Does server-side tracking require consent?

Server-side tracking can require consent. Moving data processing to a server does not remove requirements that apply to the original collection or access to information on a visitor’s device.

For example, if a browser collects an advertising identifier and sends it to a server, moving the subsequent processing to that server does not make the original collection exempt. By contrast, a backend event generated as part of fulfilling an order does not require cookie consent simply because it is processed on a server. Its purpose, data use and any subsequent disclosure may still be subject to other legal requirements.

Where consent is required, the implementation should:

• Obtain consent before the relevant collection or device access.

• Communicate the visitor’s choice to the server.

• Apply that choice to consent-dependent processing and onward transfers.

• Respect withdrawal for subsequent consent-dependent activity.

Google’s server-side consent mode documentation explains how consent parameters can affect supported Google tags. A consent management platform can help collect and communicate consent choices.

However, implementing Google Consent Mode v2 does not by itself establish that every data flow is legally permitted. Other tags, destinations and backend processes must also be assessed based on their purpose, data and applicable law.