GDPR-Compliant Conversion Tracking for Lead Generation

Standard browser-side tracking using third-party cookies (the Meta Pixel, the Google tag) is increasingly difficult to make GDPR-compliant, and the difficulty is structural rather than a matter of configuration.

When a pixel runs, an ad platform's script executes inside your visitor's browser, sets a cookie on a domain you do not own, and sends a request to a server you have no relationship with. Three obligations become awkward at once. You have to describe a data flow you cannot inspect. You have to control a processor whose script you did not write and can change without telling you. And you have to explain a transfer to a US-based recipient that, since Schrems II, needs a documented mechanism rather than an assumption.

• You cannot see what is sentA pixel decides for itself what to collect from the page. Answering an access request honestly means describing data flows you have no visibility of.
• The processor chain is longTag manager, pixel, platform, and whatever each of those loads. Every hop is a party you are responsible for naming and are not in a position to audit.
• The transfer is not yours to controlThe request leaves the browser directly for the platform. There is no point in the chain where you get to decide what crosses the border.
• And it does not even workThe same architecture is the one ad blockers, Safari's ITP and iOS restrictions target, which is where the 30 to 40% data loss comes from.

Server-side, first-party tracking removes the third-party cookie chain entirely and puts the data flow under your control. That is the only change that fixes the compliance problem and the accuracy problem with one decision, which is why it is worth doing even for a business that has no European exposure at all.

First-party tracking runs on your own domain, typically a subdomain like track.yourdomain.com, and sets no third-party cookies. The visitor's browser talks only to you. Your side then decides, deliberately, what to forward to each ad platform over its own server-to-server API, with identifiers hashed before they go.

Walking through one conversion makes the difference concrete.

• The click. A visitor arrives from a Meta ad carrying an fbclid. Your own script reads it and sends it to your own collection endpoint, on your own subdomain. No third-party cookie is written and no request leaves for an ad platform.
• The wait. The identifier sits in first-party storage on your side, so Safari's seven-day cap on JavaScript cookies does not apply and an ad blocker has nothing to block.
• The conversion. The visitor submits a form, or a stage changes in your CRM three weeks later. Your server knows it is the same person, because the record is yours.
• The transfer. Your server sends the conversion to Meta over the Conversions API. Email and phone are SHA-256 hashed first, so what crosses the border is a fingerprint rather than a contact detail, and you decide exactly which fields travel.

The compliance value is in step four. There is a single, inspectable, documentable point at which personal data leaves your control, it is under your configuration, and it is covered by one processing agreement rather than an implicit chain. That is a data flow you can put in a privacy policy and defend in a review.

GDPR-compliant tracking still requires consent for marketing-purpose tracking, and this is the point most articles on the subject get wrong. Moving collection to your own server changes where data is processed, not whether the processing needs a legal basis. If you are measuring an individual for advertising purposes, you need their consent, and it does not matter whose server the measurement runs on.

What server-side genuinely changes is the quality of the decision and what happens on either side of it.

• The banner has less to block. With no third-party cookie chain, consent gates one processor you have an agreement with instead of a list of scripts nobody has read.
• A refusal is enforceable at the boundary. When the decision is respected on your own server, refusal means nothing is forwarded, rather than hoping a tag manager honoured a flag.
• Granularity becomes real. Analytics and marketing can genuinely be separated, because you control which downstream transfers each purpose enables.

There is one legitimate nuance worth stating carefully. Aggregate measurement that never identifies an individual and never leaves your control sits on different ground from advertising measurement, and some teams run it under legitimate interest with a documented balancing test. That is a decision for your data protection adviser and your DPIA, not a default. The safe rule for anything that reaches an ad platform is consent, every time.

These circulate confidently enough that they end up in briefs. Each one is worth pushing back on before it becomes an architecture decision.

• "Server-side means you don't need consent"The most expensive myth in the category. The legal basis follows the purpose, not the server. Advertising measurement of an identifiable person needs consent wherever it runs.
• "Hashed data isn't personal data"A hash that lets a platform match a person is still personal data. It is good minimisation practice and it keeps the transfer firmly in scope.
• "EU hosting solves the transfer question"It helps a great deal, and it does not end the analysis. If you forward conversions to a US-based ad platform, that transfer still needs its own documented mechanism.
• "GDPR bans conversion tracking"It does not. It requires a lawful basis, transparency, minimisation and control. All four are achievable, and the first-party server-side architecture is what makes them straightforward.

Nine items, in three groups. Audits usually open with the third group, which is the one most teams have not done.

Technical compliance

• First-party domain. Tracking runs on a subdomain you own, such as track.yourdomain.com, with a certificate you control.
• No third-party cookies set on your visitors' browsers by anything in your tracking stack.
• Hashed identifiers. Email, phone and name SHA-256 hashed, and normalised first (lowercased, trimmed, phone in E.164), before transmission to any ad platform.

Process compliance

• Consent management with granular controls that genuinely separate analytics from marketing, not a single accept button.
• Consent respected at the boundary. Verify it: decline on your own site in a private window and confirm in the platform's event tools that nothing arrived.
• Privacy policy disclosure naming the tracking, the data flows, the processors and the transfer mechanism, in language a visitor could follow.

Documentation

• A signed DPA with your tracking platform, and a current list of its sub-processors.
• A retention policy with automatic deletion timelines that are actually enforced rather than written down.
• A data subject rights flow covering access, deletion and rectification, that reaches the tracking data too and not only the CRM.

If you can produce all nine, the technical setup will not be what an audit turns on. If you cannot produce the last three, the first six will not save you.

LeadJourney runs server-side tracking on your own subdomain, so no third-party cookie is set and the collection point is yours. Identifiers are hashed before they are forwarded to Meta, Google, LinkedIn or Microsoft, and you decide which pipeline stages are sent at all.

Production infrastructure is in Frankfurt, inside the EU. Traffic is served over TLS, and OAuth tokens, two-factor secrets and personal data in the database are encrypted with AES-256-CBC. We keep a current, public list of every sub-processor with access to data on the GDPR page, and a data processing agreement is available. The full control-by-control account, including access control and integration secrets, is on the security page.

Two limits worth stating plainly, because a vendor who states none is not worth trusting on this subject. Tracking respects consent decisions rather than working around them, so a visitor who declines is not measured and your reported numbers will reflect that. And forwarding conversions to a US-based ad platform is still a transfer that needs its own documented basis; we minimise and hash what is sent, and we do not pretend that removes it from scope.

Carry on with Consent Mode v2 for lead generation, server-side tracking without a developer and server-side vs browser tracking. For our own documentation, see the GDPR and data protection page, the security page and the technical and organisational measures.