Looking back at the Server-side Tagging Seminar: the transition to first-party data

On Friday 8 September, we organised our first seminar! This afternoon was entirely dedicated to privacy and tracking, and how to best anticipate these as an online marketing specialist. With sessions from DDMA, Digitale Bazen, Analytics Support, and of course AdPage itself, it was a very successful and valuable afternoon. In this article, we outline the key takeaways from this afternoon for you.

Tracking trends and developments

The day was kicked off by ‘our own’ Bram and Jochem. Both have been working as account managers at AdPage for several years. In particular, over the last year, their expertise has focused on tracking and conversion optimisation. Their mission is to ensure that all the data available to online marketers is as complete as possible.

Bram and Jochem have mapped out the period from March 2021 to the present day using a timeline. The period before 2021 is also referred to by them as the ‘golden age for advertisers’.

In those days, you simply placed a Facebook pixel or a Google Analytics code on your website and could measure everything. In this way, you could see exactly where your conversions were coming from and optimise your campaigns very precisely based on those results. Building audiences, for example for retargeting campaigns, was also quite straightforward using tracking pixels.

Announcement Apple iOS 14.3

The first development we encountered was the Apple iOS 14.3 update. Apple announced this update in March 2021, and it was implemented later that year (in December). This update gave Apple users the ability to disable tracking from third parties. You've almost certainly come across the notification below as an Apple user.

In totaal gaf ongeveer 95% van de Apple gebruikers aan om liever niet getrackt te worden. Dit leidde er toe dat onder andere Facebook veel minder data ter beschikking kreeg. Vanaf het moment dat een Facebook gebruiker (vanaf een Apple apparaat) op een advertentie klikt ‘verliest’ Facebook het zicht en zijn eventuele conversies voor die campagne dus niet meer te achterhalen.

The consequence of this was that the Facebook pixel could only measure 20% to 40% of conversions. Facebook responded to this by introducing the Facebook Conversion API. This allowed a large part of the measurements to be restored, enabling 60% to 70% of conversions to be measured.

Announcement of the end of third-party cookies by Google

2021 proved to be a year full of significant and far-reaching changes, partly due to the Apple update and other privacy developments. In November 2021, Google also announced a major change: the end of Third Party Cookies within Google Chrome.

Google Chrome will also stop tracking visitors via third-party cookies. Logically, this has a huge impact on advertisers, entrepreneurs and platforms. When both Google and Apple make it impossible to measure via cookies, measurements become much less accurate. As Google will only implement the update in 2024, the precise impact is still difficult to estimate. However, given the data loss from the Apple update, the impact here too will be enormous.

The Google update was originally scheduled for 2021 and later in 2023. It is now clear that it will finally be implemented in 2024. For online marketers, it is therefore essential to switch to first-party cookies in good time to prevent a complete loss of insight into figures.

Apple iOS 16.4 Announcement

Following the above developments, many companies switched to server-side tagging. This means they started processing data themselves via their own server. From that server, they can decide for themselves with which third parties this data is shared. Because the server is linked to their own domain, this is seen as First Party Data.

Apple was not happy with this development, and therefore launched the iOS 16.4 update. This update means that placed cookies may henceforth be placed for a maximum of 7 days, including via server-side tagging. The major problem that arose from this Apple update was that returning visitors who took longer than a week to return could no longer be measured. Fortunately, there is also a solution for this problem. We will tell you more about this later in this piece!

Transition from Universal Analytics to Google Analytics 4

Since 1 July 2023, Google Universal Analytics has been a thing of the past, and your website traffic data is now stored in Google Analytics 4 (GA4). The transition from Google Universal Analytics to Google Analytics 4 has been a considerable undertaking.

European Parliament introduces DSA and DMA

The aforementioned developments have therefore ensured that we are now at an important crossroads. We can either bury our heads in the sand by taking no action, or we can start collecting our own data now.

When you opt for the latter, you are doing well. Although we can imagine that you will want to do this in a future-proof way. This is because several developments are also on the horizon in 2024 which we already know we need to respond to.

The most significant development is the announcement from the European Parliament. They have announced that the Digital Service Act (DSA) and Digital Markets Act (DMA) will be introduced in the first or second quarter of 2024.

Specifically, these regulations must ensure greater transparency in online advertising, reduce counterfeiting, improve data protection, and, above all, give the EU more control over the economic power of a few internet giants. This means that online entrepreneurs will henceforth have to collect their own data instead of third parties. Therefore, as an online entrepreneur, you must take control of visitor data yourself.

Where previously you were forced by large companies, such as Apple, to stop working with third-party cookies due to their updates, it will soon also be banned by the European Union. Conclusion: in 2024, we will definitively say goodbye to Third Party Cookies.

Watch presentation again

Watch the full presentation by Bram and Jochem again below.

Privacy-first data-driven marketing

Romar van der Leij is Privacy & Legal Expert at DDMA (Data-Driven Marketing Association). DDMA's aim is to prepare members for all current and future developments in the field of online data and to ensure they make optimal use of the data available to them.

AVG & Privacy

The two main terms that (online) entrepreneurs have to deal with are GDPR and ePrivacy. GDPR primarily concerns the processing of personal data, while ePrivacy concerns the use of cookies and the reading of visitor information.

AVG

With AVG, you are dealing with 7 core principles, with the first two being the most important.

• Lawful, fair and transparent
• Target binding
• Data minimisation
• Accuracy
• Storage limit
• Integrity and confidentiality
• Accountability

To comply with GDPR regulations as an entrepreneur, it is important, first and foremost, to obtain (unambiguous) consent from your visitors for the processing of personal data. This means being clear; you communicate that you process personal data and indicate what you use it for. Subsequently, the visitor must have the free choice to agree to this or not.

The importance of the organisation collecting the personal data must always be balanced against the impact it has on the privacy of the data subject. You should therefore always ask yourself to what extent the data is important to you as an entrepreneur and to what extent you are willing to ‘infringe’ on your visitor's privacy for it. You, as the entrepreneur, make this consideration yourself.

Your purpose limitation must also be clear. This means that as an entrepreneur, you may only collect personal data for a clear and justified purpose. This purpose must always be clearly defined and specified in advance. Furthermore, personal data may only be used for the purpose as described to the data subject. In other words: you are obliged to state concretely for what purpose you are using which data. You are not allowed to use the data for another purpose afterwards.

ePrivacy

While GDPR applies to all forms of personal data processing, ePrivacy specifically focuses on the processing of personal data for electronic communication services. The main rule of ePrivacy is that you must explicitly request consent to store or access user data.

Online, this consent is requested via a cookie banner. Through a cookie banner, website visitors are asked to give consent for the processing of personal data. This consent must always have been given through a free, informed, and unambiguous action.

There is currently no wrong way to set up a cookie banner. This is simply because the regulations for it have not been specifically laid down. When creating a cookie banner, it is good to always ask yourself if you yourself would accept the terms and conditions.

In practice, we see visitors feeling conned when, for example, the ‘accept’ button is much more conspicuous than any other buttons. This is called ‘nudging’, whereby people are 'subtly' encouraged to take a desired action. The application of this is viewed as unethical.

Below, three different cookie banners are shown. In all cookie banners, visitors are given the freedom to accept or reject cookies, and they can also differentiate by cookie type. In two examples, you can see that the accept button stands out clearly. This is therefore not punishable, but you have to ask yourself if your visitors will accept this. The last example is therefore the best choice from an ethical perspective.

Checklist for entrepreneurs

When you as an entrepreneur embark on a particular action, campaign, or engagement with an external party, it is important to follow the steps below. By always asking yourself these questions, you can check whether you are allowed and able to carry out the action.

1. Are personal data involved?

The definition of personal data within the GDPR concerns all information about a person that:

• relates to an identified or identifiable natural person
• is considered identifiable
• relates to a person who can be directly or indirectly identified, in particular by means of an identifier such as;
• a name
• an identification number
• location data
• an online identifier

or of one or more elements characteristic of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

2. What is my role?

Always ask yourself what your role is in the process of processing personal data:

• Controller: This is the party that collects data and links it to specific purposes. This is therefore the website or online shop that wishes to collect user data.
• Processor: This is the party that receives data from the controller to subsequently do something with it. For example, Meta or Google Analytics, which receive data from the entrepreneur via a pixel to subsequently create reports from it.
• Data subject: Person providing data, i.e. the user.

In the old situation, a processor was always jointly responsible for the data obtained. By switching to first-party cookies, that is no longer the case and your company is therefore itself responsible for the data collected from your site visitors.

3. Which basis am I using?

If you have not explicitly received consent from the visitor beforehand, it is important to ask yourself if processing their personal data is truly necessary. How have you communicated this necessity to visitors?

4. How do I inform?

How and about what will you inform the visitors? As an entrepreneur, you have a duty to inform regarding the collection of personal data. You must inform them about the following matters:

• What grounds
• Purpose of processing
• Retention period (and how to determine it)
• Justice interest (which interest exactly?)
• Data Protection Officer Name (if applicable)
• Third party recipients/or categories
• Third countries
• Origin of the data
• Responsible party
• Obligation to provide data by agreement
• Automated decision-making: plus underlying logic
• Right of access and rectification
• Right to object/appeal
• Right to withdraw consent
• To lodge a complaint
• Report extra rights

5. Is there a possibility of appeal?

Is there an opt-out option available? Can visitors choose not to have their data processed at the time it is requested? And can they withdraw their consent at a later date?

6. The Consideration

Weigh up whether the tooling is the right solution for you. For each tooling, determine what you minimally need and create a ‘Tracking Measurement Plan’. Discuss this with your colleagues. A marketer and a legal professional will both look at this in a different way.

How to implement server-side tagging as a marketing agency

Erik Minkels is a marketing expert at Digitale Bazen. As a marketing expert, he has extensive experience with online marketing for various clients. Developments in recent years have had a huge impact, with a major shift having occurred particularly in the last year.

For many online marketers, and therefore for Erik too, Google Analytics is the foundation. In Google Analytics, you gain insight into website traffic. You can see where visitors come from, whether they convert, and where they drop off in their customer journey. Decisions about campaigns and ads are often made based on the reports in Google Analytics.

“Google Analytics is the foundation. You almost blindly assume that the information here is correct.”

Erik has increasingly encountered the problem in recent years that the data in Google Analytics is incomplete. In fact, he even concluded that he only had 70% of the data available. This meant the ‘foundation’ of many of his campaigns disappeared, causing him to increasingly doubt the decisions he needed to make.

Als marketing agency wil hij waarde creëren voor de klant en deze waarde kunnen bewijzen. Doordat hij in een situatie was gekomen, waarin hij beslissingen moest nemen op basis van 70% van de beschikbare data, kon hij er nooit zeker zijn dat zijn beslissingen de juiste zouden zijn. Hij was overgeleverd aan zijn onderbuikgevoel en dat is niet hoe je al marketeer te werk wil gaan. Je meerwaarde als marketing agency vervalt daarmee.

As an online marketing expert, Erik was eager to collect complete data for his clients. To achieve this, he went in search of a solution himself and quickly came to the best solution for his situation: server-side tagging. However, implementing server-side tagging proves to be difficult. Within his organisation, which mainly consists of marketers, the knowledge to get this sorted is lacking.

In his search for a good partner, Erik comes into contact with various parties. The implementation takes up a lot of time for those parties, but the end result remains the same: the result was not 100%.

Eventually, Erik makes contact with the owner of AdPage, Koen van de Wetering. Koen also saw that it is a challenge to be able to measure everything 100%, but he has taken on the challenge. And with success: thanks to some custom solutions, they have now succeeded in restoring the data 100%. This allows Erik to once again trust his reports within Google Analytics.

How to set up server-side tagging

Koen van de Wetering is the founder of AdPage. In 2014, he began developing a landing page tool with his business partner. This tool has since been expanded into a complete builder for landing pages, pop-ups, and personalisation.

Koen has a lot of contact with marketers and has received increasing numbers of questions about campaign measurability in recent years. Together with a team of developers, he spent several months building the solution: AdPage Tagging. AdPage's server-side tagging solution aims to help marketing agencies and web shops achieve the best possible results for their online campaigns.

Now that we know why server-side tagging is needed and what it can achieve, it is of course also important to delve deeper into the actual implementation of server-side tagging.

The gap between Marketer and Developer

Setting up tracking correctly on your website has become quite a challenge. For a good tracking setup, it is essential to configure the DataLayer and the Tag Manager containers properly. To do this well, you need both technical and marketing knowledge.

There are three different ways to forward events and conversions to your server:

• Via a Tag Management System such as Google Tag Manager
• Via Webhooks
• With the GA4 Measurement Protocol

With server-side tagging, you ensure that a web and server container work together in a Tag Management System (in AdPage's case, that's Google Tag Manager). For smooth communication between the two containers so that the collected data can be shared with third parties, the following components are important:

• DataLayer installed on your website with the correct events and parameters
• Google Tag Manager Web Container
• Google Tag Manager Server Container
• Correctly set up channels

The process within a web or server container proceeds via triggers, variables, and tags. You can see the collaboration between triggers and tags as an “if-then construct”. So Also when a visitor takes a specific action, perform dan take action.

• Trigger: The action performed by a visitor on a website that will fire a tag (thus triggering the tag). For example, viewing a product, clicking a button, etc.
• Variables: The information passed within the tag configuration, for example the product name, order value, or visitor's personal details. This information is retrieved from the DataLayer.
• Ensures that the desired information is sent to your server and server container in the form of variables as an event, for example, for Meta or Google Analytics.

Setup with Webcontainer only

The image below shows the setup when you are working solely with the Google Tag Manager Web container, meaning through client-side tagging.

On a website, a DataLayer is present which collects visitor data. Triggers react to this and ensure that tags with associated data are sent to your channels, such as Meta and Google Analytics.

You can compare this process to the process of pixels from the external platforms themselves. Just like with those pixels, visitor data is stored in the browser and sent directly to the relevant platforms.

In server-side tagging, an extra step is added, namely the server container. Unlike the setup above, this ensures that events are not sent directly to external channels, but first to your server.

The triggers in a server container respond to these events and conversions that come in via the web container. In the server container, you then determine which platforms you want to share these events and conversions with. This allows you to process visitor data via your proxy server, and this is no longer done within the visitor's browser.

DataLayer

To set up server-side tagging correctly for your website, it's important to have a well-functioning DataLayer. A DataLayer is a JavaScript object that is used to collect information from your website, and this information is then sent to Google Tag Manager.

Tip! Unsure if you have a DataLayer or if it's set up correctly? Use the Google Chrome Extension ‘DataLayer Checker’. At each stage of your customer journey, you can then see which events are fired in the DataLayer and what user data is linked to those events.

Server-side tagging with webhooks

Combined with server-side tagging, you can also measure data using webhooks. This allows you to include refunds in your analyses, among other things, and analyse the entire multichannel presence of your business.

This can be useful, for example, when you advertise a lot on Facebook. If you know that a certain type of advertisement causes many refunds, you know that that advertisement needs attention to limit these refunds.

A webhook is a push notification that you send directly to the server. With every order, cookie information is forwarded. When someone returns a product, the cookie information is sent along in the webhook. This allows the refund to be matched with the order and the relevant campaign. You can also apply these webhooks in combination with your CRM or point-of-sale system, allowing you to make more use of multichannel marketing.

Watch presentation again

Watch Koen's full session below.

Apple's iOS 16.4 update and how we fixed it

Jeroen Frenken is Lead Developer at AdPage. Despite his youthful appearance, Jeroen has years of experience writing code. Within AdPage, he is responsible for the entire development of AdPage Tagging. He takes care of server maintenance and the continuous optimisation of all features to respond to new and emerging updates. Jeroen is constantly looking for functions and possibilities to make tracking even better for our users.

One of the updates that has improved the privacy of Apple users and made data measurement via server-side tagging more difficult is the iOS 16.4 update.

For server-side tagging, you use CNAME cloaking to forward measured data to your server and store it as first-party data. CNAME cloaking involves linking your server to your domain via your DNS settings. Apple currently performs checks to see if the first 4 digits of the domain's IP address match your server's IP addresses. If this is not the case, Safari will mark the placed cookie as third-party. Consequently, attribution will revert to 7 days.

How did AdPage solve this?

By means of a master cookie. Via plugins or server operations, a master cookie can be placed on a site that replaces marketing cookies. This master cookie checks during every started session whether the master cookie is still present. If this is not the case, that master cookie is immediately placed back from your server.

The ITP is a feature from Apple that they have implemented for their users to ensure their online privacy. Therefore, restoring the master cookie does not contradict a guideline or law. In this way, Apple, Google and other platforms will continue to release new features that make it more difficult to measure visitor data. AdPage is on top of these developments and ensures that a solution is found to keep tracking in order.

GA4 Measurement Protocol

Jody Twijsel is a Google Tag Manager and GA4 specialist. He supports marketing agencies with the implementation of these.

The necessity of server-side tagging is a technical story. Jody explains it perfectly using the example below.

As a consumer, you want to buy Coca-Cola, so you go to your local supermarket. Before you can buy that cola, it has been transported from the distribution centre to the supermarket. Before the cola arrived at the distribution centre, it was transported from the Coca-Cola factory to the distribution centre.

So before you get your hands on your cola, it's already come a long way.

The process of acquiring data is actually the same, whereby:

• the Coca Cola factory will be replaced by your server;
• The distribution centre is being replaced by your browser.;
• The local supermarket is being replaced by storage in Google Analytics.

Last year, the distribution centres were blocked by the farmers' protests. Consequence: the distribution centres could not be supplied nor deliver to the supermarkets. Consequence: empty shelves in the supermarkets.

To ensure full shelves, the supermarket goes directly to the factory. The distribution centre is blocked and skipped in the process.

In this case, the farmers' protest can be compared to new legislation and features that prevent your browser from sending data to Google Analytics any longer. To ensure you still have access to this data, make sure you retrieve the data directly from the server.

The direct retrieval of data from your server to forward to Google Analytics is called the Measurement Protocol.

The Measurement Protocol is a way to send data without standard tracking codes by means of HTTP requests. You can send these HTTP requests from your server, Google Sheets, apps, point-of-sale systems, or other devices.

Unlike server-side tagging, with the Measurement Protocol, you retrieve the data directly from your server to send it straight to Google Analytics.

With server-side tagging, you use a distribution centre to pass on your data (as described in the example). The Measurement Protocol can also be the connection between your hosting server and the server for your first-party data.

To forward data to Google Analytics or your server with first-party data, you make use of a request with an api_secret, after which a payload is sent. The payload is then filled with the data you requested via your requests. The big difference with Universal Analytics is also that an api_secret must now be provided in the request so that not everyone can send data to your Analytics. To generate such a request, you use the Google Event Builder.

Watch presentation again

Watch Jody's full presentation below.

More insight into your data?

Would you like to get started with server-side tagging yourself? Schedule a no-obligation Demo with our tracking specialists. Together, we will look at the current settings and possibilities for improvement.