GTM server-side tracking: what to sort out before you start

October 26, 20266 min read

Short answer: before you set up server-side tracking, sort out six things: access to every platform, a server for the container, your own subdomain or path, consent, the events and data layer, and a test plan. Have those in place and you build the container in one go. Sort them out along the way and you mostly wait for other people.

By the TrackLead team. Technically reviewed by Pieter. Updated: October 2026.

This article covers the preparation. The build itself, step by step, is in the complete guide to setting up server-side Google Tag Manager.

1. Access to every platform, at the right level

Access takes the longest, because you are waiting on the client. Request everything in one go, at the right level per platform:

Google Tag Manager: only an account administrator can create a new container, including a server container. To publish you need the Publish permission on the container. Approve is not enough.
Google Analytics 4: adding or editing data streams needs at least the Editor role.
Google Ads: creating conversion actions works with Standard or Admin access.
Meta: the Conversions API needs an access token. The link to generate it in Events Manager is only visible to users with developer privileges for the business. A system user in Business Settings is the other route.
Google Cloud: if you host on Cloud Run, you need a Google Cloud project with a billing account. Agree whose name it is in.

2. A server for the container

The server container runs on a server that you or the client manage. There are two routes:

Google Cloud Run. GTM can create a server for you automatically, but Google intends that automatic setup for testing. For production Google recommends at least two instances. According to Google, two to ten servers handle roughly 35 to 350 requests per second.
A managed host, such as Stape, TAGGRS or AdPage. It handles the server and scaling for you.

Choose the region up front as well. For EU clients, a server in the EU is the obvious choice. Note: the automatic setup from GTM always runs in us-central1 and Google says it is meant for testing only. For an EU region, deploy the server manually. What each route costs is covered in how much a server-side tracking setup costs.

3. Your own subdomain, and who can change DNS

On Cloud Run a server container gets a run.app address by default. Google recommends mapping your own domain. There are two options:

Same origin: the container runs under a path of the website itself, such as /metrics. Google calls this the best practice.
A subdomain, such as data.client.com. That is easier to set up.

Mind Safari. Cookies from a subdomain that points to another party through a CNAME, or that runs on an IP network very different from the website’s, are kept for seven days at most. So discuss with the host how the subdomain is connected.

Agree up front who at the client can change DNS. It is often a web agency or the IT team, and that costs days if you only ask on the day itself.

Server-side doesn’t change the rules: you still need consent. You set up consent in the web container, and the Google tag passes the visitor’s choice on to the server. Check up front:

Which consent platform (CMP) the client uses, and whether it has a GTM template. Cookiebot and Consent Studio both do.
Whether Consent Mode v2 already works. Since March 2024 you need to send consent signals to Google for visitors in the EEA to keep measurement, personalisation and remarketing in Google Ads.
Which default state applies before the visitor chooses.

How to set that up is covered in Consent Mode v2 in GTM with server-side tracking.

5. The events and the data layer

Decide up front which events you measure and which data goes with them. Put that in a short tracking plan, so you and the client mean the same thing by "a conversion".

Online store: use GA4’s recommended ecommerce events, such as add_to_cart, begin_checkout and purchase. For purchase, transaction_id and items are required. Also send value and currency: without currency, revenue isn’t counted correctly.
Leads: measure the form confirmation, not the button click. Store the click ID, such as the gclid, if you want to send leads back from the CRM later.
Meta: if you send the same event through the Pixel and the Conversions API, give both the same event_id and event name. Meta then removes duplicates within 48 hours.

Check whether the website already pushes that data to the data layer. If not, that is work for the client’s developer, and you would rather plan it now than halfway through.

6. A test plan

Agree up front how you will know it works:

Server container Preview shows per request which client claimed it, which tags fired and what went out to the platforms.
Meta Test Events works with a test_event_code. Test events still count, so remove the code before you go live.
Google Ads shows a status per conversion action under Goals › Conversions › Summary.
The backend: record a week of orders or leads from the client’s own system before you start. That is your baseline.

How to do it

Send the client one request covering all access, at the right level per platform.
Choose the server (Cloud Run or a managed host) and the region, and agree who gets the bill.
Agree the subdomain or path with the client and start the DNS change.
Check the consent platform and Consent Mode v2 in the current web container.
Write the tracking plan: events, data per event and which platforms receive them.
Record the baseline and write down how you will test.

Then you build. The complete guide to setting up server-side Google Tag Manager takes you through it step by step.

With TrackLead your client grants access with one link, and we set up the implementation in your client’s own GTM, on the host you already use. Take a look at tracklead.eu.

Frequently asked questions

How long does it take to set up server-side tracking?

Mostly it depends on the preparation. As long as access, DNS or consent is missing, the project stalls. How long the build itself takes is covered in how long a server-side GTM setup should take.

Do I need a developer?

Not necessarily for the server container. You do if the website doesn’t push the data to the data layer yet, or if DNS is managed by a web agency or the IT team.

Can the server container stay on the `run.app` address?

It works, but Google recommends mapping your own domain. With your own subdomain or path, measurement stays on the client’s domain.

Yes. Server-side changes the route the data takes, not whether you need consent.