Loading auth config...
Skip to main content
Lokker
A diagram illustrating the transition from client-side to server-side tracking, highlighting privacy regulations (GDPR, CCPA), consent management processes, and the roles of edge functions and reverse proxies in data handling and accountability.

Server-Side Tracking and Shifting Accountability

Many organizations are moving tracking from client-side (browser) to server-side implementations, believing this reduces privacy compliance obligations. However, server-side tracking does not remove consent requirements or accountability—it shifts where enforcement and monitoring must occur.

Table of Contents​

The Shift to Server-Side Tracking​

Why Organizations Are Moving Server-Side​

Organizations are implementing server-side tracking for several reasons:

  • Browser Restrictions: Third-party cookies are being phased out by browsers
  • Privacy Controls: Client-side tracking is increasingly blocked by privacy tools
  • Data Quality: Server-side tracking can provide more reliable data collection
  • Compliance Perception: Misconception that server-side tracking reduces compliance obligations

Common Server-Side Implementations​

First-Party Relays:

  • Your server receives data from the client
  • Your server forwards data to third parties (Google Analytics, Facebook, etc.)
  • Data appears to come from your domain, not third-party domains

Edge Functions:

  • Cloudflare Workers, AWS Lambda@Edge, Vercel Edge Functions
  • Process requests at the edge before reaching your origin server
  • Can modify, enrich, or forward data to third parties

Reverse Proxies:

  • Intercept requests between client and server
  • Can inject tracking pixels or forward events
  • Operate transparently to the client

Event Forwarding Pipelines:

  • Server-side event collection and forwarding
  • Google Tag Manager Server-Side, Segment, Tealium
  • Collect events server-side and route to multiple destinations

Moving tracking server-side does not eliminate privacy compliance obligations:

Consent Requirements:

  • GDPR: Still requires consent for processing personal data, regardless of where processing occurs
  • CCPA/CPRA: Still requires disclosure of data sharing, even if routed through your server
  • State Privacy Laws: Still require opt-out mechanisms for data sales/sharing

Disclosure Obligations:

  • Privacy policies must still disclose what data is collected and shared
  • Third-party disclosures must include server-side data forwarding
  • Data processing agreements still required for third parties receiving data

The "First-Party" Misconception​

Common Misconception: "If data goes through our server first, it's first-party data and doesn't require consent."

Reality:

  • Data destination matters: If data is ultimately shared with third parties, consent/disclosure is still required
  • Purpose matters: Processing for third-party purposes (advertising, analytics) still requires consent
  • Legal basis matters: Server-side forwarding doesn't change the legal basis for processing

Where Accountability Shifts​

New Areas Requiring Visibility​

Privacy teams now need visibility into infrastructure that was previously out of scope:

Edge Functions:

  • Cloudflare Workers, AWS Lambda@Edge, Vercel Edge Functions
  • Can forward data to third parties without client-side scripts
  • Often invisible to traditional client-side scanning tools

Reverse Proxies:

  • Cloudflare, Fastly, Akamai, AWS CloudFront
  • Can inject tracking or forward events server-side
  • May operate at network level, not application level

Event Forwarding Pipelines:

  • Google Tag Manager Server-Side, Segment, Tealium
  • Server-side event collection and routing
  • Can forward to multiple third parties simultaneously

API Endpoints:

  • Custom endpoints that forward data to third parties
  • Webhook handlers that process and forward events
  • Backend services that enrich and share data

Why Traditional Monitoring Fails​

Client-Side Scanning Limitations:

  • Cannot detect server-side data forwarding
  • Cannot see edge function processing
  • Cannot identify reverse proxy modifications
  • Cannot track API endpoint data sharing

New Monitoring Requirements:

  • Server-side code audits
  • Edge function configuration reviews
  • Reverse proxy rule analysis
  • API endpoint data flow mapping
  • Event forwarding pipeline documentation

Attorney General Requests​

State Attorneys General can request detailed information about data collection and sharing:

What AGs Can Request:

  • Data Collection Details: What data is collected, when, and how
  • Data Sharing Details: What data is shared, with whom, and for what purpose
  • Processing Locations: Where data is processed and stored
  • Consent Mechanisms: How consent is obtained and documented
  • Server-Side Logs: Logs of server-side data forwarding

Server-Side Logging Requirements:

  • Must maintain logs of all data forwarded to third parties
  • Must be able to provide details of server-side data processing
  • Must document edge function and reverse proxy configurations
  • Must track event forwarding pipeline destinations

Compliance Documentation​

Organizations must maintain documentation for:

Server-Side Data Flows:

  • Map all server-side data forwarding paths
  • Document edge function data processing
  • Record reverse proxy modifications
  • Track event forwarding destinations

Consent and Disclosure:

  • Document how consent is obtained for server-side forwarding
  • Update privacy policies to disclose server-side data sharing
  • Maintain records of data processing agreements
  • Track third-party data recipients

Audit Trails:

  • Log all server-side data forwarding events
  • Maintain records of data processing activities
  • Document changes to server-side tracking configurations
  • Track consent decisions and data sharing

Best Practices for Server-Side Tracking Compliance​

1. Maintain Complete Visibility​

Infrastructure Audits:

  • Regularly audit edge function configurations
  • Review reverse proxy rules and modifications
  • Map event forwarding pipeline destinations
  • Document all API endpoints that forward data

Monitoring Tools:

  • Use server-side monitoring tools (not just client-side)
  • Track data forwarding to third parties
  • Monitor edge function execution
  • Log all server-side data processing

2. Update Privacy Policies and Disclosures​

Privacy Policy Updates:

  • Disclose server-side data forwarding
  • List all third parties receiving server-side data
  • Explain edge function and reverse proxy processing
  • Document event forwarding pipeline destinations

Third-Party Disclosures:

  • Update cookie/technology disclosures
  • Include server-side data sharing in data processing lists
  • Disclose edge function and reverse proxy usage
  • Document event forwarding destinations

Consent Requirements:

  • Obtain consent before server-side data forwarding
  • Honor opt-out requests for server-side data sharing
  • Document consent decisions for server-side processing
  • Provide mechanisms to withdraw consent

Consent Enforcement:

  • Block server-side forwarding when consent is denied
  • Respect opt-out preferences in server-side processing
  • Log consent decisions for audit purposes
  • Provide preference centers for server-side data control

4. Maintain Comprehensive Logging​

Logging Requirements:

  • Log all server-side data forwarding events
  • Record edge function execution and data processing
  • Track reverse proxy modifications and forwarding
  • Document event forwarding pipeline activities

Log Retention:

  • Retain logs for required compliance periods
  • Ensure logs are accessible for AG requests
  • Maintain audit trails of data processing
  • Document changes to server-side configurations

5. Vendor Management​

Third-Party Agreements:

  • Execute data processing agreements for server-side forwarding
  • Document all third parties receiving server-side data
  • Maintain vendor inventory including server-side integrations
  • Regularly review vendor compliance

Due Diligence:

  • Verify third-party compliance with privacy regulations
  • Assess server-side data forwarding risks
  • Review edge function and reverse proxy vendor practices
  • Evaluate event forwarding pipeline vendor security

Common Compliance Pitfalls​

❌ Pitfall: Assuming Server-Side = Compliant​

Problem: Organizations assume server-side tracking eliminates consent requirements.

Solution: Server-side tracking still requires consent and disclosure when data is shared with third parties.

❌ Pitfall: Lack of Visibility​

Problem: Privacy teams don't have visibility into edge functions, reverse proxies, or event forwarding pipelines.

Solution: Implement server-side monitoring and regular infrastructure audits.

❌ Pitfall: Incomplete Disclosures​

Problem: Privacy policies don't disclose server-side data forwarding.

Solution: Update privacy policies to include all server-side data sharing activities.

❌ Pitfall: Missing Logs​

Problem: Organizations can't provide details of server-side data forwarding when requested by AGs.

Solution: Implement comprehensive logging of all server-side data processing activities.

❌ Pitfall: Consent Bypass​

Problem: Server-side forwarding occurs even when users opt out of tracking.

Solution: Implement server-side consent checks before forwarding data to third parties.

Regulatory Enforcement​

State Attorneys General:

  • Can request detailed logs of server-side data forwarding
  • Can investigate server-side data sharing practices
  • Can enforce consent and disclosure requirements
  • Can impose fines for non-compliance

EU Data Protection Authorities:

  • Can investigate server-side data processing
  • Can enforce GDPR consent requirements
  • Can require documentation of server-side data flows
  • Can impose significant fines for violations

Compliance Violations:

  • Fines for failure to obtain proper consent
  • Penalties for incomplete disclosures
  • Enforcement actions for missing documentation
  • Legal liability for unauthorized data sharing

Reputational Risks:

  • Loss of customer trust
  • Negative publicity from enforcement actions
  • Damage to brand reputation
  • Loss of business opportunities

Conclusion​

Moving tracking server-side does not remove consent obligations or accountability—it shifts where enforcement and monitoring must occur. Privacy teams must now maintain visibility into edge functions, reverse proxies, and event forwarding pipelines that were previously out of scope.

Key Takeaways:

  1. Consent Still Required: Server-side tracking doesn't eliminate consent requirements
  2. Disclosure Still Required: Privacy policies must disclose server-side data sharing
  3. Accountability Shifts: Monitoring must extend to server-side infrastructure
  4. Logging Essential: Comprehensive logs required for AG requests and compliance
  5. Visibility Critical: Privacy teams need visibility into previously invisible infrastructure

Rember: Server-side tracking shifts the location of enforcement, not the existence of obligations. Organizations must maintain complete visibility and compliance across all data processing activities, whether client-side or server-side.

Note: This guide provides general information about server-side tracking compliance. Laws and regulations vary by jurisdiction. Consult with legal counsel to ensure compliance with applicable requirements for your specific implementation.