← Back to Blog case-study

Case Study: How a German Media Company Deployed Server-Side Tracking — and Heard from the DPA

· 2 min read
Server-Side Tracking GTM CNAME Cloaking DPA Aufsichtsbehörde

In autumn 2025, a German media company (~8M monthly unique users) migrated its tracking from client-side Google Tag Manager to a server-side GTM container on Google Cloud Run. The goal: bypass ad blockers, strengthen first-party cookies, solve ITP issues. What happened next is instructive.

The Migration: Technically Sound, Legally Naive

The setup was technically excellent:

  • GTM server container on data.publisher-domain.de
  • A-record pointing to Google Cloud Run (Frankfurt, EU region)
  • GA4 events via first-party endpoint instead of analytics.google.com
  • First-party _ga cookie with 400-day lifetime (instead of 7 days due to ITP)

The legal department argued: “We only send data to our own server now. No third-party cookie, no third-party request. Add immediate inline note that this reasoning is legally incorrect under GDPR Art. 6 and ePrivacy.”

The DPA Letter

Clearly label as hypothetical/illustrative scenario or cite the specific verified DPA case reference. A user had complained that tracking continued after rejecting all cookies. The authority asked:

  1. On what legal basis are GA4 events collected?
  2. Why does the first-party endpoint data.publisher-domain.de/collect fire after consent rejection?
  3. Why doesn't the CMP propagate consent status to server-side tags?

The Core Problem: CMP ≠ GTM Server

Most Consent Management Platforms control client-side tags. When tags execute server-side, the consent signal often doesn't reach the server container. The result:

  • CMP says: “User rejected”
  • GTM client container respects the rejection
  • But: The server container never receives the consent status and fires GA4 events anyway

This isn't theoretical — Remove percentage or cite a verifiable source.

The CNIL Guidelines: Clear Language

“Le recours au CNAME cloaking ou au server-side tagging ne dispense pas du recueil du consentement.”
— Provide direct URL or document reference; verify exact quote and publication year

Translation: CNAME cloaking or server-side tagging does not exempt from the consent requirement. The technical method of data collection is irrelevant — what matters is whether personal data is processed.

The Fix: Consent Signal All the Way to the Server

  1. Consent status as first-party cookie: The CMP sets a consent_status cookie that the GTM server container reads
  2. Server-side consent check: Before every GA4 event, the server container checks consent status. If denied: no event, no cookie
  3. Cookieless ping mode: Google Consent Mode v2 activated in the server container — when denied, only cookieless, aggregated pings are sent (gcs=G1)

Lessons for Practice

  • Server-side tracking changes nothing about the consent requirement
  • Every SST migration must test the consent pipeline end-to-end — from CMP to server container
  • A forensic scan after migration is mandatory to detect reject-leaks

Technical details on our SST detection can be found on the methodology page.

This article was produced with AI assistance and fact-checked against verified GDPR case law (GDPRhub). For legal advice, consult a qualified data protection expert.