Guide
Server-side conversion tracking and UK GDPR
How sending conversions from your server works, why it improves data quality, and why it never replaces consent.
Short answer: Server-side conversion tracking sends conversion events to ad platforms from your server instead of relying only on a pixel in the visitor's browser. It makes consented data more reliable and gives you control over what is shared. It does not change your UK GDPR or PECR obligations: you still need consent, a lawful basis, the right contracts and a valid transfer mechanism.
Updated 25 September 2026 · 7 min read
What is server-side conversion tracking?
Server-side conversion tracking is a way of telling an ad platform that a conversion happened by sending the event from a server you control. The traditional method is a browser pixel: a snippet of code on your thank-you page that fires when the page loads. The server-side method sends the same information through the platform's conversions API, which is an interface that accepts conversion events directly from a business's systems.
In practice most businesses run both, with the platform removing duplicates so each conversion counts once.
What does server-side tracking actually improve?
- Reliability. Events are not lost when a pixel is blocked, a page errors or a visitor closes the tab too early.
- Control. You decide which fields leave your systems instead of letting a third-party script collect whatever it can see.
- Better matching. Conversions confirmed in your own records, such as a paid order or a won deal, can be sent even when they happen away from the browser.
All three are improvements to the quality of data you are already entitled to share. None of them extends what you are entitled to share.
Does server-side tracking need consent under UK law?
In most marketing setups, yes. Two sets of rules apply.
PECR regulation 6 requires consent before storing or reading information on a visitor's device, unless it is strictly necessary for the service they requested or falls within a narrow statutory exception. The click identifiers and cookies that link a conversion back to an ad click are set and read in the browser, so the consent question arises before any server gets involved.
UK GDPR applies to the personal data you send. That includes hashed email addresses and phone numbers, IP addresses and click identifiers where they can be linked to a person. You need a lawful basis under Article 6, and where you relied on consent to collect the data, sharing it for advertising should stay within what the person agreed to.
Server-side tracking is not a way around a refused banner. Forwarding events for visitors who declined would be processing without consent, whichever route the data takes.
What should you check before switching it on?
Map what you will send
List each conversion event, the fields it carries and the ad platform it goes to, including any hashed email or phone number.
Confirm consent and lawful basis
Check that events only flow for visitors whose consent covers advertising measurement, and record your lawful basis for each purpose.
Check roles and contracts
Establish whether each ad platform acts as your processor or as a controller in its own right, and put the right terms in place.
Cover international transfers
Identify where each platform processes the data and rely on a valid UK transfer mechanism where it leaves the UK.
Update your privacy notice
Tell people which platforms receive conversion data and why, in plain language.
Test and monitor
Verify events arrive once, without duplicates from the browser pixel, and review what is sent at regular intervals.
Who is the controller when conversions go to an ad platform?
You are the controller of your customers' data: you decide what to collect and why. The ad platform's role depends on its terms. Some describe themselves as your processor for certain uses and as an independent controller for others, such as improving their own ad products. Read the data processing terms for each platform you connect, because the answer shapes what you must tell people and what contract you need.
What about international transfers?
The major ad platforms process data in several countries, often including the United States. Under UK GDPR, a restricted transfer outside the UK needs a lawful mechanism, such as a UK adequacy regulation (including the UK-US data bridge for certified US organisations) or the International Data Transfer Agreement. The platform's terms usually say which it relies on; check before you switch the connection on.
How do you keep server-side tracking honest?
Treat the connection as part of your data protection records, not a marketing tweak. Minimise the fields you send to what the platform needs. Keep consent attached to each event so it can be filtered before anything leaves your systems. Review the setup whenever you add a platform, change your banner or change what counts as a conversion. For the wider picture on consent and measurement, see why analytics undercounts after cookie consent.
This guide is general information, not legal advice. For decisions about your own processing, speak to a data protection professional.
Where uForge fits
uForge sends server-side conversions to Meta, Google Ads, TikTok and Microsoft Advertising, with the consent state recorded on every event. It is built to improve the quality of consented data, not to work around consent. Core platform data for UK customers is hosted in AWS London, and the ad platforms you connect are listed in our data processing agreement. See analytics and attribution in uForge and data and privacy.