iubenda has published a long-form guide and a 16-page white paper with a single unwelcome message for performance marketers: moving your tags to a server you control can claw back lost conversions, but it does not switch off consent.
The guide, dated as updated on October 23, 2026, walks through definitions, platform routes, an eight-step setup checklist and common mistakes. The white paper, A Deep Dive Into Server-Side Tracking: The Foundation Most Marketers Are Missing, carries no date of its own and ends with a pitch for an iubenda server-side product currently listed as coming soon.
The commercial context is plain: iubenda sells consent banners and policy generators, and is part of team.blue NV. The product page mentions five launch destinations — Google Ads enhanced conversions, LinkedIn, Meta, Pinterest and TikTok — and says the service runs on EU infrastructure.
What server-side tracking actually changes
In a standard client-side setup, a visitor’s browser fires tags and pixels directly at Google, Meta and other vendors, and ad blockers and browser restrictions interrupt that path. Server-side tracking replaces those many calls with one: the browser sends events to a subdomain the website owner controls, and that server filters, enriches and forwards them server-to-server.
Because the browser talks to a first-party-looking subdomain, the request is less likely to hit a blocklist. The onward handoff happens where ad blockers have no visibility, iubenda notes, though it also concedes some blockers will block a tracking subdomain once they identify its purpose. Google launched server-side tagging in Tag Manager back in August 2020, so the technology is not new; the compliance pressure is.
Consent stays with the device
The legal section is the heart of both documents. GDPR Article 6 requires a lawful basis for processing personal data, and the ePrivacy Directive requires consent for reading from or writing to a visitor’s device. iubenda’s central claim is that moving processing to your own server changes the route, not the requirement.
The white paper puts it bluntly: “The rule follows the device, not the data.” A consent management platform still has to record a visitor’s choice, pass it to the tracking server, and make sure only consented events are forwarded. On a first visit the consent state is not yet known, and iubenda flags the handshake between the consent layer and the server as a setup risk. CMO Andreea Mandeal has made the downstream case: without a reliable consent framework, first-party data “cannot be confidently used by any team downstream.”
Read the statistics with their caveats
The documents cite IAB research showing 95% of data and advertising decision-makers expect continued signal loss, and 71% of brands, agencies and publishers are increasing first-party datasets. They also cite a 29.5% global ad blocker usage figure. One caveat matters: the 73% and 72% figures about harder measurement and reduced browser signals came from a scenario in which Google removed third-party cookies in Chrome. Google reversed course in 2025, as the iubenda documents themselves acknowledge.
The page-speed claim is thinner. The guide says a site loading in one second converts up to 3x better than one taking five seconds, but the underlying Portent research applied that figure to B2B lead-generation sites, not e-commerce, and did not measure server-side tracking itself.
What to do before you switch
iubenda is candid that server-side tracking is not plug-and-play, and its checklist is a useful starting point:
- Set up the server layer and point a subdomain such as analytics.yourdomain.com at it.
- Connect the consent platform so nothing fires before a visitor chooses.
- Define filtering, enrichment and blocking rules per destination.
- Run client-side and server-side tracking in parallel for a week or two and reconcile numbers.
- Deduplicate events to avoid counting the same purchase twice.
- Update privacy documentation to reflect the new data flows and receiving vendors.
Pairing the server with Google Consent Mode is the second half of the play. Server-side captures consented data; Consent Mode sends limited, cookieless pings for users who decline and lets Google model the gap.
The broader takeaway for growth teams: treat the tracking server as a policy enforcement point, not a consent workaround. The legal duty attaches at the moment something reads from or writes to a visitor’s device, and that does not move just because the data does.
Source: PPC Land
