In ordinary tagging, each tool's code runs in the visitor's browser. In server-side tagging, the browser sends one stream of data to your server container, and the container sends it on to the tools you choose.
This guide is general. It says nothing about any site of ours, and it is not legal advice.
What is server-side tagging?
Google's server-side tagging overview describes it as a way to instrument your tags to measure user activity wherever it happens. Server containers use the same tag, trigger and variable model as web containers, and Google lists page speed, privacy controls and data quality among the reasons to use them. It says to reap all the benefits you should set up your own domain for the server. The setup builds on our GA4 setup checklist, which covers the basics first.
Do you need it?
Not every site does. It adds a server to run and pay for, and more to maintain. It can help when you run many tags and want control over what leaves your site, when page speed matters, or when you want to send the same events to several tools. For a small site with a few tags, a clean GA4 setup may be enough. Decide from the problem you are solving, not from a trend.
Step 1: Plan what you measure
List the events you need, such as page views, form submissions, calls and purchases, and the tools that should receive them. Check your current tags and remove the ones you do not use. Decide which data must not leave your control. This plan is the same whether tags run in the browser or on a server. Our analytics page covers tracking plans.
Step 2: Create the server container and host it
In Google Tag Manager, create a server container. Google says you can set up a tagging server using Google Cloud or a platform of your choice, and lists three set-up guides: Cloud Run, App Engine and manual set-up. Its Cloud Run guide says you can provision the service automatically in Tag Manager or manually in Google Cloud, describes a preview server for the preview feature and a tagging server for live traffic, and recommends a minimum of two instances to reduce the risk of data loss in a server outage.
The same guide estimates that each server costs approximately $45 a month in US dollars, for one vCPU and 0.5 GB of memory under always-allocated pricing, links to Cloud Run's pricing page and the Google Cloud pricing calculator, and recommends setting a billing alert. That is Google's own estimate, not a price of ours, and your cost depends on your traffic. Check it before you commit.
Step 3: Serve it from your own domain
Point a subdomain of your own site, such as a name under your domain, at the tagging server, and use that address as the server container URL. Google's overview says setting up your own domain is needed to reap all the benefits. Follow Google's guide for your hosting choice, and keep the certificate and DNS records under your control.
Step 4: Send data to the server container
Google's guide to sending data says you can route data through a server-side implementation via Tag Manager or gtag.js, and recommends using the Google Analytics tag on a web page to send data to the server container. The Google Analytics client is pre-installed in the server container by default. If your site uses a content security policy, allow your server container URL in the img-src and connect-src directives for measurement requests and in frame-src for the service worker, and make sure X-Frame-Options does not block iframes from that URL. Follow Google's guide for the exact tag settings in your version of the tools.
Step 5: Add tags in the server container
In the server container, add the tags that forward events to the tools you chose, with triggers that decide when they fire and variables for the data each needs. Start with Google Analytics, then add others one at a time. Remove duplicate tags from the browser so events are not counted twice. Keep a written list of which events go where.
Step 6: Wire in consent
Server-side tagging does not by itself decide whether you may collect data. Google's consent mode guide says consent mode can be implemented in a basic or advanced way, and names four consent types: ad_storage, analytics_storage, ad_user_data and ad_personalization. You set defaults before measurement runs, with the default command on every page, and call the update command when a visitor makes a choice. The guide says consent mode does not save consent choices, so your consent tool has to, and that if you use a consent management platform, it obtains the consent. The two newer types were added in consent mode v2 in November 2023.
Your consent tool and your tags must agree: if a visitor has not agreed to a purpose, your server container should not send data for it. Test this with a fresh browser.
What do the privacy rules say?
Rules depend on where your visitors are. This is general information, not legal advice. In Canada, the Office of the Privacy Commissioner's guidelines for meaningful consent (date modified 11 August 2025) set out seven guiding principles, including emphasizing key elements, giving people clear options to say yes or no, making consent a dynamic and ongoing process, and being ready to demonstrate compliance. In California, the Attorney General's CCPA page (updated 28 August 2026) lists rights to know, delete, correct, limit use of sensitive information and opt out of the sale or sharing of personal information, and says covered businesses must honor the Global Privacy Control as a valid request to stop sale or sharing.
Other places have their own rules, including the EU. Ask a lawyer which apply to your visitors, and record your decisions.
Step 7: Test before going live
- Use preview mode to see each request arrive at the server container and each tag fire.
- Compare numbers with your existing setup for a period, to see differences and explain them.
- Test consent states: accepted, rejected and no choice yet. Confirm the right data is sent in each.
- Check speed: page load should not get worse.
- Check failures: what happens if the tagging server is down? Plan for it.
- Set a billing alert and review hosting cost after the first month.
What goes wrong?
- Double counting, because the same event fires from the browser and the server.
- Missing consent checks, so data flows for purposes a visitor declined.
- Blocked requests, because a content security policy does not allow the server container URL.
- An under-provisioned server, which can lose data in an outage. Google recommends at least two instances.
- Unwatched cost, because nobody set a billing alert.
- No owner, so nobody updates tags when tools or rules change.
Conclusion
Server-side tagging gives you more control over what leaves your site, at the price of a server to run and a setup to maintain. Plan the events, host and secure the container, send data from the Google tag, add server tags one at a time, wire in consent and test hard.
PromotEdge International is an international strategy, technology, marketing and design company, and our delivery team is in India. This guide is not legal advice. See our analytics page.
Facts we rely on: see our company facts for what we state about ourselves and where each fact comes from.