A common belief I hear is that server-side tracking "gets around" cookie banners. It does not. Server-side GTM changes where your tags run, not what your visitors agreed to. What it does change is how consent has to be handled, because some server tags understand consent automatically and others ignore it completely. This guide explains the full path from the banner to the server and how to make every tag follow it.
If you are new to Consent Mode itself, read Consent Mode v2 explained first.
How does consent reach the server container?
Consent travels with each event, inside the request the web container sends to your server.
- The visitor makes a choice in your cookie banner (CMP).
- The CMP updates Google Consent Mode v2:
ad_storage,analytics_storage,ad_user_dataandad_personalization. - The Google tag in your web container sends GA4 events to your server container, and adds the consent state to each request as encoded parameters (
gcs, and in newer requestsgcd). - The server container's GA4 client reads the request, including the consent state, and passes it to the tags that run on that event.
The server never sees the banner. It only knows what each request tells it, so if the web side does not set consent correctly, the server cannot fix it.
Which server tags respect consent automatically?
Google's own server tags do; most others do not.
| Server tag | Reads Google consent automatically? | What you need to do |
|---|---|---|
| GA4 | Yes | Make sure Consent Mode is set on the web side |
| Google Ads conversion / remarketing | Yes | Same as above; check ad_user_data for enhanced conversions |
| Meta Conversions API | No | Add a consent condition to the trigger |
| TikTok Events API | No | Add a consent condition to the trigger |
| Pinterest, Snapchat, LinkedIn CAPI | No | Add a consent condition to the trigger |
| Custom webhooks / CRM | No | Decide per purpose and add conditions |
How do you make Meta CAPI respect consent?
You give the server container a clear consent value and use it in the trigger.
- Send the consent state with each event. Many setups parse the
gcsvalue in the server container with a variable template. Alternatively, add an event parameter such asconsent_marketing: grantedordeniedin the web container, set from your CMP. - Create a server variable that returns the marketing consent state for the current event.
- Add a condition to the Meta CAPI trigger: fire only when marketing consent equals
granted. - Repeat for TikTok, Pinterest and any other advertising tag.
If your Meta Pixel also respects consent in the browser, the browser and server sides now follow the same rule, and deduplication still works for visitors who accept.
What happens when a visitor declines?
With advanced Consent Mode, Google tags still send cookieless pings when consent is denied. These do not store or read cookies, but let Google model conversions for visitors who declined. In the server container:
- GA4 and Google Ads tags receive these pings and handle them according to the consent state.
- Meta and other non-Google tags should not fire for advertising when marketing consent is denied.
If you use basic Consent Mode, nothing is sent until the visitor accepts, so the server container simply receives fewer events.
Does consent change by country?
Yes. Strict opt-in is required for visitors in the EEA, UK and Switzerland. Many US states use opt-out rules instead, and other countries vary. Most CMPs can set different defaults by region, for example denied in Europe and granted elsewhere. Your server container just follows whatever state arrives with each event, which is why getting the web side right matters most.
How do you test consent with server-side GTM?
Test both choices before you go live:
- Decline all in the banner, then trigger a purchase or lead
- In server GTM Preview, confirm the GA4 request shows denied consent and Meta CAPI does not fire
- Accept all, repeat the action, and confirm every tag fires with full data
- Check that consent updates apply without a page reload, if your CMP supports it
- Confirm no tag in the web container fires before the consent default is set
The free Tracking Checker shows whether a cookie banner and a Consent Mode default are present on your site, which is a quick first check.
Final thoughts
Server-side GTM and Consent Mode work well together, as long as you remember that only Google's tags understand consent on their own. Pass a clear consent value to the server, add it to every non-Google tag, and test both choices. If you want your consent and server-side setup checked, see my conversion tracking service or book a free audit.