In this guide
- A server container sets cookies through the
Set-Cookieheader in its response, using thesetCookieAPI in a tag template. - Choose the domain, expiry, Secure, HttpOnly and SameSite values deliberately.
- Cookies set for advertising need consent. Test in the browser, and in Safari.
One of the main reasons to run a server container is the ability to set cookies from your own domain in an HTTP response, which browsers treat more kindly than cookies written by scripts. This page shows how it works in Tag Manager's server container, what each attribute means and how to test. See extending cookie lifetime, Safari ITP and tracking cookies.
How it works
When a request arrives from the browser, the server container builds a response. A tag can add a Set-Cookie header to that response. The browser stores the cookie for your tagging subdomain's parent domain if the attributes allow it. Because it is set in an HTTP response from your own domain, it counts as a first-party cookie.
Runs on your domain, anywhere
Your tracking runs on your own domain, so a visit from any country is handled the same way.
A tag template example
Custom tag templates use sandboxed JavaScript. The setCookie API takes a name, a value, options and an optional flag that disables encoding.
const setCookie = require("setCookie");
const getCookieValues = require("getCookieValues");
const name = "my_visitor_id";
const existing = getCookieValues(name)[0];
const value = existing || data.generatedId;
setCookie(name, value, {
domain: "auto",
path: "/",
"max-age": 63072000, // two years, in seconds (browsers may cap it)
secure: true,
httpOnly: false,
sameSite: "Lax"
}, false);
data.gtmOnSuccess();Add the permissions the template needs (for example, set access to the cookie name) in the template's permissions tab.
The attributes
| Attribute | Meaning | Recommendation |
|---|---|---|
domain | Which hosts may read the cookie | auto sets the parent domain of the tagging host, such as example.com, so the website and subdomains can read it |
path | Which paths | / |
max-age or expires | Lifetime | As short as your purpose needs. Chrome caps at 400 days; Safari may cap server-set cookies in some cases |
secure | HTTPS only | Always true |
httpOnly | Hidden from JavaScript | True if scripts do not need it; false if the browser tag reads it |
sameSite | Cross-site sending | Lax for most tracking cookies |
Check your tracking in one pass
This is an example. Run the check on your own site to see where yours stands.
Restoring cookies
If a cookie was deleted, the server can set it again from a stored copy. Open Tracked's Cookie Keeper does this for platform cookies such as _fbp, using the Data Store, and on the Business plan you can add custom cookies with a name and the days to keep. Use it with consent.
Consent
A cookie set for advertising or analytics needs consent where the law requires it, wherever it is written. Add a consent check to the tag, so it does not set cookies when the visitor declined. See consent in a server container.
Test
- Open a private window and load the site.
- Check the response in the Network tab: a
Set-Cookieheader for your tagging host. - Check the cookie in the Application tab: domain, expiry, flags.
- Test in Safari and check the expiry after eight days.
- Test with consent denied: no cookie should be set.
Watch events arrive, live
A sample feed. In Open Tracked you see the same stream for your own store.
Frequently asked questions
Can a server container set cookies?
Yes, in its HTTP response, using the setCookie API in a tag template.
Why set cookies from the server?
Server-set cookies tend to last longer than script-set ones, especially in Safari.
What is the maximum cookie lifetime?
Chrome caps cookies at 400 days. Safari may cap server-set cookies in some cases.
Do server-set cookies need consent?
Yes, if they are not strictly necessary.
What does Cookie Keeper do?
It keeps platform cookies on your server and restores them for returning visitors, with consent.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Troubleshooting · 6 min read
