Tracking without cookies in the EU: server-side GTM, CAPI, and what this means in practice

According to Backlinko’s 2026 report, roughly 40% of internet users in Europe use ad blockers - in Germany the figure reaches 49%. Among technical audiences (developers, product managers, IT decision-makers - the exact people who sign off on B2B purchases), ad blocker penetration is even higher. At the same time, Safari and Firefox block third-party cookies by default, and France’s data protection authority CNIL issued combined fines approaching half a billion euros in late 2025 for consent violations. Ignoring the degradation of client-side tracking in the EU is no longer an option.

In practice this means that a standard JavaScript pixel in the EU no longer functions as an effective signal for ad algorithm training: Google and Meta algorithms see 40-60% of real conversions and optimize on incomplete data. The weaker the signal, the more expensive the conversion and the harder it becomes to scale campaigns without losing efficiency. Yet most EU B2B teams continue treating ad account reports as the source of truth - when in reality they’re only seeing part of the picture.

This article explains how server-side tracking works, how Meta and LinkedIn Conversions APIs function, and what to consider from a GDPR standpoint to get complete data without compliance risk. If you’re interested in attribution more broadly, see our article on B2B attribution models.

Why classic tracking is degrading

If you work with EU audiences and still rely solely on client-side JavaScript pixels, you’re losing data. The scale of losses depends on your audience, but the typical picture is:

  • Safari and Firefox block third-party cookies by default - that’s thirty to forty percent of your EU traffic
  • Adblocker penetration in Europe: thirty-five to forty-five percent among technical audiences (your ICP is no exception)
  • Consent Mode with a forty to fifty percent opt-out rate removes the pixel for half of visitors

As a result, your campaigns train on incomplete data. Google and Meta algorithms optimize on forty to sixty percent of real conversions. This leads to effective audiences being underestimated and budget distributed suboptimally.

Server-side GTM: what it is and why it matters

Classic Google Tag Manager runs in the user’s browser: JavaScript loads on the page, pixels send data directly to advertising systems. This is exactly the traffic that adblock and browsers block.

Server-side GTM is your own intermediary server. An event (click, conversion, pageview) is first sent to your server, the server processes it and forwards it to Google Analytics, Google Ads, Meta, LinkedIn, and so on. From the user’s browser perspective - this is a request to your own domain, which adblock doesn’t block.

Practical advantages:

Bypassing adblock - requests to your subdomain (for example, gtm.yoursite.com) go through because adblock doesn’t block first-party domains.

Data accuracy - more events reach advertising systems, algorithms receive a complete signal.

Data control - you decide what data to send and where. You can filter PII before sending to third parties.

Reduced browser load - less JavaScript on the client side, the page loads faster.

Cost of server-side GTM: Google Cloud Platform hosting, approximately $50-150/month for typical B2B traffic. Setup requires a technical specialist (two to three days of work).

Conversions API (CAPI): Meta and LinkedIn

Conversions API is a parallel mechanism for sending conversion data directly from your server to the advertising system, bypassing the browser.

Meta (Facebook/Instagram) CAPI is especially important for those advertising on Meta in the EU. With browser-only tracking you see thirty to fifty percent of real conversions. With CAPI you send events from your CRM or backend: “lead created,” “demo scheduled,” “deal closed.” Meta matches these events to users through a hashed email or phone number.

Event Match Quality (EMQ) - a metric in Meta Events Manager showing how well your server-side events match to users. A good value is 7+ out of 10. If lower - pass more parameters (email + phone + IP + user agent).

LinkedIn CAPI works on the same logic but for LinkedIn Ads. Especially valuable for B2B where LinkedIn is the primary paid channel. It allows passing offline conversions: for example, when a lead from LinkedIn closed in the CRM sixty days later, you can attribute that conversion back to the ad campaign.

GDPR and server-side tracking: are they compatible?

Yes, when implemented correctly - they are. Key principles:

Server-side GTM doesn’t eliminate the need for consent. If a user declined analytics cookies, you must not pass their data to Google Analytics or advertising systems - even through the server. Consent Mode v2 must be configured to block sending in the absence of consent.

For CAPI with CRM data - the legal basis is different. If the user filled out a form and provided their email, you have a legitimate interest or direct consent for processing for marketing purposes (depending on your policy). Hashing the email before passing to Meta/LinkedIn is mandatory.

PII must not reach third-party systems in plain text. If you’re interested in how to build a broader first-party data strategy, we cover that in our article on first-party data in 2025. Server-side GTM allows filtering data: for example, passing only an anonymized user ID to GA4, not an email.

Where to start

Prioritization for a B2B company in the EU:

If Meta Ads is your primary channel: implement Meta CAPI first. This gives the biggest data gain for algorithms.

If LinkedIn Ads is your primary channel: LinkedIn CAPI and Insight Tag via server-side.

If Google Ads: configure Consent Mode v2 and Enhanced Conversions (passing hashed user data at conversion).

Server-side GTM as a platform is the next step, allowing you to centralize all of these integrations. But you can start with CAPI without server-side - Meta and LinkedIn support direct API integration.

Realistic result of implementation: +20-40% visible conversions in ad accounts, better quality of algorithm optimization, and a more complete picture for attribution reporting.