Google Tag Manager (GTM) has long been a key tool for digital marketing professionals, providing valuable insights into the user journey, conversion paths, and ad exposure that you can use to optimise your website.
It provides a convenient way to manage all types of tracking code – from Google Analytics and Adwords to Facebook pixels and Hotjar events – without manually modifying your site’s source code.
But the rise of numerous regulatory regimes designed to protect user data, combined with the increasing use of ad blockers and browser privacy settings, means monitoring how people browse your websites so you can drive conversions has become more and more difficult.
Fortunately, Google has released a new feature for GTM that allows you to continue monitoring the use of your websites while protecting user privacy. With server-side tagging, all data is sent to your own cloud-hosted server, giving you control over what you do with that user data. As added benefits, server-side tagging can also increase your site’s performance and improve security.
In this article, we’ll look at how server-side tagging works, the benefits it offers, and the potential pitfalls you need to be aware of.
How does server-side tagging work?
To understand how server-side tagging works and the benefits it offers, it’s helpful to start by recapping how GTM has worked up until now.
Before Google introduced server-side tagging, most of the action took place in the user’s browser – i.e. on the client. If you wanted to use a service to measure conversions, analyse user behaviour, or earn advertising revenue, you needed to add a dedicated tag to the source code for each of your webpages.
With server-side tagging, your collection of tracking and advertising tags are moved out of the page source code and onto your web server. In their place is a single tag that sends all relevant data to your web server. Once on the server, that data can be filtered, augmented and anonymised before being forwarded to the relevant third-party providers. As we’ll see, this design offers numerous benefits around privacy, security, and performance.
A key part of implementing server-side tagging is setting up a secure web server to receive and process the user data before sending it to the third-party providers. The recommended approach is to set up the server as a custom subdomain (e.g. analytics.your-domain.com).
Advantages of server-side tagging
Reduced page load times
When you switch from client-side tagging to server-side tagging, you’re removing tags from your pages’ source code and running them on your web server instead, and that can make an appreciable difference to page load times. Faster pages not only provide a better user experience but also improve how your pages are scored by search engines.
Respect for user privacy
From a data privacy point of view, client-side tagging poses a problem. Tracking codes typically collect multiple data points about each user’s visit, with some using cross-site tracking cookies to scrape additional information about the browsing habits and search history of a user.
Furthermore, that data is sent straight from the browser to third party providers. Although using tracking data to improve your site design and optimise for conversions is legitimate, the type of data collected and who it is shared with has triggered concerns for user privacy.
To address this, multiple jurisdictions have introduced data protection legislation that aims to give users more control over how their data is used. Major browsers are following suit by adding privacy settings to prevent cross-site tracking.
For example, Safari Intelligent Tracking Prevention (ITP) limits the duration of third-party cookies, stopping ad providers from setting cookies that track return visits after more than 24 hours. Ad-blocking software is increasingly popular with privacy-conscious individuals, as well as those wanting to improve page load times and limit downloads to save their bandwidth.
Sever-side tagging allows you to gain insights into user behaviour while protecting your users’ data. Because the third-party service no longer has direct communication with your users’ browsers, you maintain control over what data is collected and shared.
Assuming you’ve set up your web server with a custom subdomain, any cookies you do set will be first-party rather than third-party, exempting them from the restrictions imposed by ITP. Similarly, ad blockers target tags from known ad providers, but removing those tags from your page’s source code means there is nothing to block.
Maintaining an up-to-date content security policy (CSP) is essential for protecting visitors to your site from cross-site scripting attacks where a user’s browser is tricked into downloading and executing a malicious script.
With client-side tagging, you have to relax your CSP so your users’ browsers can download and execute your third-party providers’ tags, widening the potential attack surface. Moving to server-side tagging means limiting your CSP to allow only scripts from your domain to run when a user visits your site.
Server-side tagging can also protect your site from measurement protocol spam, whereby hackers spam your tracking IDs with automated requests. Their aim is to pollute your data with fake visits and make your analytics worthless. By moving your tracking IDs to a GTM container on your web server, you can prevent this type of attack and maintain the integrity of your usage data.
Considerations for server-side tagging
While there are clear benefits to server-side tagging, it’s worth bearing in mind the following considerations before migrating your tags.
Setting up web servers with a custom domain, installing the GTM container, migrating existing tags, creating a tag to send data to your server and configuring the client to process that data.
The work involved in setting up sever-side tagging is not insignificant and will require technical support. You can reasonably expect to involve your IT team in the infrastructure elements and need web development expertise to configure GTM for your organisation’s needs.
In addition to the technical skills involved in setting up server-side tagging, it’s important to estimate and budget for the running costs involved with server-side tagging. Given the value of the data you’re collecting and the insights you can derive from them, you should consider setting up multiple web servers to ensure redundancy. If one fails, you can continue to track usage.
The more visitors you have to your site, the more data you will collect, in which case you may need to scale your infrastructure further, just as you do for the servers serving your site’s content.
While server-side tagging was in beta, the only option was to host the server on Google Cloud Platform. Now that server-side tagging has been released for general availability, you can host the server anywhere that supports Docker containers, including most public and private clouds, as well as on your own infrastructure.
Server-side tagging offers multiple benefits in terms of performance, user privacy and security. While there are considerations to bear in mind, in most cases the pros significantly outweigh the cons. With server-side tagging for Google Tag Manager now released for general availability, it’s a good time to start experimenting with server-side tagging.