and the [GDPR](/laws/gdpr) requires a legal basis for it, which for tracking is consent.

Hiding a tracker behind a first-party subdomain so that ad blockers or banners do not see it does not make it lawful. If anything, it makes the consent record more important, because an authority will ask how you made sure the server forwarded nothing for visitors who refused.

## How does consent reach the server container?

Through the web tag. Google's guide on consent mode with server-side Tag Manager says the banner on the website collects consent, the Google tag adds the consent state to each request it sends to the server container, and you only need to set up consent mode in the web container. Server containers support both basic and advanced consent mode.

So the order of operations from [the Consent Mode guide](/guides/google-consent-mode-v2) still applies: defaults set to denied before the Google tag runs, an update on every choice, and the web tag pointed at your tagging server.

## Which server tags respect consent on their own?

Google says its product tags in the server container are consent-aware:

| Server tag | Behavior when consent is denied |
|---|---|
| Google Analytics 4 | Depends on `analytics_storage` and on basic or advanced mode |
| Google Ads Conversion Tracking | Needs the Conversion Linker tag; cookies are not read or written when `ad_storage` is denied |
| Google Ads Remarketing, Floodlight | Requests and cookie use are blocked when `ad_storage` is denied |

Tags for other vendors are a different matter. A server tag that forwards events to Meta, TikTok, LinkedIn or a data warehouse fires whenever its trigger fires, unless you add a condition. In the server container, build that condition from the consent state carried by the request, or send events for those vendors only from web tags that already wait for consent.

## What can server-side tagging do for privacy?

Used with consent, it can reduce what each vendor receives:

- remove or truncate IP addresses and user agents before forwarding;
- drop query parameters, e-mail addresses or IDs that should never reach a vendor;
- send fewer third-party requests from the browser, which also helps page speed;
- keep a single point where you can see and document every data flow.

Those are good reasons to adopt it. They are not reasons to skip the banner.

## How do you set it up correctly?

The steps below assume a web container and a server container already exist. The [Google Tag Manager platform guide](/platforms/google-tag-manager) covers the web container side with a consent banner.

## How do you test it?

Use Tag Manager's preview mode for both containers, and the browser test from [checking cookies before consent](/guides/check-cookies-before-consent). Before any choice, the requests to your tagging server should carry the denied state, and the server container's preview should show non-Google tags not firing. After Reject all, the same. After Accept all, everything fires.

## Where does a consent banner fit?

It stays exactly where it was: in the browser, before the Google tag. Cookiequiet's script sets the Consent Mode defaults to denied before any Google tag runs and updates them on every choice, so the web tag passes the right state to your server container. It also pushes a `cq_consent` dataLayer event with per-category flags that web triggers can use. Setup is one script tag placed before your other scripts, with Consent Mode v2 switched on in the snippet the dashboard gives you; the free plan covers one website, Starter is €3 per website per month (see [pricing](/pricing)).

## Questions

### Does server-side tagging make cookies first-party and therefore exempt?

No. First-party cookies need consent too unless they are strictly necessary. Moving analytics or advertising cookies to your own domain changes who sets them, not their purpose.

### Do I need to set up consent mode in the server container?

Google says you only need to set it up in the web container, because the Google tag passes the consent state to the server with each request. Google product tags in the server container then adjust their behavior. Tags for other vendors need conditions you add yourself.

### Can server-side tagging send data when the visitor refused?

It can if it is misconfigured, which is the main risk. A non-Google server tag without a consent condition will forward events from visitors who refused. Test with preview mode after every change.

### Is server-side tagging worth it for a small site?

Often not. It requires hosting a server container, usually at a monthly cost, and maintenance. The privacy gains come from stripping data before forwarding, which matters most for sites with many vendors and high traffic.

## Sources

- [Google, An introduction to server-side tagging](https://developers.google.com/tag-platform/tag-manager/server-side/intro)
- [Google, Implement consent mode with server-side Tag Manager](https://developers.google.com/tag-platform/tag-manager/server-side/consent-mode)
- [Tag Manager Help, Tag Manager consent mode support (built-in and additional consent checks)](https://support.google.com/tagmanager/answer/10718549?hl=en)
- [Directive 2002/58/EC (ePrivacy Directive), article 5(3)](https://eur-lex.europa.eu/eli/dir/2002/58/oj)
- [EDPB, Guidelines 2/2023 on the technical scope of article 5(3) of the ePrivacy Directive](https://www.edpb.europa.eu/documents/guideline/guidelines-22023-on-technical-scope-of-art-53-of-eprivacy-directive_en)