Server-side tracking frameworks & methodology

Open your tag manager and count what the site actually fires. A typical mid-market ecommerce estate runs somewhere between 25 and 60 distinct events: purchase, add_to_cart, begin_checkout, newsletter signup, scroll depth, plus two abandoned variants of a lead form nobody has cleaned up since 2021. Now answer the question this lesson exists for. Which of those events leave the browser, which get rebuilt from your own systems, what key identifies each one so it is counted once, and which fields travel with it to Meta, Google and TikTok?

Route everything and you pay per request for volume no bidding model uses, while widening the surface where double-counting happens. Route only purchases and you starve the mid-funnelfunnelThe customer journey from awareness to purchase, typically Awareness, Interest, Consideration, Decision, Action, with prospects narrowing at each stage.View full definition → signal those platforms optimise against. Neither mistake surfaces as an error in a dashboard. It surfaces as a media mix that drifts for a quarter before someone reconciles reported revenue against the order system.

The signal decay that makes any of this necessary is covered in the foundations lesson. What follows is the method: taxonomy, keys, match-rate targets, payloads.

Core concept: tier the event taxonomy before you route anything

Three tiers, decided once, written down as a contract your engineers and your agency both work from.

Tier 1, revenue truth. Purchase, subscription start, qualified lead. These must originate from the system that knows the outcome (payment authorisation, the order record, the CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition → status change), not from a thank-you page render. The distinction is not cosmetic. A browser purchase event fires when the confirmation page paints, which includes authorisations that later fail 3-D Secure, fraud declines and duplicate submissions. A server event fired on authorisation, or better on order capture, excludes them. Brands that trigger Tier 1 client-side and then reconcile against finance routinely find the gap sits in the low single digits on volume but much higher on value, because failed high-basket orders are over-represented.

Tier 2, optimisation signals. Add to cart, begin checkout, view item, search, registration. Send these server-side only if you can attach at least one identifier or click ID. Unmatched Tier 2 volume does not help bidding and it drags your average match quality down, which is the metric the platforms use to decide how much of your signal to trust. Volume with no identity is noise you are paying to transmit.

Tier 3, stays home. Scroll depth, rage clicks, form field focus, internal search strings. These belong in your analytics stack. Routing raw search terms or product URLs to an ad platform is how a supplements retailer or a maternity brand ends up exporting special-category inferenceinferenceThe moment a trained AI model is put to work: it takes a new input and produces an answer, prediction or generated output.View full definition → out of its own estate, in a payload nobody reviewed because it was configured as a variable, not as a decision.

One canonical schemaschemaA schema is the formal blueprint that defines how data is structured, named, typed, and related within a database, file, or message.View full definition →, mapped per destination. Your internal purchase becomes Purchase for Meta, purchase for GA4 and Google Ads, CompletePayment for TikTok. Write the mapping table before the first tag goes live, because the alternative is three platforms counting three different definitions of the same order and nobody able to say which is right.

Key sub-concept 1: deduplication keys are a design decision, not a checkbox

Run browser and server events in parallel, which you should during any transition, and you double-count unless the key is right.

Key on the business object, never on the page view. For purchases the key is the order ID. Meta deduplicates on the pair of event_id and event_name, and only inside a documented window of 48 hours. Google Ads deduplicates conversions on transaction_id. TikTok's Events APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → uses event_id with the event name. So one value, your order ID, can serve all three if you pass it through unchanged.

The failure modes follow from that:

• A random ID generated per page load. The customer refreshes the confirmation page, the browser fires twice with two different IDs, and your server fires once. Three purchases in the platform, one in your order system.
• Independent generation on both sides. If the browser mints a UUID and the server mints its own, nothing matches and every event is counted twice. For Tier 2 events with no natural key, generate the ID client-side and pass it to your server in the same request.
• Batching Tier 1. A nightly export that lands 30 hours after the browser event still fits Meta's window. A queue that backs up over a weekend does not, and the duplicates become permanent.
• Retries. Your forwarding layer gets a 500, retries, and sends the same payload twice. An idempotent event_id absorbs this. Without it, every platform outage inflates your numbers afterwards.

The control is weekly reconciliation of platform-reported conversions against the order management system, by day, not by month. A few percent variance is normal from attributionattributionA framework for assigning credit to the touchpoints that contributed to a conversion, so you can measure which channels and interactions actually drive results.View full definition → windows. Thirty percent or more above actual orders means the key is broken, and the longer it runs the more your bidding has learned from fiction.

Key sub-concept 2: payload design, platform by platform

Each destination wants a different shape. Designing one generic payload and hoping is where match rates die. Note that Google, Meta and TikTok all sell the ad products these APIs feed, so their recommended field sets are commercial recommendations as well as technical ones: they ask for the maximum, you decide the minimum that hits your target.

Meta Conversions API. event_name, event_time as a Unix timestamp (accepted up to seven days old, so a delayed queue is recoverable within limits), event_id, action_source, plus user_data and custom_data. In user_data the useful fields are hashed email, hashed phone, external_id (your customer ID, hashed consistently), client IP, user agent, and the two browser values _fbp and fbc. Rebuild fbc yourself from the click as fb.1.{timestamp}.{fbclid} if the cookie is missing. In custom_data, value and currency, and send the ex-VAT figure your finance team uses or your ROAS will disagree with the P&L by roughly the VAT rate.

Google Ads. Either a click identifier (gclid, or gbraid/wbraid for app-to-web iOS journeys) or Enhanced Conversions hashed identifiers, plus transaction_id and the consent fields ad_user_data and ad_personalization. Send both click ID and hashed email where you have them: the click ID wins attribution, the hash covers the cases where it was stripped.

TikTok Events API. event_id, event_time in seconds, hashed email and phone, ttclid and the _ttp cookie value. Use test_event_code in staging, then remove it, because test-flagged events do not count and teams have shipped a whole quarter that way.

Hashing rules apply everywhere and get broken everywhere: SHA-256, lowercase, trimmed, phone digits only with country code and no symbols or spaces. Two silent killers: hashing a value that was already hashed (match rate goes to zero while the API returns 200 OK), and hashing the literal strings "null", "undefined" or an empty value, which produces a valid-looking hash that matches nothing.

Key sub-concept 3: match-rate targets and the coverage arithmetic

Match rate is coverage arithmetic, not magic. Meta scores event match quality 0 to 10 per event in Events Manager, and the score moves on which identifiers you send and how clean they are, not on how many events you push.

Work it on paper first. Take 100,000 monthly purchases. Say 58,000 come from logged-in customers with a verified email, 24,000 are guest checkouts with a usable typed email, 11,000 carry a phone number but no reliable email, and 7,000 have neither because they came through a marketplace or a call centre. Email alone gives a strong identifier on 82% of purchases. Adding normalised phone takes you to 93%. The last 7% is unreachable by identity and only partly recoverable by click ID. Most teams chase that final slice with fragile workarounds while their phone numbers still sit in the database with spaces and inconsistent prefixes, which is a normalisation fix worth eleven points.

Set the floor in writing per platform and per event. Meta EMQ above 7 on Purchase, with anything below 6 treated as degraded signal rather than a minor issue. For Google Ads, read the Enhanced Conversions diagnostics per conversion action and hold a stated percentage. Then instrument the input: what share of orders captures an email at all is a checkout design question, and it caps everything downstream.

Zalando built a customer data layer that enriches events with CRM-matched identifiers before forwarding them to ad platforms, and reported a double-digit improvement in Meta match rates against browser-only signal. The mechanism is unglamorous: identity resolution happens in your estate, before the API call, using data you already hold.

Key sub-concept 4: consent as a routing variable

Consent state belongs in the routing logic, per destination, not as a single on/off switch at the container door. Google's Consent Mode v2 has been required for EEA markets since March 2024: when a user declines, you send a cookieless ping rather than a full payload, and Google models from it. That is one destination's behaviour. Meta and TikTok tags in the same container need their own suppression rules, because your server holds the full payload including the email, and a misconfigured tag forwards it with no browser restriction to stop it.

Two consequences of getting this wrong. Legally, the exposure is real: in January 2022 the CNIL fined Google 150 million euros and Facebook 60 million euros over consent mechanism failures. Operationally, missing Consent Mode signals means Google's Smart Bidding runs without modelled conversions for opted-out users, and in Germany and France that population can be 40 to 60% of your audience.

Real-world cases

ZALANDO, IDENTITY BEFORE TRANSMISSION: rather than sending whatever the browser happened to hold, the enrichment step attaches CRM-matched identifiers to the event before it reaches Meta or Google. The methodological point is sequencing. Match rate is decided in your own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition → layer, and no payload tuning recovers an identifier you never joined.

THE CALL-CENTRE CONTAMINATION PATTERN: a retailer connects its order system to Meta and Google, and every order flows in, including phone and B2B orders that never involved an ad click. Volume rises, reported CPACPACost Per Acquisition: the total cost to generate one customer or conversion, computed by dividing total spend by the number of acquisitions.View full definition → falls, and Smart Bidding starts crediting whichever channel happened to match by email. The fix is taxonomy, not tagging: separate conversion actions for orders with a digital origin, and correct `action_source` values so the platform knows what it received.

TIKTOK, THIN PAYLOADS AT LAUNCH: a CompletePayment sent with only ttclid and no hashed identifiers validates cleanly and reports as received. It just matches poorly, so the platform discounts it and the campaign looks weaker than it is. Validate with a real order end to end and read the diagnostics, rather than trusting a 200 response.

CMO action items

• Ask for the event contract: one page listing every event, its tier, its dedup key, its destination and its identifier set. If nobody can produce it in a week, the implementation is undocumented, whoever built it.

• Set match-rate floors as targets your team owns, starting with Meta EMQ above 7 on Purchase, and require the checkout email capture rate to be reported alongside it. One caps the other.

• Put weekly reconciliation of platform conversions against the order system into a standing report, by day and by value, not just by count. That single number catches dedup breakage, double hashing and contaminated offline feeds before a budget cycle acts on them.

Common mistakes that kill results

MISTAKE 1: ROUTING EVERY EVENT SERVER-SIDE BECAUSE YOU CAN. Server-side infrastructure bills per request, so Tier 3 traffic costs real money to transmit and buys nothing. It also multiplies the number of event types that need a dedup key, a consent rule and a payload review. Fewer, better-instrumented events beat comprehensive coverage every time.

MISTAKE 2: TRUSTING A SUCCESSFUL API RESPONSE. Double-hashed emails, unnormalised phone numbers, hashes of empty strings and test event codes left in production all return success. The platform received something; it just cannot match it. Verification means placing a real order and reading the match quality diagnostics, not checking that the tag fired.

MISTAKE 3: TREATING THE MAPPING AS FINISHED. Apple adjusts ITP behaviour with major releases, Meta changes required fields, TikTok versions its API, and Google reversed itself twice on third-party cookies inside a year (dropping forced deprecation in July 2024, then confirming in April 2025 that no standalone opt-out prompt would ship). An event contract nobody has revisited in 18 months is a slowly degrading one. Assign an owner the way you assign a CRM owner.

Key takeaways

• Tier your events first: revenue truth from your own systems, optimisation signals only when they carry an identifier, diagnostics never leave your estate.
• Fire Tier 1 on payment authorisation or order capture, not on the confirmation page, or you import failed and cancelled orders into your ROAS.
• Key deduplication on the business object (the order ID), pass the same value to Meta, Google and TikTok, and remember Meta's window is 48 hours, so never batch revenue events overnight.
• Match rate is coverage arithmetic. Fixing phone normalisation or email capture at checkout moves it more than any payload tweak.
• Design payloads per platform: click IDs plus hashed identifiers together, correct action_source, ex-VAT values, and no test codes in production.
• Consent routing is per destination and lives on the server, where the full payload sits and no browser will stop a misconfigured tag.