Privacy Officers Love owntag
Server Side Tagging on European Infrastructure
Server Side Tagging has established itself as the technical standard for fulfilling Privacy-by-Design requirements under Art. 25 GDPR. With owntag, you get full control over your tracking data flows – hosted on 100% European infrastructure, without Google Cloud, AWS, or Azure.
- EU Infrastructure
- 100%
- No US clouds
- GDPR compliant
- Art. 25
- Privacy by Design
- CLOUD Act Risk
- 0
- European providers
- Setup Time
- 30s
- To running server
The Problem
Why Client-Side Tracking is Problematic
In traditional tracking, the browser communicates directly with third-party servers – without your control.
With a typical tracking setup today, JavaScript tags like gtag.js, analytics.js, or the Meta Pixel run in your users' browsers. These scripts send HTTP requests directly to google-analytics.com, connect.facebook.net, or other third-party domains.
Data is automatically transmitted that you as a website operator have no influence over:
- IP address of the user (always in HTTP header)
- User-Agent (browser type, version, operating system)
- Cookies (including third-party cookies for cross-site tracking)
- Referrer URL and URL parameters (UTM tags, click IDs)
- Device information (screen resolution, viewport, language)
The core problem: Third-party scripts can read arbitrary information from the browser. You don't know exactly what data is actually being collected and transmitted. In a privacy audit, this is difficult to document – and even harder to justify.
Client-Side vs. Server-Side Tracking
The fundamental difference lies in control over the data flow.
Client-Side Tracking
- Direct data transfer to third-party servers (Google, Meta, etc.)
- No control over actually collected data
- Third-party cookies enable cross-site tracking
- IP address automatically transmitted in HTTP header
- Third-party scripts can read arbitrary data
- No way to filter before forwarding
Server Side Tagging
- Data flows through your own server as a gateway
- Full control: You decide which data gets forwarded
- First-party context through custom subdomain
- IP anonymization before forwarding to third parties
- PII stripping: Filter personal data
- Third parties only see server IP, not user's IP
The Solution
Server Side Tagging as Proxy Architecture
An intermediate server between browser and third parties gives you back control.
Server Side Tagging inserts a controlled server into the data flow. Instead of Browser → Third Party, the data flow now goes: Browser → Tagging Server → Third Party.
This server container – in our case the Server Side Google Tag Manager – acts as a gateway. It receives the data, processes it, and then decides what gets forwarded to which recipient.
Custom Subdomain for First-Party Context
Crucial for privacy is setting up a custom subdomain like data.yourdomain.com. This makes the tagging server operate in first-party context:
- Cookies are set as first-party cookies
- HTTP-Only flags are possible
- Safari/Firefox ITP restrictions (7-day limit) don't apply
- Third parties like Google Analytics only see the server's IP address, not the user's
This inherent technical pseudonymization is an important building block for Privacy by Design under Art. 25 GDPR.
GDPR Compliance
How Server Side Tagging Supports GDPR
Server Side Tagging isn't a silver bullet, but it gives you the technical tools to meet privacy requirements.
- Art. 25 GDPR: Privacy by Design
- SST enables data minimization before forwarding – exactly as required by Recital 78 GDPR.
- Art. 32 GDPR: Security of Processing
- Centralized processing on controlled servers instead of in the browser. No third-party JavaScript execution.
- Art. 44 ff. GDPR: Third Country Transfers
- With EU-only hosting and complete anonymization before transfer, there's no transfer of personal data to third countries.
- SHA256 Hashing
- Personal data like email addresses can be encrypted before forwarding (e.g., to Meta CAPI).
- Complete Documentation
- All outgoing requests visible in "Outgoing HTTP Requests" – perfect for audits and accountability.
- No Piggyback Tags
- In client-side tracking, tags can load additional tags. SST completely eliminates this uncontrolled data sharing.
Regulatory Context
Regulatory Decisions on Google Analytics
Landmark decisions by EU data protection authorities have established Server Side Tagging as a compliance strategy.
DSB Austria: The Starting Shot
The Austrian Data Protection Authority ruled in December 2021 that using Google Analytics violates Art. 44 GDPR. Key criticisms:
- IP addresses, cookie IDs, and browser parameters are personal data
- IP anonymization is pseudonymization, not anonymization – Google can re-identify users
- The risk-based approach was explicitly rejected
In a follow-up decision, the DSB called IP anonymization a "useless protective measure."
CNIL France: Proxy Server as Solution
The French CNIL issued multiple decisions against Google Analytics starting February 2022 – and explicitly named proxy servers as a possible compliance solution in their June 2022 FAQ:
- Company must be registered in the EU
- Servers physically located in the EU
- Pseudonymization before data export
- No re-identification possible by the recipient
This is essentially a description of Server Side Tagging with EU hosting.
Other Authorities
The Swedish IMY issued the first fines for Google Analytics use in the EU in July 2023: Tele2 received €1 million, CDON about €29,000. The Danish Datatilsynet recommended stopping Google Analytics or implementing a reverse proxy. Norway's authority warned in February 2025 that European companies should develop "exit strategies" for US services.
The EU-US Data Privacy Framework
Since July 2023, the new EU-US Data Privacy Framework allows transfers to certified US companies. Google is certified. However: noyb has announced "Schrems III," the framework is based on an executive order (revocable at any time), and the EDPB is calling for a re-evaluation. Legal uncertainty remains – another reason to secure yourself with EU-based alternatives.
100% EU Infrastructure
owntag is European
With owntag, you host your Server Side GTM on infrastructure that's not just in the EU, but also owned by EU companies.
owntag GmbH, based in Hamburg, runs all servers on Scaleway – a French cloud provider. We use no Google Cloud, AWS, or Azure.
This means: No application of the US CLOUD Act, which gives US authorities access to data at US companies – even when servers are in the EU. With owntag, you don't have this risk.
owntag for Privacy
What owntag Does for Your Privacy
owntag provides the infrastructure and tools for privacy-compliant tracking – configuration is up to you.
- 100% EU Infrastructure
- Servers on Scaleway (France) – no Google Cloud, AWS, or Azure. No US CLOUD Act applies.
- German Company
- owntag is a German GmbH based in Hamburg. Fully European company under EU law.
- Built-in Geolocation
- Country detection without external API calls. Your user IPs aren't shared with anyone.
- DPA Available
- Data Processing Agreement per Art. 28 GDPR for your compliance documentation.
Privacy-Friendly Geolocation
Detect Countries Without Third Parties
owntag determines origin country automatically – without external API calls and without sharing user IPs.
Geolocation happens completely locally on owntag servers using a constantly updated IP2Location database. No external services are queried.
The country code is provided via HTTP header (x-owntag-usercountry). This lets you use Google's Region-Specific Behavior for Tags feature – e.g., to apply different consent rules for different countries.
Structured Device Information
User Agent Info Without Third Parties
owntag parses User-Agent strings locally and provides structured device data – no external services involved.
User Agent Info parses the User-Agent header on owntag servers and provides browser, OS, rendering engine, and platform type as individual HTTP headers (e.g., x-owntag-device-browser, x-owntag-device-os).
Use this data for analytics enrichment, platform-specific triggers, or passing structured device information to conversion APIs – all without relying on third-party parsing services.
Important to Know
What Server Side Tagging Cannot Do
SST is a powerful tool, but not a silver bullet. You should know these limitations.
owntag explicitly states: "Does using owntag automatically make my tracking GDPR compliant? No, but it gives you the tools to make it compliant." Here are the key limitations:
Limitations and Responsibilities
- Consent Still Required
- SST doesn't exempt you from consent requirements under TTDSG § 25 and ePrivacy Directive. Consent Mode V2 must still be implemented.
- Responsibility with Operator
- You remain the controller per Art. 4 No. 7 GDPR. owntag gives you the tools – correct configuration is up to you.
- Configuration is Key
- Incorrect configuration still leads to privacy violations. Regular audits of outgoing requests are recommended.
- Google Analytics & US Transfer
- With GA4, data is always processed on US servers according to Google documentation. SST is a proxy solution here, not complete exclusion.
Technical Tips
Recommendations for Privacy-Friendly Implementation
These measures help you get the maximum privacy benefit from your SST setup.
Technical Measures
- Set up custom domain: Use a subdomain of your own domain (e.g.,
data.yourshop.com) for first-party context. - Configure IP handling: Remove IP addresses completely (
ip_override: "0.0.0.0") or replace with server IP before forwarding to US services. - Pseudonymize client ID: CNIL recommends a hash with time-variable component:
crc32_hash(IP + UserAgent) + "." + timestamp - Use transformations: Filter data before sending to vendor tags. The Google Ads Tag sends all event data by default – filter what you don't need.
- Check outgoing requests: In SGTM Preview Mode, you can see exactly what data goes to which recipient under "Outgoing HTTP Requests."
Legal Measures
- Execute DPA with owntag per Art. 28(3) GDPR
- Transfer Impact Assessment for remaining US transfers (e.g., Google Analytics)
- Update records of processing (Art. 30 GDPR)
- Adapt privacy policy – mention the server-side tracking setup
- Archive consent logs for accountability under Art. 5(2) GDPR
Conclusion
Server Side Tagging as a Privacy Building Block
Server Side Tagging is a technical building block for more privacy-compliant tracking that substantially supports the requirements of Art. 25 GDPR (Privacy by Design) and Art. 32 GDPR (Security of Processing).
European-only hosting on EU-owned infrastructure – as offered by owntag – eliminates third-country transfer risks for the hosting area and addresses the core criticisms from the Austrian DSB and French CNIL regarding Google Analytics.
The technology gives you as a website operator the tools for better privacy: data filtering, IP anonymization, PII stripping. The responsibility for their correct use remains with you as the controller.
Legal uncertainty from the expected "Schrems III" challenge to the EU-US Data Privacy Framework makes proactive planning with EU-based alternatives advisable. With owntag, you're prepared.
Ready to go server-side?
Take control of your digital data collection with Server Side Tagging – easily and conveniently hosted with owntag.
