Server-side GTM for B2B attribution

What is server-side tagging in GTM?

Server-side tagging is a way to run Google Tag Manager on a server you control instead of only in the visitor’s browser.^[1] The browser sends one stream of data to your server container. The container then decides what to pass to Google Analytics, ad platforms and other tools.

Google lists two main benefits. You have full control over how the data is shaped and where it is routed, and only you can see the data on the server until you choose to send it on.^[1] For B2B that means fewer vendor scripts and one place to strip fields no vendor needs.

Why does first-party context matter?

Where the container lives decides what it can do with cookies. Google’s custom domain guide gives three options: the default hosting domain, a subdomain of your site, or a path on your main domain served through a CDN or load balancer.^[2]

On the default domain the container can only set JavaScript cookies. On your own subdomain or path it gets what Google calls the security and durability benefits of server-set cookies, and Google names same-origin serving as best practice.^[2] Google also advises setting up the container on your first-party domain before you send production traffic.^[1]

What does Safari’s ITP actually limit?

WebKit documents Intelligent Tracking Prevention on its own site, and the details matter more than the summaries that circulate:^[4]

• Third-party cookies are blocked by default, with no exceptions outside the Storage Access API and a temporary compatibility fix for popups.

• Script-written storage, including cookies created in JavaScript and LocalStorage, is deleted after 7 days of no user interaction with the website.

• Link decoration: when ITP detects click IDs in a link being picked up by script, it caps JavaScript cookies on the landing page at 24 hours.

• Cloaking: ITP detects third-party CNAME cloaking and third-party IP address cloaking, and caps cookies set in the HTTP response to 7 days.

The cloaking defense arrived with Safari 14 in 2020.^[5] It is the reason a subdomain that simply points at a vendor’s hosts does not give you durable first-party cookies. WebKit’s table shows no cap when the subdomain resolves to your own infrastructure, and a 7-day cap when it resolves to a third party.^[4]

So does server-side GTM fix Safari?

Partly, and only when it is set up as first party. A container on a path of your main domain that sets cookies in the HTTP response sits in the configuration WebKit does not cap.^[4] A container on a subdomain that points to a cloud host may still be treated as cloaked. WebKit does not publish the exact IP address test, so check cookie expiry in Safari after launch rather than assume it.

It does nothing for the 7-day limit on cookies your own scripts write, or for visitors who block scripts outright. A longer cookie also only helps on the same browser, and B2B buyers often switch devices. That is why the CRM record, not the cookie, should carry attribution for long cycles. Our guide to B2B marketing without third-party cookies covers the wider picture.

Does consent still apply on the server?

Yes. Moving a tag to a server changes where it runs, not what the visitor agreed to. In Google’s setup the Google tag adds consent parameters to each request it sends to the server container, and Google product tags in the server are consent-aware and adjust what they send.^[3] You only configure consent mode in the web container.^[3]

For non-Google tags in the server container, build the same rule yourself: read the consent state on the request and drop ad data when it is denied. A setup that forwards everything regardless of the banner is a legal risk, however clean the data looks.

What does it cost to run?

Server-side tagging is infrastructure you own. Google’s Cloud Run guide requires a Google Cloud billing account, recommends at least two instances to reduce the risk of data loss in an outage, and tells you to set a billing alert.^[6] Each instance is billed, and the maximum instance setting is the worst case you could pay for.^[6]

Beyond hosting, budget time for:

• Mapping a domain or path, which may need DNS, CDN or load balancer changes.^[2]

• Moving tags one at a time and comparing numbers before and after.

• Monitoring, version control and updates to the container and its templates.

For a small site with simple tags, consent mode and a tidy web container may be enough. Server-side earns its keep when several vendors, sensitive fields or conversion feeds run through one place.

How do conversions APIs fit in?

Server-side tagging handles browser events. Conversions APIs carry the outcomes that happen later, in your CRM:

• Meta recommends running its Conversions API alongside the Pixel and deduplicating with a shared event ID and event name.^[7] See our guide to Conversions API match quality.

• LinkedIn accepts server events with identifiers such as a hashed email or its first-party ad tracking ID, with conversion times within the past 90 days.^[8]

• Google Ads enhanced conversions for leads use hashed first-party data from your forms to tie offline sales back to campaigns.^[9]

A server container can send some of these. CRM stages such as a qualified opportunity usually go straight from the CRM or a middleware job. Our guide to closing the loop from CRM to ad spend covers that flow.

Where should a B2B team start?

1. List every tag, what it stores and whether it respects the consent banner.

2. Decide whether you need a server container at all, or only a cleaner web container.

3. If you do, serve it from a path on your main domain and confirm cookie expiry in Safari.

4. Send qualified CRM stages to your highest-spend platform through its conversions API.

5. Read results as aggregates as well, as covered in MTA vs MMM.

Our analytics and attribution service covers these steps as part of our B2B demand generation work.