GDPR-compliant conversion tracking:
measure on a sound legal footing, without losing data

Generally no. As soon as tracking accesses information stored on a user's device or stores information there (cookies or comparable identifiers), Section 25 of the German TDDDG requires active consent. This applies to classic conversion tracking via Google Ads or the Meta Pixel and to most server-side setups alike. Exceptions are narrow (strictly necessary operations). Fully consent-free measurement is realistically only conceivable with strongly data-minimising, cookieless methods such as a suitably configured Matomo instance, and even that is a case-by-case assessment. This is a professional opinion, not legal advice.

Three pieces belong together: first, active consent via a legally compliant cookie banner (no pre-ticked boxes, rejecting as easy as accepting); second, a privacy policy that names the tracking and the services in use; and third, a data processing agreement (DPA) under Art. 28 GDPR with providers such as Google. Google conversion tracking counts as processing on behalf of the controller, so the DPA is mandatory (e-recht24.de).

Yes. Anyone using Google services such as GA4, Google Ads conversion tracking or the server-side Tag Manager with Google tags processes personal data on behalf of the controller and needs a data processing agreement under Art. 28 GDPR. With Google, the relevant Data Processing Terms are accepted when the account is created and stored in the account. The same principle applies to Meta, TikTok and other platforms.

No. This is the most common misconception. Server-side tracking improves data quality, stability and control, but it does not replace a legal basis. If a user rejects consent in the banner, a server-side container may not pass personal data to Google, Meta or TikTok without consent either, not even in anonymised or hashed form. Server-side is not a consent bypass. Set up correctly, it enforces consent on the server and collects more complete data only where a legal basis exists (tobiasbatke.com).

In Germany, realistically around 40 percent of users reject cookies. Without countermeasures, roughly 30 to 50 percent of conversion data is then missing in GA4 and the ad platforms (konzept54.de). This gap optimises your bidding algorithms on a distorted basis, so you pay twice: once in data protection exposure and once in wasted ad budget. Consent Mode v2 plus server-side recovers part of it in a legally compliant way.

Since the adequacy decision of July 2023, transfers to the US under the EU-US Data Privacy Framework are in principle possible again where the recipient is certified. The framework is, however, considered unstable: privacy advocates such as noyb have already announced a challenge along the lines of Schrems II, a possible Schrems III (jentis.com, taggrs.io). Anyone who wants to reduce the residual risk keeps as many processing steps as possible inside the EU, which is exactly where German infrastructure comes in.

The TDDDG (the German Telecommunications Digital Services Data Protection Act) replaced the TTDSG on 13 May 2024 and is the authoritative German law for cookie consent. It requires consent before any access to the device and complements the GDPR. Violations can be fined up to 300,000 euros (cortina-consult.com). In practice this means the banner must sit in front of every consent-requiring tag, and consent must be passed cleanly to all downstream tools at a technical level.

Consent Mode v2 is a consent signal: it tells Google in real time whether a user has agreed and thereby controls which data is collected and whether conversions are modelled. Server-side tracking is an architecture: events run through your own server container instead of straight from the browser, which makes them more resilient against ad blockers and ITP and gives you data sovereignty. The two complement each other. Consent Mode governs the whether, server-side governs the how and where. Only together do you get a legally sound and technically complete setup.