In this guide
- Moving tracking to a server does not remove the need for a lawful basis or consent where the law requires it.
- It does give you control: you decide what each vendor receives, what is hashed and how long data is kept.
- Use that control to minimise data, document it and respect the visitor's choices.
Marketers sometimes hear that server-side tracking is "GDPR compliant" or, worse, that it avoids consent. Neither is right. GDPR and the ePrivacy rules apply to personal data and to reading or writing information on a visitor's device, whichever machine sends the data on. This page explains what stays the same, what a server container makes possible, and a checklist. It is general information, not legal advice. Ask your own lawyer or data protection officer for decisions. See also Consent Mode v2 and personally identifiable information.
What does not change
- Consent for cookies and similar storage. The ePrivacy rule on reading and writing information on a device applies to a cookie set by your server too, unless it is strictly necessary.
- A lawful basis for processing personal data. For advertising and many analytics uses that is usually consent.
- Transparency. Your privacy notice must say who receives what.
- Visitor rights. Access, deletion and objection still apply.
- Your responsibility. You are the controller of the data you collect from your visitors.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
What a server container makes easier
Data minimisation
Send each vendor only what it needs. Remove fields in a container with allow and exclude rules. See transformations.
One place to enforce consent
Tags can check the consent state in one container instead of in a dozen scripts in the browser.
Control over identifiers
You choose what to hash, what to drop and how long to keep it.
A clear record
The container lists every vendor that gets data, which helps your records of processing.
Fewer scripts in the browser
Fewer third parties read the page directly.
Hashing is not anonymising
Platforms ask you to send e-mail and phone as SHA-256 hashes. A hash hides the plain value from casual view, but it can still identify a person when matched with another list. Under GDPR it remains personal data, so treat it as such: consent, minimisation and security still apply.
Connected in minutes
Add your domain, install the pixel, connect your ad platforms and watch the first events land.
Processors and contracts
Your hosting provider handles data on your behalf, so it is a processor. You need a data processing agreement (DPA) with it, and with every ad platform or analytics tool that receives personal data. Check where servers are located and what transfer rules apply. Open Tracked publishes a DPA on its website; read it and the vendor's sub-processor list, and compare with your own requirements.
Retention
Keep data no longer than needed. In Open Tracked, the Data Store keeps hashed identifiers for the number of days you choose, up to 400. Choose the shortest period that serves the purpose, and document it. Server logs are kept for 3 days on Pro and 10 days on Business.
What to do about IP addresses
An IP address is personal data. Platforms such as Meta use it for matching, and some analytics tools use it for location. If you do not need it, the Anonymizer power-up (every plan) zeroes the last part of the IP or removes it entirely, before it reaches your server container. Tags that rely on the IP, such as GA4's city and Meta's matching, then get less to work with. See GA4 IP anonymization.
A practical checklist
Terms you will see
- Controller
- The business that decides why and how personal data is processed.
- Processor
- A company that processes data for the controller, such as a hosting provider.
- DPA
- A data processing agreement between controller and processor.
- Lawful basis
- The legal reason that allows you to process personal data.
- Data minimisation
- Collecting and sending only what you need.
- ePrivacy
- The EU rules on cookies and similar storage on devices.
Questions to put to your lawyer
Orders from your store, back to the ad that earned them
Your store sends the order once. Open Tracked passes it on to each ad platform, cleaned and deduplicated.
Frequently asked questions
Is server-side tracking GDPR compliant?
Not by itself. It is a technical set-up. Compliance depends on your lawful basis, consent, minimisation, contracts and records.
Do I still need a cookie banner?
Yes, where consent is required. Server-set cookies are still cookies.
Is a hashed e-mail personal data?
Yes. A hash can still identify a person when matched, so treat it as personal data.
Where is the data stored?
Ask your host for its regions and sub-processors, and check them against your transfer rules.
Can I use it without consent in the EU?
Only for processing that has another lawful basis and does not read or write information on the device without consent. Ask a lawyer.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 5 min read
