Server-Side Tracking & GDPR: Tracking in compliance with the law – even without a consent banner? (2026)

This guide clarifies the two levels of the legal situation (§ 25 TDDDG and the GDPR), the crucial difference between anonymous and pseudonymous data, when consent-free tracking is really permitted, third-country transfers to US services – and how to implement server-side tracking cleanly in e-commerce.

Server-side tracking explained briefly

With client-side tracking, a script fires directly in the browser to the endpoints of the target systems, such as GA4. With server-side tracking, the browser only sends a request to your own server (e.g., sst.yourdomain.com), which processes the events and forwards them server-to-server to the target systems.

An often-confused term: server-side tagging specifically refers to the server container (e.g., server-side Google Tag Manager), while server-side tracking is the whole approach. For the basics – what conversion tracking even is and how the measurement chain works – see the conversion tracking guide. Here, we tackle the question it only touches on: is this actually GDPR-compliant?

Is server-side tracking GDPR-compliant? The honest answer

The short answer: Yes, but not on its own – and not without consent just because it runs server-side.

The most common misconception goes: "We track server-side, so we no longer need a consent banner." That's wrong. The location of processing (browser vs. server) changes nothing about your data protection responsibility. Almost every server-side setup still has a client-side component – a tag, a pixel, or a first-party cookie that feeds the data to the server. It's precisely this access to the device that triggers the consent requirement again.

The server-side Google Tag Manager doesn't make your tracking automatically compliant either. It relocates the processing, not the legal obligations.

The legal bases: § 25 TDDDG and Art. 6 GDPR

Legally sound tracking settles two levels – cumulatively:

Level 1 – § 25 TDDDG (access to the device). The Telecommunications Digital Services Data Protection Act (the new name of the TTDSG since May 2024) requires, in § 25(1), prior consent for storing information on the device or accessing it – i.e., cookies, localStorage, active fingerprinting. The provision is technology-neutral: it applies regardless of whether the evaluation afterwards happens in the browser or on the server. Important: § 25 has no exception via "legitimate interest" – there is only consent or the narrowly defined exceptions of § 25(2) (strictly technically necessary, e.g., shopping cart, login). Marketing and analytics tracking is not "strictly necessary" and is therefore subject to consent.

Level 2 – GDPR (processing of the data). What happens after receipt on your server is a separate question. As soon as personal data is processed, you need a legal basis under Art. 6 GDPR:

• Consent (Art. 6(1)(a)): the standard case for marketing tracking – and the consistent basis when § 25 already requires consent anyway.
• Legitimate interest (Art. 6(1)(f)): theoretically possible, in practice narrow. The EDPB Guidelines 1/2024 require the three-step test (interest → necessity → balancing), and the CJEU weighs the intrusiveness of tracking heavily – so for cross-channel advertising tracking, (f) rarely holds. The catch: (f) only helps at Level 2. It doesn't save § 25 – wherever access to the device takes place, consent remains required.

In short: § 25 TDDDG decides whether you may store/read anything on the device at all; the GDPR decides what you may do with the data afterwards.

Anonymous vs. pseudonymous data: the crucial difference

Here lies the lever that almost every guide omits – and that determines the consent requirement:

• Anonymous data falls completely outside the GDPR (Recital 26) – provided the person can no longer be identified by reasonable means. The anonymization has to be irreversible.
• Pseudonymous data remains personal (Art. 4(5) GDPR) and fully subject to the GDPR. A hash, a token, or a replaced ID is pseudonymization, not anonymization.

Why it matters: "server-side = anonymous" is a myth. Your server still receives the IP, user agent, behavioral data, and often a first-party ID – this combination is at least pseudonymous. The CJEU has sharpened this twice:

• IP address = personal (CJEU Breyer, C-582/14): dynamic IPs are personal for the site operator if it has legal means to identify the person with the help of third parties. In combination with Recital 30 (IP as an online identifier), the rule is: in a web/marketing context, an IP is regularly personal.
• Identifiers = personal (CJEU IAB Europe, C-604/22, 2024): an ID is already personal if it can be linked to an IP or other identifiers – even if the holder itself cannot establish the link. That refutes "we only store a hashed value, so it's anonymous."

The rule of thumb: as long as a recognizable reference remains, the data is pseudonymous – and therefore subject to consent.

Consent-free tracking: myth or a real strategy?

Now to the question everyone really cares about. Consent-free tracking is possible – but not a switch. It's legally viable only when both levels are cleanly solved:

1. No § 25 trigger: no storing/reading on the device that requires consent (or only what's strictly technically necessary). As soon as you set a cookie or a device ID to enable the measurement, § 25 is active again.
2. AND either genuine anonymity (no personal reference → the GDPR doesn't apply) or a viable legal basis without consent (in practice almost only a carefully documented legitimate interest – with the narrow limits mentioned).

"Cookieless ≠ consentless" is the most common confusion here: tracking without cookies doesn't automatically mean you're allowed to track without consent. Cookieless methods too can be personal (e.g., via IP or fingerprinting) and therefore subject to consent.

What certifications mean – and what they don't. For consent-free methods there are private audit/certification seals (e.g., ePrivacyseal) that certify a specific measurement method as working without consent under the TDDDG/GDPR. Important to place correctly: such a seal audits the method, not your entire setup, and it is not binding on supervisory authorities or courts. It's a strong indication and a trust signal – not a free pass.

How Tracify solves this. Tracify starts exactly here: with a patented hybrid tracking that, according to Tracify's own statement, is certified as consent-free and is processed exclusively on German servers. The claim: to capture customer journeys without depending on the consent rate – and without the typical § 25 triggers. According to Tracify, this brings up to 60 percent more relevant data points into the system, at a tracking rate of nearly 100 percent over more than 30 days, while consent-based standard setups lose more users with each passing day. (For concrete use, the same applies here: the data protection assessment is setup-specific – the certification attests to the method.)

Third-country transfer & data sovereignty: is an EU server enough?

A common fallacy: "We host in the EU, so the US transfer is solved." Not quite.

• If you pass events on to Meta or Google (USA), a third-country transfer takes place – regardless of where your tagging server sits. The current legal basis is the EU-US Data Privacy Framework (DPF) (adequacy decision July 2023). Status in 2026: the DPF applies and was initially upheld by the EU General Court in the Latombe case (T-553/23, September 2025) – however, an appeal against that ruling is pending (C-703/25 P), and there are "Schrems III" discussions. In short: reliable today, but not set in stone. In practice: check whether the specific recipient is DPF-certified, and keep standard contractual clauses plus a transfer impact assessment as a fallback.
• Cautionary example: the Regional Court of Munich I ruled in 2022 on "Google Fonts" that merely passing the IP on to a US service without a legal basis is already a violation (damages under Art. 82 GDPR). Any server-to-server transfer that lets the IP leak without a basis carries the same risk.
• German servers as a sovereignty answer. If your tracking/attribution layer processes the data on German servers, at least this level stays under German jurisdiction – a real difference to US cloud setups. That's exactly Tracify's setup: processing in Germany, rather than needlessly mirroring data to the USA.

Implementing server-side tracking correctly in e-commerce

For shops, the path runs through a first-party setup, cleanly coupled to consent:

• Shop systems: in Shopify, Shopware, JTL, or WooCommerce, you connect server-side tracking via native integrations or plugins; the purchase events (value, currency, order ID) run through the first-party endpoint.
• Interplay with Meta CAPI: server-side is the architecture, the Meta Conversions API is a destination on top of it. Here too: consent has to control the pixel and CAPI – server-side is not consent-free.
• GDPR checklist for the setup: consent coupling across all channels; a data processing agreement with every service provider/recipient; a documented legal basis per processing activity; third-country transfer checked (DPF/SCC); data minimization (only necessary parameters, IP handling); a data protection impact assessment where tracking is extensive; a maintained record of processing activities.

From legally sound data to fair evaluation: AI attribution

Legally sound, complete tracking is the prerequisite – but it doesn't yet answer the actual marketing question: which channel really caused the sale? On a complete, GDPR-compliant data foundation, Tracify runs a behavior-based, AI-powered attribution that measures the actual, incremental contribution of every touchpoint – not just the last click. Only complete data and fair weighting produce reliable numbers. More on this in hybrid tracking and in AI attribution.

Conclusion

Server-side tracking is possible with legal certainty – but not because it's server-side, rather when you cleanly solve both levels: access to the device under § 25 TDDDG and processing under the GDPR. "Server-side = consent-free" and "EU server = US transfer solved" are myths that can get expensive.

Consent-free tracking isn't a switch but a narrow strategy that needs expert review: no consent-requiring device access, genuine anonymity or a viable basis – ideally with a certified method and processing in Germany. Precisely this combination of complete data, legal certainty, and fair AI attribution is Tracify's approach.