Also called: server-side GTM, sGTM, server container, server-side tracking
In a client-side setup, every vendor gets its own script in the browser and its own direct connection to the user. In a server-side setup, one endpoint on your domain receives the event and fans it out server-to-server. The browser loads less code and talks to fewer third parties.
The immediate wins are measurable: fewer third-party scripts (faster pages), first-party cookies set with a full lifetime instead of the seven days Safari's ITP allows for script-set cookies, and resilience against ad blockers that filter requests by hostname.
The cost is real infrastructure. A server container runs somewhere — Google Cloud Run, or an equivalent — and it needs a subdomain, a certificate, monitoring, and someone who notices when it stops. It also concentrates risk: if the endpoint goes down, every vendor loses data at once instead of one pixel failing in isolation.
Why it matters
Server-side tagging typically recovers 10–30% of conversion signal lost to ad blockers and browser cookie restrictions — which matters most for exactly the paid-acquisition channels whose bidding depends on that signal.
Common questions about Server-side tagging
Is server-side tagging worth it for a small site?
Usually not below roughly $50K/month of ad spend. The signal recovery scales with spend, while the infrastructure and maintenance cost is close to fixed, so small sites pay more in operational overhead than they gain in recovered conversions.
Does server-side tagging bypass ad blockers?
Partly. Requests to your own first-party subdomain are not filtered by hostname-based blocklists, so more events arrive. It does not defeat blockers that operate on request patterns, and it does not — and should not — override a user's consent choice.
Does server-side tagging make me GDPR compliant?
No. It changes where data is processed, not whether you have a lawful basis for processing it. If anything it raises the stakes: you become the controller of a dataset you previously handed straight to a vendor, so your consent handling has to be correct before the forwarding logic runs.