Server-side tracking keeps more conversions out of reach of ad blockers and Safari's cookie limits, and more leads reach the CRM with the source that earned them. Your site sends one first-party request to server-side GTM on Cloud Run or Stape, or Google Tag Gateway serves Google tags from your domain. Consent still decides what fires.
Ready to build? Server-side GTM or Tag Gateway runs as an Advanced Tracking Build of 5 to 8 weeks. Plan your server-side setup
A lead with no GA4 client ID cannot be joined to the session that produced it, and Google Ads has no click to credit. Across Waftr client audits, 28% to 41% of CRM form leads arrived that way. Pick your volume to see what the range means for your pipeline, and which part of it a server can reach at all.
1Form leads reaching your CRM each month
2Show the result
Each form submit carried the visitor's GA4 client ID into the CRM in a hidden field. We counted the CRM records where that field was empty. The delivery pipeline was tested first, which means an empty field marks a browser that never wrote the ID.
Leads arriving with no GA4 client ID
280 to 410of 1,000 form leads a month
Blockers stop requests to Google and Meta domains. Google Tag Gateway serves Google tags from your domain, and server-side GTM extends first-party delivery to Meta and BigQuery. Read this number as the ceiling of what first-party serving can reach.
These visitors refused tracking, and their choice stands under any setup. Advanced Consent Mode v2 sends cookieless pings instead, which makes GA4 behavioral modeling and Google Ads conversion modeling eligible.
Your own share can fall outside the range. Audience, browser mix and banner design all move it.
Read the client ID. In Google Tag Manager, a first-party cookie variable reads _ga. The client ID is the last two number blocks of its value.
Write it into each lead form. Add a hidden field filled from that variable and map it to a property in your CRM.
Prove the pipe. Submit test leads with consent accepted and confirm the ID lands in the CRM every time.
Count after a few weeks. Divide the leads with an empty field by all leads from those forms. That is your share.
The Advanced Tracking Audit runs this reconciliation for you, then splits the result by cause.
Three questions settle the Google Tag Gateway vs server-side GTM choice for most setups, and sometimes the answer is to stay client-side. Answer them in order: each one rules a route in or out, and the end of your path is the setup we would scope.
Check in GTM Preview: submit your own form with consent accepted. The conversion tag should fire once, on success. The free GA4 audit tool shows whether tags load from your domain, and a GTM audit tests the container itself.
No Stay client-side and fix the web containerYes Go to Q2
In GA4, compare the Direct share of returning users on Safari with the same share on Chrome. A clearly higher Safari figure points to Intelligent Tracking Prevention cutting cookies short.
Yes Server-side GTM with server-set cookiesNo Go to Q3
Google Tag Gateway forwards Google's own tags and nothing else. Any other destination needs a tagging server.
Yes Server-side GTMNo Google Tag Gateway
Your pathQ1 yes, Q2 no, Q3 no: Google Tag Gateway
A tagging server forwards whatever the browser hands it, broken triggers and duplicate tags included. Rebuild the web container from a data layer spec, with Consent Mode v2 and Enhanced Conversions, and revisit server-side once the tags are clean.
You run Nothing new to host
See the rebuilt web containerA server container on a first-party subdomain or a path of your main domain. It sets cookies from the server, feeds GA4, Google Ads, the Meta Conversions API and BigQuery, and checks consent before each one.
You run Cloud Run in a Google Cloud project, or Stape, billed to you
Google's tag and its measurement requests travel through your domain, routed by a CDN or load balancer you already run: Cloudflare, Akamai, Fastly or Google Cloud. The enterprise SaaS build paired it with server-side tagging.
You run A routing rule on your CDN, with no server to host
Server-side tracking sends your site's measurement data to a tagging server you control, on your own subdomain or a path of your domain, instead of letting the browser call each vendor. The server container reads the consent state, then forwards events to GA4, Google Ads, the Meta Conversions API and BigQuery.
The Consent Mode v2 state passes from the web container to the server container with each request, and server tags check it before sending. The banner side is covered under Consent Mode v2 setup.
Safari also caps a server-set cookie at 7 days when the server's IP address does not share the first half of your site's address. A tagging server on its own cloud subdomain usually falls under that rule. Serving it from a path on your main domain keeps the cookie's full life.
Google Tag Gateway forwards Google's requests through your CDN. It runs without a container or custom logic, and it cannot strip or enrich data before Google receives it.
One stream of events arrives from your site, and the server container builds a separate request for each platform with only the fields that platform needs. Conversion APIs such as Meta and LinkedIn can run from the same container.
Events from the GA4 client, forwarded after the consent check. A server-set cookie can keep the client ID stable across visits.
Conversion tags and Enhanced Conversions, with hashed first-party data from the form attached for matching.
Events to the Meta Conversions API from your tagging server. If the browser pixel also runs, both copies carry the same event ID and Meta keeps one.
Every event written before any platform filters it, which gives you a record to reconcile against CRM leads line by line.
Delivered by Waftr. Store events reach the server container like any other site's, and each platform receives them only after the consent check.
Eight questions to settle before a server-side GTM or Google Tag Gateway build is scoped.
Different failures on the same layer. The enterprise SaaS build went after blocked requests, and the US retail build went after Safari's cookie limits. Each result appears exactly as its case study publishes it, with the window it was measured over.
| Detail | Enterprise SaaS | US retail |
|---|---|---|
| What broke | Ad blockers and privacy browsers kept GA4 from loading. Leads reached the CRM with no source and were counted as direct. | Safari ITP cut cookie life from 30 days to 7, and to 24 hours for paid search visits. Returning visitors landed in direct. |
| What was built | Server-side tagging and Google Tag Gateway, a UTM fallback for paid traffic and a document referrer fallback for organic visits. | Server-side tracking with server-set cookies, Consent Mode v2, and modeling in GA4 and Google Ads. |
| Consent | The existing OneTrust setup stayed as it was. | Consent Mode v2 set up alongside the server work. |
| Delivery | 1.5 months with the client's web team. Audit, Build, then Care on a monthly retainer. | One Tracking Build. |
| Measured | Share of CRM leads counted as direct, 2 months before vs 2 months after. | Cost per lead after the server-side setup. |
| Result | 53% to 38%leads counted as direct, down 15 points | -20%cost per lead |
| Case study | Read the enterprise SaaS case | Read the US retail case |
Neither number is a forecast for your site. The estimator above shows exposure; these two columns show what two finished builds measured.
An sGTM setup runs 5 to 8 weeks as part of an Advanced Tracking Build. Consent is set up first, then the data layer, then the cloud project, subdomain and server tags, then tests in each consent state. Both containers go live together, after your team approves the version.
The Advanced Tracking Audit includes a server-side review. If GA4 itself is in doubt, a Google Analytics audit comes first.
Consent goes in before any tag moves. Retrofitting it after tags are live is the failure we meet most often.
We write the spec, your developers push it, and we verify each value in GTM Preview.
A Google Cloud project or Stape account in your name, the first-party subdomain or path, and a client and tags per destination.
Server Preview in accept, reject and no-choice states, then both containers publish with version notes and a handover call.
Server-side tracking is quoted inside an Advanced Tracking Build, as one fee agreed in writing before work starts. Four things move that quote, listed below. Hosting never passes through Waftr: Google Cloud or Stape bills you for it directly.
Several sites, brands or regions under one plan become an Enterprise Build, scoped per project.
13 years in digital analytics across 10+ industries and 50+ global teams stand behind each build, with Google Analytics, Google Tag Manager and OneTrust certifications held across the Waftr team.
