Consent and privacy: control, not bypass

You still need a consent banner, and you still need Google Consent Mode configured so that tags default to a denied state until the visitor opts in. The fact that an event passes through your own server does not grant you permission the visitor has not given. If anything, the discipline is the same as client-side: collection is gated on consent, and the gate sits in front of the whole pipeline. Treat any pitch that frames server-side tracking as "no more cookie consent needed" as a red flag, because it is describing a configuration that would put you on the wrong side of the rules you are trying to respect.

There is a real privacy advantage here, and it is worth understanding precisely because it is the honest one. Because every event now flows through a single endpoint you own, you have a checkpoint that did not exist before. A raw browser pixel ships data straight to a vendor with nothing in between; you could not inspect it, shape it or hold anything back. With a server-side container, the data passes through infrastructure you govern before it reaches anyone else.

That checkpoint is where data minimisation becomes something you do rather than something you hope the vendor respects. You decide what is forwarded onward and what is held back. The privacy story is not "track more without asking"; it is "the data you are permitted to collect passes through a gate you control on its way to vendors", which is a stronger position than trusting a pixel you cannot see inside.

For an operator working under GDPR, this reframes a compliance obligation into something you own rather than outsource. Data minimisation is a principle you are meant to uphold; running your tracking through infrastructure you govern gives you the means to uphold it, instead of delegating the question to whatever a third-party pixel decides to transmit. That is the right way to position server-side tracking to a privacy-conscious buyer or a cautious co-founder: not as a clever workaround, but as moving a governance responsibility onto infrastructure you actually control.

The trap is selling, or believing, the bypass story. It is tempting because it sounds like a bigger win, and it is dangerous because it describes a setup that breaks the rules. The accurate, defensible version is quieter and better: consent still governs collection, and server-side tracking gives you a governance checkpoint you never had. Build it that way, describe it that way, and the privacy story becomes a strength rather than a thing you have to hope nobody examines.