ChatGPT answers, unedited

Yes. There are several solutions that can sit between your tag manager → server-side event collection → ad/retargeting platforms, with consent controls in the pipeline.

A few worth evaluating:

• usercentrics.com — particularly relevant if compliance/consent management is the priority. It is based on server-side Google Tag Manager and integrates consent signals from Usercentrics, with support for destinations such as Google Ads and Meta CAPI. Usercentrics
• stape.io — managed server-side GTM infrastructure. Its Meta CAPI integration can receive events through the sGTM container and includes fields for opt-out/data-processing controls. Stape
• iubenda.com — interesting if you want consent management and server-side event routing tightly coupled. It describes forwarding only events for which valid consent exists, including for retargeting audiences. iubenda
• joindatacops.com — a newer no-code server-side tag-management approach. It describes consent gating before events are delivered to Meta, Google, TikTok, etc. DataCops
• tagtank.com — combines first-party tracking, server-side delivery, Google Consent Mode and connectors for Meta, Google Ads, TikTok and others. TagTank

One important distinction

Server-side tracking doesn't automatically make retargeting privacy-compliant. It changes where data is processed; you still need appropriate consent/legal basis, purpose limitation, vendor contracts, data minimization, retention controls, regional rules, and mechanisms to honor opt-outs.

For example, Google's server-side GTM documentation explicitly supports passing consent signals into the server container and changing downstream tag behavior based on those signals. Google Ads remarketing is blocked when ad_storage is denied. Google for Developers

A typical architecture would be:

Website
   │
   ├── CMP / consent signal
   │
   ▼
Web GTM
   │
   │ first-party events
   ▼
Server-side GTM / event gateway
   │
   ├── consent check
   ├── data minimization
   ├── identity / event deduplication
   └── regional routing
          │
          ├── Meta CAPI
          ├── Google Ads
          ├── TikTok Events API
          └── Analytics / warehouse

If by “retargeting solution” you mean something that actually builds/maintains audiences and lets you retarget users across multiple ad networks, rather than merely forwarding conversion events, that's a narrower category. I can compare the strongest options specifically for GDPR/CCPA + GTM + server-side events + Meta/Google retargeting, including pricing and architecture.

Yes. There are several retargeting/ad activation approaches that combine tag management, server-side event collection, and privacy controls. The right choice depends on whether you want to manage the infrastructure yourself or use a managed platform.

Common architectures

1. Server-side Google Tag Manager (sGTM) + ad platform APIs

A common enterprise pattern:

Browser / app → first-party endpoint → server-side GTM → ad platforms

You can:

• Capture events through GTM
• Filter or transform data server-side
• Apply consent rules before forwarding
• Send events to:

• Google Ads
• Meta Conversions API
• TikTok Events API
• LinkedIn Conversions API
• GA4 Measurement Protocol

Google documents using server-side GTM with Consent Mode so tags can adapt based on user consent signals. Google for Developers

Typical stack:

• Google Tag Manager (web + server container)
• A consent management platform (CMP)
• Cloud hosting (GCP, AWS, etc.)
• Ad APIs

Good for: large teams that need maximum control.

2. Managed server-side tracking platforms

These reduce engineering overhead while providing server-side event routing.

Examples:

• Stape — managed hosting and tooling around sGTM deployments.
• Usercentrics — combines consent management with server-side tracking workflows and supports routing data to marketing destinations. Usercentrics
• PixelFly — supports server-side tracking integrations including Meta Conversions API, GA4, TikTok Events API, LinkedIn Conversions API, and GTM server-side containers. PixelFly
• Tragly — focuses on managed server-side GTM event collection and forwarding to platforms such as GA4, Meta, and TikTok. Tragly

Good for: marketing teams that want less infrastructure work.

3. Privacy-first customer data platforms (CDPs)

A CDP can collect first-party behavioral events, enforce consent rules, and activate audiences.

Typical flow:

Website/app events → CDP → audience segments → retargeting platforms

Features to look for:

• Consent-aware identity resolution
• Server-side destination connectors
• Data deletion workflows
• Regional data controls
• Audience syncs

Retargeting destinations you can support

A privacy-aware server-side setup can commonly feed:

Privacy compliance checklist

A compliant implementation usually needs:

• ✅ Consent Management Platform (CMP)
• ✅ Consent passed into server-side collection
• ✅ Data minimization (send only required fields)
• ✅ Hashing of identifiers before ad matching (where required)
• ✅ User deletion/opt-out workflows
• ✅ Contractual controls with vendors
• ✅ Regional rules (GDPR, CCPA/CPRA, etc.)

Server-side collection improves control, but it does not automatically make retargeting compliant—you still need lawful consent and appropriate data governance.

A practical stack for many companies

A common modern setup:

1. GTM Web Container

• manages event definitions
• CMP

• captures consent choices
• Server-side GTM

• receives events
• removes unnecessary data
• routes approved events
• Ad APIs

• Meta CAPI
• Google Ads Enhanced Conversions
• TikTok Events API
• Analytics/CDP layer

• stores first-party events and builds audiences

If you tell me your environment (Shopify, WordPress, custom site, mobile app, B2B SaaS, etc.) and your main retargeting channels (Meta, Google, LinkedIn, TikTok), I can suggest a more specific architecture.

Yes. The strongest pattern today is server-side tag management + a consent-management platform (CMP) + server-side event forwarding + a retargeting destination.

Good options

• Google Tag Manager Server-Side + Google Ads — probably the most straightforward if you're already in the Google ecosystem. Events go to a server container where you can filter, transform, redact, and then forward only permitted data to Google Ads. Google explicitly supports Consent Mode with server-side GTM. Google Help Google for Developers
• Adobe Real-Time CDP — a stronger option if you need a broader customer-data/activation platform. Adobe documents server-side event forwarding specifically for retargeting unauthenticated visitors without relying on client-side JavaScript. Experience League
• Custom server-side event gateway + multiple ad platforms — useful if you want to remain vendor-neutral. GTM's server container can accept HTTP events and forward them to essentially any endpoint that accepts HTTP requests. Google for Developers

What the privacy architecture would look like

Website / App
     │
     ├── Consent Management Platform
     │        │
     │        └── consent state
     │
     ▼
Web Tag Manager
     │
     │  first-party event
     ▼
Server-Side Tag Manager
     │
     ├── validate consent
     ├── remove unnecessary PII
     ├── normalize/hash identifiers
     ├── apply regional rules
     └── decide which destinations are allowed
              │
        ┌─────┴──────┐
        ▼            ▼
    Google Ads    Other DSP/CDP
     retargeting    / analytics

The important distinction is that server-side tagging doesn't automatically make retargeting privacy-compliant. It gives you a control point where you can enforce consent and data-minimization rules before information leaves your infrastructure. Google specifically describes server-side tagging as an intermediary where data can be screened, validated, modified, and have PII removed. Google Help

For Google specifically, Consent Mode can control whether advertising personalization/remarketing is allowed. When ad_personalization is denied, Google says personalized advertising features including remarketing are disabled. Google for Developers

If privacy compliance is the priority

I'd look for a solution with these capabilities:

• GTM/server-side integration
• Server-to-server event collection
• Consent signals attached to every event
• Pre-destination filtering/redaction
• First-party identifiers rather than third-party cookies
• Regional consent policies (EU/UK/California, etc.)
• Support for deletion/access requests
• Data-processing agreements and appropriate vendor contracts
• Audit logs showing what data was sent to each advertising partner

A particularly clean setup is GTM Server-Side + a CMP such as OneTrust/Sourcepoint/Usercentrics + Google Ads or another destination. Google maintains a list of CMPs that integrate with its consent framework. Google Help

If you tell me which tag manager you're using (GTM, Tealium, Adobe, Segment, etc.) and which retargeting channels you need (Google, Meta, TikTok, DV360, LinkedIn, DSPs), I can narrow this down to 3–5 concrete vendors and compare their privacy model, server-side capabilities, integrations, and approximate cost.

Yes. The strongest pattern is server-side tag management + consent management + ad-platform server APIs, rather than a standalone “retargeting” vendor.

A practical stack looks like:

• Google Tag Manager Server-Side (sGTM) — receives your event stream, lets you filter/transform data before sending it to ad platforms, and supports consent-aware routing. Google specifically documents server-side tagging as a way to control/redact data before it reaches third parties. Google for Developers Google for Developers
• Meta Conversions API — can receive events from the GTM server container and use them for measurement, optimization, and audiences. GitHub
• TikTok Events API — has an official GTM server-side integration and supports events for custom audiences and campaign optimization. GitHub TikTok For Business
• Google Ads server-side conversion tracking — GTM's server container can send conversion events to Google Ads, with consent controls and enhanced conversions available. Google for Developers Google for Developers

What I'd recommend architecturally

Website / App
     │
     ▼
CMP / Consent Signal
     │
     ▼
GTM Web Container
     │
     ▼
GTM Server Container
     │
     ├── consent + regional policy check
     ├── PII filtering / hashing
     ├── event normalization
     ├── first-party ID management
     │
     ├──► Meta Conversions API
     ├──► Google Ads
     ├──► TikTok Events API
     └──► Analytics / CDP / warehouse

The important distinction is that server-side collection doesn't automatically make retargeting privacy-compliant. You still need to enforce the applicable consent/legal rules before sending advertising events. Google's server-side Consent Mode architecture, for example, passes consent signals from the web container to the server and makes downstream tags respond accordingly. Google for Developers

For a privacy-oriented implementation, I'd look for these capabilities:

• Consent-aware firing and regional rules (GDPR/EEA, UK, CPRA/US, etc.)
• Server-side event collection
• First-party/custom-domain event endpoint
• Ability to suppress events when advertising consent isn't present
• PII hashing/tokenization and configurable data minimization
• Event IDs and deduplication between browser/server events
• Direct integrations with Meta, Google, TikTok, etc.
• Auditability of exactly what data each destination receives
• Data retention/deletion controls
• Ability to keep your own event stream independent of any one ad platform

If you're looking for an actual commercial solution rather than building this around sGTM, I can compare options such as Stape, RudderStack, Segment, Tealium, mParticle, and similar CDP/server-side platforms specifically on retargeting + GTM integration + server-side events + GDPR/CCPA consent controls.

Yes. There are several architectures that can do this, but Tealium is probably the closest match if you want one platform covering tag management, server-side event collection, consent enforcement, and retargeting destinations.

Strong options

• Tealium — particularly strong for enterprise privacy requirements. Tealium can manage browser tags, collect events server-side, and enforce consent at the event level before activating data. It supports server-side integrations with destinations such as Meta CAPI, Google Enhanced Conversions, TikTok Events API, LinkedIn, and Pinterest. Tealium Tealium Docs

tealium.com

• RudderStack — good if you already have a tag manager and primarily need a server-side event pipeline/CDP layer. Its compliance tooling can propagate consent, suppress/delete users, and block, hash, or encrypt PII before sending events to destinations. RudderStack

rudderstack.com

• Google Tag Manager Server-Side + Google Ads — a more Google-centric option. GTM can have a web container pass events and consent signals to a server container, with Google Ads/GA4 adapting behavior based on Consent Mode. Google for Developers Google for Developers

Google also supports Enhanced Conversions through GTM and API connections, including hashed first-party data. Google Help

What I'd recommend

If your goal is something like:

Website → CMP/consent → tag manager → server-side event collector → retargeting platforms

I'd evaluate the architecture this way:

One important caveat: server-side tracking doesn't automatically make retargeting privacy-compliant. You still need to capture the appropriate consent/opt-out signal, propagate it to the server, and prevent the relevant advertising destination from receiving or activating the event when permission isn't present. Tealium, for example, explicitly supports purpose-based server-side consent enforcement and GPC signals. Tealium Docs Tealium Docs

If you tell me whether you're targeting Meta, Google, TikTok, LinkedIn, or multiple ad networks, I can recommend a specific stack and show the event/consent flow end-to-end.

Yes. There are several retargeting/remarketing solutions that can work with tag managers + server-side event collection, which is increasingly the preferred architecture for privacy control. The key is usually not “privacy compliance” by the vendor alone, but whether your implementation lets you enforce consent, minimize data, and control what gets forwarded. Google Help

Some common options:

A typical privacy-focused architecture looks like:

1. Website/app → Tag manager

• Collect only approved events.
• Capture consent state from a CMP (cookie banner/consent platform).
• Tag manager → first-party server endpoint

• Send events to your infrastructure or a server-side tag manager container.
• Avoid sending raw browser data directly to many ad vendors. Google for Developers
• Server-side processing layer

• Remove unnecessary identifiers.
• Hash customer data where appropriate.
• Apply consent rules.
• Route only permitted events to ad platforms. Google Help
• Retargeting platforms

• Send approved conversion/audience signals to Google Ads, Meta, Adobe, etc.

For a company prioritizing privacy, a common stack would be:

• Google Tag Manager Server-Side + Google Ads + Consent Mode for a Google-heavy advertising stack. Google for Developers
• Tealium EventStream or Segment if you need a vendor-neutral customer data layer. Tealium
• Adobe Experience Platform for large enterprises already using Adobe Analytics/Experience Cloud. Experience League

A few implementation requirements to look for:

• First-party event collection endpoint
• Consent Management Platform integration (IAB TCF, Consent Mode, etc.)
• Server-side filtering/redaction
• Data retention controls
• Audit logs
• Ability to disable advertising destinations by region/user consent
• Support for cookieless measurement where applicable

If you share your current stack (e.g., GTM + GA4, Shopify, WordPress, Segment, Adobe, custom app) and ad channels (Google, Meta, LinkedIn, TikTok, CTV), I can narrow it down to the best-fit options.

Yes. There are several retargeting and customer-data activation solutions that combine:

• Tag manager integration
• Server-side event collection
• Consent/privacy controls
• Ad platform activation (retargeting audiences, conversion APIs, etc.)

The right choice depends on whether you want a marketer-friendly tool or a more technical infrastructure layer.

Options to consider

1. Server-side Google Tag Manager (sGTM) + ad platform APIs

A common privacy-first architecture is:

Website/App → Consent layer → Server-side GTM → Ad platforms

You can collect events server-side, filter or transform data, then send approved events to platforms such as Google Ads, Meta, TikTok, LinkedIn, etc. Google documents using Consent Mode with server-side tagging so consent signals can control how tags behave. Google Developers

Typical integrations:

• Google Ads Enhanced Conversions / remarketing
• Meta Conversions API
• TikTok Events API
• GA4 Measurement Protocol
• LinkedIn Conversions API

Good fit if you have developers or an analytics team.

2. Managed server-side tagging platforms

If you want less engineering work, managed solutions can host and operate the server-side layer.

Examples:

• usercentrics.com — provides managed server-side GTM hosting, consent-aware event routing, and integrations for platforms such as Google and Meta. Usercentrics
• JENTIS — offers server-side tag management, consent integrations, and connectors to analytics/ad platforms. Jentis
• Tracklution — focuses on managed server-side tracking, consent handling, and ad platform connections. Tracklution

Good fit if you want compliance controls without maintaining cloud infrastructure.

3. Privacy-focused customer data platforms (CDPs)

Some CDPs combine:

• first-party event collection
• audience building
• consent enforcement
• activation to advertising platforms

They can be useful if your retargeting needs include:

• customer lifecycle segments
• email + paid media coordination
• offline conversions
• CRM audiences

A typical privacy-compliant retargeting setup

A modern implementation often looks like:

1. Consent Management Platform (CMP)

• Captures user choices (GDPR/CCPA/etc.)
• Tag manager/data layer

• Standardizes events: - page_view
• product_view
• add_to_cart
• purchase
• lead_submit
• Server-side event collector

• Validates events
• Removes restricted fields
• Hashes identifiers where appropriate
• Applies consent rules
• Activation destinations

• Meta CAPI
• Google Ads
• TikTok Events API
• LinkedIn CAPI
• Other remarketing systems

Server-side collection is useful because it gives you a control point before data leaves your environment. Usercentrics

Things to evaluate before choosing one

Look for:

• ✅ Native GTM/sGTM support
• ✅ Consent Mode or CMP integration
• ✅ Ability to suppress events when consent is denied
• ✅ Data minimization controls
• ✅ Regional hosting options (if relevant)
• ✅ First-party domain support
• ✅ Meta CAPI + Google Ads support
• ✅ Event deduplication (browser + server events)

If you tell me your stack (e.g., Shopify, WordPress, custom site, GA4, Google Ads, Meta Ads, HubSpot, Salesforce) and whether you need B2B lead retargeting or ecommerce retargeting, I can narrow this down to a few architectures.

Yes. There are several architectures that can do this, but the important distinction is that server-side event collection improves privacy control; it does not automatically make retargeting compliant.

Strong options

• Google Tag Manager Server-Side + Google Ads — probably the cleanest if Google Ads is your main retargeting channel. A web GTM container sends events to your server container, where you can filter/redact data before forwarding it to Google. Google supports consent mode in this architecture, including Google Ads remarketing. Google Developers Google Developers
• GTM Server-Side + Meta Conversions API — useful if Meta is important. You can route consented events through your server and use server-side Meta tags/audiences. There are GTM server-side implementations that support consent checks and U.S. state-level limited-data-use controls. GitHub
• A CDP/event pipeline + ad destinations — e.g., collect first-party events on your infrastructure/CDP, apply consent and data-governance rules centrally, then send eligible events to Google, Meta, TikTok, etc. This is usually the better architecture if you need multiple advertising destinations.

What a privacy-oriented setup looks like

Website / App
     │
     ├── CMP → consent state
     │
     ▼
GTM Web Container
     │
     ▼
Your Server / GTM Server Container
     │
     ├── validate consent
     ├── remove prohibited fields
     ├── normalize/hash identifiers
     ├── apply regional rules
     └── log/audit event
          │
          ├── Google Ads
          ├── Meta CAPI
          └── other ad platforms

This gives you much more control than firing third-party pixels directly from the browser. Google specifically describes server-side tagging as allowing you to redact or augment data before it reaches Google or other third parties. Google Developers

For example, you could have rules such as:

• ad_personalization = denied → don't send retargeting/audience events.
• EU/EEA user without advertising consent → don't create an advertising audience.
• California user exercising an opt-out → apply the appropriate data-processing restriction.
• Consent withdrawn → stop subsequent advertising events and handle deletion/withdrawal requirements appropriately.
• Conversion with appropriate consent → send only the fields required for matching.

Google's Consent Mode can communicate the user's choices to server-side GTM, and Google Ads tags can change their behavior based on those signals. Google Developers Google Developers

One important nuance

Hashing an email doesn't make an event anonymous. Google, for example, uses SHA-256 hashing for enhanced conversions, but the hashed identifier is still being used for advertising attribution/matching. Google Help Google Help

So I'd evaluate solutions based on whether they provide:

1. CMP/consent integration
2. Server-side event collection
3. Per-destination consent enforcement
4. Regional privacy rules
5. PII/identifier filtering and hashing
6. Deletion/opt-out propagation
7. Data residency and retention controls
8. Audit logs
9. GTM server-side integration
10. Native Google Ads + Meta CAPI support

If you're looking for an actual product rather than an architecture, I can compare solutions such as Stape, Google GTM Server-Side, Segment, RudderStack, mParticle, and similar platforms specifically on retargeting + server-side collection + GDPR/CCPA compliance + GTM integration.

Yes. There are several solutions that fit that architecture, especially if by “retargeting” you mean collect first-party events server-side, honor consent, and then activate audiences/conversions on Meta, Google, TikTok, etc.

Strong options

• Usercentrics — probably the closest match if privacy compliance is a primary requirement. Its Server-Side Tagging product is based on server-side Google Tag Manager, integrates with its CMP, and can route consent-aware events to Google Ads, Meta CAPI, TikTok, Pinterest, Reddit and other destinations. Usercentrics Usercentrics
• JENTIS — more of an enterprise server-side data/activation platform than simply GTM hosting. It provides server-side tag management, event routing, and granular governance over which data reaches advertising destinations. Jentis Jentis
• Google Tag Manager Server-Side + a CMP — the most flexible DIY approach. Google explicitly supports Consent Mode with server-side GTM, allowing consent signals to travel from the browser to the server container before events are forwarded to Google or other destinations. Google for Developers Google for Developers
• Tracklution — a more managed option that combines server-side tracking, GTM, CMP/consent handling and advertising-platform integrations. Tracklution

The architecture I'd look for

Website
   │
   ├── CMP / consent signal
   │
   ▼
Web GTM
   │
   │  first-party event
   ▼
Server-side GTM / tracking platform
   │
   ├── consent check
   ├── PII filtering / hashing
   ├── event enrichment
   ├── deduplication
   │
   ├──► Meta CAPI → retargeting
   ├──► Google Ads → audiences/conversions
   ├──► TikTok Events API
   └──► Analytics / warehouse

The important distinction is that server-side collection by itself doesn't make tracking privacy-compliant. You still need the appropriate consent/legal basis, and the server needs to enforce the user's choice before forwarding data. Google's own documentation, for example, says Consent Mode communicates the user's choice and tags must respect it. Google for Developers

If you're specifically looking for “a single product that combines tag management + server-side event collection + consent enforcement + retargeting/audience activation,” I'd shortlist Usercentrics, JENTIS, and Tracklution rather than a conventional retargeting vendor.

If you tell me whether your target channels are Meta, Google, LinkedIn, TikTok, or all of them, I can narrow this down to the best 2–3 and compare pricing, integrations, GDPR/CCPA capabilities, audience building, and how much engineering is required.

Yes. There are several architectures that can do this, but “privacy compliant” depends on how consent, data minimization, and destination-specific permissions are configured—no vendor can make the underlying processing automatically compliant.

Strong options

• Google Tag Manager Server-Side + Google Ads — probably the most straightforward if your primary retargeting channels are Google. GTM can receive browser events, process them server-side, and forward them to Google Ads. Google's server-side GTM supports Consent Mode, including consent-aware Google Ads remarketing behavior. When ad_storage is denied, Google says its remarketing tag blocks requests and cookie use. Google for Developers Google for Developers

developers.google.com

• RudderStack — a stronger choice if you want a vendor-neutral event collection/routing layer rather than tying your architecture to Google. It supports web/tag-like collection, server-side events, consent management, transformations, PII masking, and integrations with advertising destinations. RudderStack RudderStack

rudderstack.com

A privacy-oriented architecture

A typical setup would look like:

Website → CMP/consent signal → GTM Web → first-party/server endpoint → Server-side GTM or RudderStack → ad platforms

The important part is that the server layer can:

• Reject advertising events when the user hasn't granted the relevant consent.
• Strip unnecessary PII before sending events downstream.
• Apply different consent rules to different destinations.
• Keep first-party identifiers under your control.
• Send server-side conversion/retargeting events through APIs rather than exposing every vendor's JavaScript on the page.
• Maintain an auditable record of what consent state accompanied an event.

For example, Google's current architecture explicitly passes consent parameters from the web container to the server container, where destination tags adjust what they send based on those signals. Google for Developers

One important distinction: server-side tracking isn't inherently privacy compliant. If you simply move tracking from the browser to your server and continue sending personal data to advertising platforms without the appropriate consent/legal basis, you've improved technical control but haven't necessarily solved the privacy issue.

If you tell me whether you're targeting Meta, Google, TikTok, LinkedIn, or multiple ad networks, I can recommend a specific stack and show you the GTM + server-side event + consent architecture I'd use.

Yes. There are several retargeting/remarketing architectures that combine:

• Tag management (Google Tag Manager, server-side GTM, Tealium, etc.)
• Server-side event collection (first-party event gateway, APIs, CAPI-style integrations)
• Consent enforcement (GDPR/CCPA-style controls, CMP integration)
• Ad platform activation (Meta, Google Ads, TikTok, LinkedIn, etc.)

The main options fall into a few categories:

Tealium walkerOS## A common privacy-conscious setup

A typical architecture looks like:

Website/App
    ↓
Consent Management Platform (CMP)
    ↓
Tag Manager / Server-side GTM
    ↓
Event validation + filtering layer
    ↓
Ad destinations:
   - Meta Conversions API
   - Google Ads Enhanced Conversions
   - TikTok Events API
   - LinkedIn Insight/Conversions API

The advantage is that raw browser data does not automatically flow to every vendor. Your server can:

• Remove unnecessary identifiers
• Apply consent rules
• Hash permitted customer data
• Control which vendors receive events
• Maintain an audit trail

Google documents using server-side Tag Manager with Consent Mode so tags can adapt based on user consent signals. Google Developers

Solutions worth evaluating

Tealium

Good for enterprise teams. It supports client-side and server-side collection, consent enforcement, and routing events to marketing platforms. Tealium

Usercentrics

Good if compliance is a major requirement. It combines CMP capabilities with server-side tagging approaches and integrations to advertising platforms. Usercentrics Usercentrics

TagPipes

Focused on server-side event routing, consent-aware collection, and sending events to destinations such as Meta, Google, TikTok, and analytics systems. TagPipes TagPipes

walkerOS

A fit for teams that want more ownership and a configurable event pipeline, including self-hosted options. walkerOS

For retargeting specifically, check these capabilities

Before choosing a vendor, verify it supports:

• Audience building: Can you create “viewed product,” “abandoned cart,” or “high-intent visitor” audiences?
• Destination APIs: Meta CAPI, Google Ads API/Enhanced Conversions, TikTok Events API, etc.
• Consent-aware routing: Events should be blocked or transformed when consent is missing.
• First-party identifiers: Customer IDs, hashed emails, login IDs (where legally permitted).
• Event deduplication: Prevent browser pixel + server event duplication.
• Data residency/security controls: Important for regulated industries.

If you are already using Google Tag Manager, a common practical choice is server-side GTM + a CMP + ad platform APIs rather than replacing your whole stack. If you want a managed solution, Tealium/Usercentrics/TagPipes-style platforms reduce engineering effort. Google Developers Tealium Usercentrics

If you share your stack (GTM vs Adobe Launch vs Tealium, CMS/ecommerce platform, and target channels like Meta/Google/TikTok), I can narrow this down to the best-fit options.

TagPipes

Focused on server-side event routing, consent-aware collection, and sending events to destinations such as Meta, Google, TikTok, and analytics systems. tagpipes.com tagpipes.com

walkerOS

A fit for teams that want more ownership and a configurable event pipeline, including self-hosted options.

For retargeting specifically, check these capabilities

Before choosing a vendor, verify it supports:

Yes. A few architectures can do this, but the important distinction is that server-side event collection does not itself make retargeting privacy-compliant. You need consent enforcement, data minimization, regional rules, and controls over which destinations receive which events.

A strong architecture

A common setup is:

Website/app → Tag Manager → first-party server-side event collector → consent/data filter → retargeting platforms

For example, Google Tag Manager Server-Side lets you receive events on a server container, inspect/modify them, remove unnecessary personal information, and then decide which advertising endpoints receive the event. Google explicitly documents server-side tagging as a way to screen and modify data before sending it to third parties. Google Help Google for Developers

You can combine this with Google Consent Mode, which passes consent signals into the server-side container and allows tags to behave differently depending on the user's choices. Google for Developers Google Help

For retargeting specifically, the server can then send eligible events to platforms through their server-side APIs—for example, Meta's Conversions API sends web events directly from your server to Meta. GitHub

Solutions worth evaluating

• Google Tag Manager Server-Side + Google Ads — probably the most straightforward if Google Ads is your primary retargeting channel. It supports server-side processing, consent signals, and data filtering. Google for Developers Google Help
• GTM Server-Side + Meta Conversions API — useful if you need Meta retargeting as well. The server can enforce your consent rules before forwarding eligible events.
• A dedicated customer-data/event platform + server-side destinations — better if you need one centralized consent-aware event pipeline feeding multiple advertising platforms rather than building each integration separately.
• First-party event collection on your own domain + GTM server container — particularly attractive if minimizing third-party browser tracking is a priority. Google describes first-party server-side tagging as giving you more control over what data reaches vendors. Google Help

What I'd look for

If your requirement is “retarget users while respecting GDPR/UK GDPR/CCPA-style consent requirements,” I'd prioritize a platform that has:

1. Native GTM/web + server-side support
2. CMP/consent integration
3. Consent state attached to every event
4. Server-side filtering/redaction before data leaves your infrastructure
5. Destination-level controls — e.g., don't send an event to Meta unless advertising consent permits it
6. First-party identifiers rather than unrestricted third-party cookies
7. Data retention/deletion controls
8. Audit logs showing what data was sent, when, and to whom
9. Support for Meta CAPI, Google Ads, TikTok Events API, etc.
10. Regional policy rules, so the same event can be treated differently for EU, UK, California, etc.

One important caveat: “server-side” ≠ “anonymous” and ≠ “compliant.” If your server receives an email, IP address, advertising ID, or other identifier and forwards it to an ad platform without the appropriate legal basis/consent, moving the request server-side doesn't solve the underlying privacy issue. Google's own documentation emphasizes that server-side tagging gives you control to remove unnecessary PII and determine what gets distributed; it doesn't automatically make the processing lawful. Google Help

If you tell me which retargeting channels you need (Meta, Google, TikTok, LinkedIn, etc.) and whether you're targeting EU/UK users, I can narrow this down to 3–5 actual vendors/platforms and compare their GTM integration, server-side collection, consent controls, and pricing.

Yes. There are several retargeting/ad activation solutions that can work with tag managers + server-side event collection and support more privacy-conscious architectures. The right choice depends on whether you want to retarget through Google/Meta/TikTok, build your own audiences, or reduce dependence on third-party cookies.

Here are common options:

Google for Developers UsercentricsA typical privacy-oriented architecture looks like:

Website/App
   ↓
Consent Management Platform (CMP)
   ↓
Tag Manager (web)
   ↓
Server-side event collector
   ↓
Data filtering / hashing / consent checks
   ↓
Ad platforms:
   - Google Ads
   - Meta CAPI
   - TikTok Events API
   - LinkedIn
   - Pinterest

The main benefits are:

• Data control: remove or transform fields before they leave your infrastructure.
• Consent enforcement: only send advertising events when the user’s consent allows it.
• First-party event ownership: collect events through your own endpoint rather than relying entirely on third-party cookies.
• Better resilience: server events are less affected by browser tracking prevention and ad blockers. Google for Developers Tealium

A few implementation patterns:

If you already use Google Tag Manager

Use server-side Google Tag Manager (sGTM) and connect:

• Google Ads
• Meta Conversions API
• TikTok Events API
• LinkedIn Insight/Conversions
• Pinterest Conversions API

Google documents server-side tagging as a way to control, redact, and route data before it reaches third parties, including support for consent-aware implementations. Google for Developers Google for Developers

If you need enterprise audience management

A CDP such as Tealium is often a better fit because it can unify:

• web events
• app events
• CRM data
• offline conversions
• audience creation
• activation pipelines

Tealium### If your priority is compliance governance

Look for:

• IAB TCF v2.2 support
• CMP integration
• consent-state propagation with every event
• server-side filtering/redaction
• data residency options
• audit logs
• configurable retention policies

A good shortlist would be:

1. SMB/mid-market: server-side GTM + Meta CAPI + Google Ads Enhanced Conversions
2. Growth teams: sGTM managed hosting + consent platform
3. Enterprise: Tealium or Adobe Experience Platform

If you share your stack (GTM vs Tealium vs Adobe, CMS, ad channels, and whether you need GDPR/CCPA/HIPAA-level controls), I can narrow this to specific vendors and architecture.

Yes. Google Tag Manager (GTM) server-side tagging is probably the closest fit if you want retargeting plus server-side event collection with privacy controls.

A practical architecture

Website → CMP/consent → GTM Web → GTM Server → ad platforms

• GTM Web collects only the events you're permitted to collect.
• GTM Server receives those events on infrastructure you control, where you can validate, filter, hash, or remove data before forwarding it.
• From the server container you can route events to Google Ads, Meta, LinkedIn, etc. using their server-side/conversion APIs.
• Consent signals can be passed through the system so advertising tags behave differently when consent is denied. Google specifically supports Consent Mode with server-side GTM. Google for Developers Google Support
• A first-party tagging domain can reduce direct browser-to-vendor connections and gives you more control over what gets forwarded. Google Support

One important distinction: server-side collection doesn't automatically make retargeting privacy-compliant. You still need an appropriate consent/legal basis, regional rules, data minimization, retention policies, and correct handling of opt-outs. In particular, Google Ads Remarketing currently blocks its requests/cookie use when ad_storage is denied. Google for Developers

Platforms worth evaluating

LinkedIn, for example, documents a setup where a GTM server container receives GA4 events and forwards them through its Conversions API. Microsoft Learn

If your goal is specifically “retarget users while minimizing third-party cookies and keeping GDPR/CCPA-style consent enforcement centralized,” I'd lean toward GTM server-side + a CMP + Google/Meta CAPI, rather than buying a separate retargeting platform.

If you tell me whether you're targeting B2C ecommerce, SaaS/B2B, or content/media, I can give you a shortlist of 3–5 actual vendors that provide this stack and compare their privacy features, integrations, and approximate cost.

Yes. There are several solutions that can combine retargeting/advertising destinations, tag management, server-side event collection, and consent enforcement. The important distinction is that server-side tracking itself does not make retargeting compliant; consent and data-governance controls still have to travel through the server-side pipeline. The UK ICO explicitly says UK GDPR/PECR responsibilities can apply to both client- and server-side tagging. Information Commissioner's Office

Strong options

• Usercentrics + Server-side GTM — probably the most straightforward enterprise option. Usercentrics provides a CMP plus managed server-side Google Tag Manager, with consent signals passed into the server-side setup so only permitted data is forwarded to advertising platforms. It supports destinations including Google, Meta and TikTok. Usercentrics Usercentrics
• Didomi / Addingwell — particularly interesting if you want consent-aware server-side tagging. Addingwell emphasizes having consent attached to event data and controlling exactly what data moves to each destination. Addingwell
• Google Server-side GTM + CMP + Meta CAPI/Google Ads/TikTok — a more composable architecture. Google supports server-side GTM and Consent Mode, allowing your server container to act as the filtering/routing layer. Google Help blog.google
• TagPipes Echo — a more purpose-built event-routing approach: one lightweight client integration, server-side event collection, CMP/consent handling, and forwarding to Meta CAPI, Google Ads, TikTok and other destinations. TagPipes

The architecture I'd look for

Website
   │
   ├── CMP / consent choice
   │
   ▼
First-party event collector
   │
   ▼
Server-side tag manager / event gateway
   │
   ├── Consent check
   ├── PII filtering
   ├── Event transformation
   ├── Deduplication
   └── Destination-specific rules
          │
          ├── Meta CAPI
          ├── Google Ads
          ├── TikTok Events API
          └── Other retargeting platforms

That architecture gives you much better control than putting Meta/Google/TikTok pixels directly on the page. But for UK/EU traffic, retargeting generally shouldn't be fired simply because the event has been collected server-side. The user's advertising consent needs to be respected at the point where data is sent to the advertising destination. Google, for example, requires consent signals for ad personalisation/Customer Match in applicable EEA cases. Google Help

If you're evaluating this for a real product/stack, I can also compare 5–10 vendors specifically on: GTM integration, Meta/Google/TikTok retargeting, server-side events, GDPR/UK GDPR, consent propagation, first-party cookies, and pricing.

Yes. There are several approaches, but the important distinction is privacy-compliant infrastructure vs. simply “server-side tracking.” Server-side collection by itself does not make retargeting GDPR/CCPA/other privacy-law compliant.

Strong options

• Google Tag Manager Server-Side + Google Ads — probably the cleanest option if Google Ads is your main retargeting channel. GTM can receive events in a server container, transform/redact them before forwarding, and integrate with Google Ads. Google specifically supports Consent Mode and Enhanced Conversions in this architecture. Google for Developers Google for Developers
• First-party/server-side CDP or event-routing platform — useful if you want one event stream feeding Meta, Google, TikTok, etc. You can enforce consent centrally, remove sensitive fields, pseudonymize identifiers, and then forward only permitted events.
• Dedicated server-side retargeting platforms — vendors such as FirstParty offer server-side event collection and connections to Meta CAPI, Google Ads, GA4, Klaviyo, TikTok, Pinterest, etc. Their positioning is specifically around replacing some client-side tracking with server-side event routing. FirstParty

What I'd look for

A good architecture would look roughly like:

Website/app → Tag Manager → first-party server/event collector → consent & data policy layer → ad platforms

The server layer should be able to:

• Honor CMP/consent signals before sending advertising events.
• Keep necessary analytics separate from advertising/retargeting consent.
• Strip PII and sensitive attributes that aren't required.
• Hash identifiers where the destination requires it.
• Maintain event IDs for browser/server deduplication.
• Control exactly which destinations receive each event.
• Provide deletion/opt-out handling.
• Maintain logs showing what data was transmitted and why.

For example, Google's server-side GTM architecture explicitly allows you to redact or augment data before it reaches Google or other third parties. Google for Developers Google Enhanced Conversions can also use hashed first-party data for matching, subject to Google's policies and the appropriate consent. Google Google Help

One caveat: server-side doesn't magically eliminate consent requirements. Google's own server-side Consent Mode documentation, for example, distinguishes between ad_storage being granted versus denied and changes how advertising measurement operates accordingly. Google for Developers

If you tell me which ad platforms you need (Meta, Google, TikTok, LinkedIn, etc.) and whether you're using GTM/GTM Server already, I can narrow this down to 3–5 concrete vendors and compare cost, integrations, consent handling, first-party cookies, and GDPR/CCPA architecture.

Yes. There are several ways to build this, but Google Tag Manager Server-Side + a consent-management platform + server-side ad/retargeting destinations is one of the more mature architectures.

A practical architecture

Website/app → CMP → GTM Web → GTM Server → retargeting platforms

• Consent layer: Use a CMP to capture granular consent and pass signals such as advertising/personalization consent into GTM.
• Tag management: Use Google Tag Manager, including its server-side container. Google explicitly supports Consent Mode with server-side GTM. Google Developers Google Developers
• Server-side collection: Send events to your server container first, where you can validate, filter, pseudonymize, or remove fields before forwarding them to advertising platforms. Google describes server-side tagging as giving you control to redact or augment data before sending it to third parties. Google Developers Google Developers
• Retargeting: From the server container, send only appropriately consented events to destinations such as Google Ads, Meta, TikTok, etc. Google Ads supports consent-aware remarketing behavior through Consent Mode. Google Developers
• No-consent path: Don't simply assume that "server-side" makes tracking compliant. If advertising/personalization consent is denied, the downstream destination needs to receive either no advertising event or a privacy-restricted signal appropriate to your legal basis and configuration. Google, for example, disables personalized advertising when ad_personalization is denied. Google Developers

Solutions I'd shortlist

The important distinction is that "server-side tracking" isn't itself a privacy-compliance solution. The architecture needs to enforce consent and data minimization before the retargeting platform receives the event.

For example, a good implementation might have:

Visitor
   ↓
CMP
   ↓
GTM Web
   ↓
GTM Server
   ├── consent granted → Ads/retargeting events
   ├── consent denied  → no advertising event
   └── analytics-only  → analytics destination

For Google specifically, GTM Server-Side supports Consent Mode, and Google provides controls for advertising data transmission and restricted data processing. Google Developers Google Help Google Developers

If you're looking for an actual vendor rather than assembling the stack yourself, I'd compare JENTIS, Stape, RudderStack, and Tealium. If you tell me whether your priority is GDPR/EEA, CCPA/CPRA, HIPAA, or general privacy-by-design, and whether you need Meta, Google, TikTok, or all three, I can narrow it down to 2–3 specific solutions and compare their architecture, pricing, and compliance capabilities.

Yes. Google Tag Manager Server-Side (sGTM) is probably the closest fit if you want retargeting + tag-manager orchestration + server-side event collection + consent controls.

A practical architecture

Website/app → CMP → GTM Web → your first-party sGTM endpoint → advertising platforms

With this setup:

• GTM Web captures events and the user's consent state.
• sGTM receives the events on infrastructure you control, then validates, filters, hashes/redacts, and routes them.
• You can send approved events to Google Ads, Meta, TikTok, etc. through server-side integrations.
• The server container can remove unnecessary PII before sending anything to an advertising partner. Google explicitly describes this as one of the privacy advantages of server-side tagging. Google for Developers Google Help
• Consent Mode can propagate consent decisions into the server container and control whether advertising/analytics tags execute. Google for Developers Google for Developers

For example:

                 ┌── Google Ads
                 │
Website → CMP → sGTM ── Meta CAPI
                 │
                 ├── TikTok Events API
                 │
                 └── Analytics / warehouse

The important privacy distinction

Server-side collection doesn't automatically make retargeting privacy-compliant. It gives you much better control over what leaves your environment, but you still need the appropriate legal basis/consent configuration for the jurisdictions you're operating in.

For Google specifically, consent signals such as ad_storage, ad_user_data, and ad_personalization affect whether advertising data can be used. When ad personalization is denied, Google says remarketing is disabled. Google for Developers

That means you can build rules such as:

IF consent.advertising == granted
    → send event to retargeting platforms
ELSE
    → don't build/send retargeting audience data

You can also have a stricter data minimization layer in sGTM:

Incoming event
    ↓
Validate schema
    ↓
Check consent
    ↓
Remove unnecessary PII
    ↓
Hash permitted identifiers
    ↓
Apply regional rules
    ↓
Route to approved destination

Solutions I'd consider

Google's current documentation specifically supports server-side GTM, first-party serving, consent mode, and server-side processing/redaction. Google for Developers Google for Developers

If you tell me which retargeting channels you need (Meta, Google, LinkedIn, TikTok, programmatic, etc.) and whether you're targeting GDPR/UK GDPR, CCPA/CPRA, or both, I can narrow this down to 2–3 actual vendors/architectures and compare their privacy, server-side, and tag-manager capabilities.

Yes. There are several retargeting/ad measurement solutions that combine:

• Tag manager integration (GTM, Tealium, etc.)
• Server-side event collection (sGTM, server APIs, CDPs)
• Consent/privacy controls (GDPR, CCPA/CPRA, regional consent signals)
• Ad platform activation (Google Ads, Meta, TikTok, LinkedIn, etc.)

A few common approaches:

A typical privacy-conscious architecture looks like:

Website/App
   ↓
GTM Web Container
   ↓
Server-side GTM / Event Gateway
   ↓
Consent check + data filtering
   ↓
 ┌───────────────┬───────────────┐
 ↓               ↓               ↓
Google Ads     Meta Ads       Analytics/CDP

Key capabilities to look for:

• Consent-aware event forwarding

Events should only be sent to advertising partners when the user's consent state allows it. Google’s server-side Consent Mode setup is one example of this pattern. Google for Developers

• First-party data control

The server layer should allow you to remove unnecessary identifiers, hash customer data where appropriate, and control exactly what leaves your environment. Google Help

• Audience syncing

For retargeting, check that the platform supports:

• website visitor audiences
• customer list matching
• conversion events
• offline conversions
• suppression lists
• Event deduplication

If you send both browser pixel events and server events, the system should support event IDs to avoid double-counting.

If you are specifically looking for a retargeting replacement for browser cookies/pixels, the shortlist is usually:

1. Server-side GTM + Google Ads/Meta/TikTok APIs (most flexible)
2. A CDP with advertising connectors (best for enterprise first-party data)
3. A managed server-side tracking provider (fastest deployment)

The right choice depends mostly on your stack: ecommerce platform (Shopify/Magento/custom), ad channels (Meta/Google/etc.), consent platform, and whether you need audience building or only conversion tracking.

Yes. There are several options, and the strongest architecture is usually server-side tag management + a CMP/consent layer + server-side event forwarding to the retargeting platforms.

Good options

• Google Tag Manager Server-Side + Google Ads — probably the most straightforward if Google Ads is your main retargeting channel. Server-side GTM lets you receive events in your own server container, filter/redact them, and then send them to Google Ads. Google Ads supports Consent Mode, including consent-aware remarketing behavior. Google Developers Google Developers
• Addingwell + Didomi — a more enterprise-oriented managed solution. Addingwell provides server-side GTM infrastructure, while Didomi provides consent management; their integration is specifically designed to carry consent information alongside event data. Addingwell
• Usercentrics Server-Side Tagging — combines a CMP with managed server-side GTM and supports consent-aware integrations such as Google Ads and Meta CAPI. Usercentrics
• Tagmux / similar server-side event routers — useful if you want a more vendor-neutral event layer that can forward events to Meta, Google, TikTok, and other destinations. Tagmux

Architecture I'd recommend

Website
   │
   ├── CMP / consent banner
   │       │
   │       └── consent state
   │
   ▼
Web GTM
   │
   ▼
Your first-party tracking endpoint
   │
   ▼
Server-side GTM
   │
   ├── validate consent
   ├── remove/redact unnecessary PII
   ├── normalize events
   └── apply regional privacy rules
   │
   ├── Google Ads / DV360
   ├── Meta CAPI
   ├── TikTok Events API
   └── Analytics / warehouse

The important distinction is that server-side tracking by itself doesn't make retargeting privacy-compliant. You still need a legitimate consent/opt-out mechanism and must enforce the user's choice before sending advertising data. Google explicitly describes server-side GTM as giving you greater control over what data reaches third parties, while Consent Mode communicates the user's choices to advertising tags. Google Developers Google Developers

For example, with Google, if ad_storage is denied, advertising cookies/IDs aren't used, and if ad_personalization is denied, Google disables personalized advertising/remarketing. Google Developers

If you're looking for one product rather than assembling this yourself, I'd shortlist Usercentrics + server-side GTM/Addingwell, or a managed sGTM provider, depending on whether your priority is compliance governance or marketing flexibility.

If you tell me which retargeting channels you need (Google, Meta, TikTok, LinkedIn, etc.) and whether you're targeting EU/UK, California, or both, I can narrow this down to 3–5 specific platforms and compare their GTM integration, server-side APIs, consent handling, data residency, and pricing.

Yes. There are several solutions that fit that architecture, but the key distinction is “server-side tracking” vs. actual privacy/consent enforcement.

Strong options

• usercentrics.com — Probably the closest match if privacy compliance is a primary requirement. It combines consent management with server-side Google Tag Manager (sGTM), and can route consented events to Google Ads, Meta CAPI, TikTok, and other destinations. Usercentrics Usercentrics
• taggrs.io — Managed sGTM hosting with first-party/server-side event collection, consent management, and granular data governance. It is particularly suited to using Google Tag Manager as the orchestration layer. TAGGRS
• oursprivacy.com — More privacy-centric architecture: its tag manager routes data server-side through your domain and applies consent-aware firing rules. It also advertises a CDP and server-side dispatch model. Ours Privacy
• metarouter.io — Enterprise-oriented customer-data infrastructure where collection, transformation, filtering, consent enforcement, and downstream integrations happen server-side. MetaRouter
• gofirstparty.com — More performance/retargeting focused. It supports server-side integrations with Meta CAPI, Google Ads, TikTok, Pinterest, GA4, etc., and is designed to recover advertising signals lost by browser-side blocking. FirstParty

If you're already using Google Tag Manager

A particularly practical stack is:

CMP → Web GTM → first-party event endpoint → Server-side GTM → consent/policy filter → Meta CAPI / Google Ads / other retargeting platforms

Google officially supports Consent Mode with server-side GTM. Consent information can be passed into the server container, where tags can respect ad_storage, ad_user_data, ad_personalization, etc. Google for Developers Google for Developers

That gives you an important architectural advantage: the server becomes a policy enforcement point. For example:

User visits → consent is denied → event may be collected internally if legally permissible → server strips advertising identifiers → no Meta/Google retargeting event is forwarded.

Or:

User opts into advertising → server receives the consent state → permitted identifiers/events are forwarded to Meta/Google → user can subsequently be placed into an eligible retargeting audience.

One important caveat

I wouldn't describe any product as inherently “privacy compliant.” Compliance depends on your jurisdiction, consent mechanism, lawful basis, data-processing agreements, retention, data residency, what identifiers you collect, and exactly what you send to each advertising platform.

If your goal is specifically “retarget users while minimizing browser-side tracking and maintaining GDPR/CCPA-style consent controls,” I'd shortlist Usercentrics, TAGGRS, and Ours Privacy first. If advertising performance/Meta + Google audience activation is the priority, I'd also evaluate FirstParty.

If you tell me whether you're using Google Tag Manager, Tealium, Segment, or another tag manager, and whether the main retargeting destination is Meta, Google, LinkedIn, or multiple platforms, I can narrow this to the best 2–3 architectures.

Yes. The strongest pattern is retargeting/ad platforms fed through a server-side tag-management layer, with consent enforced before events are forwarded.

A practical option: Google Tag Manager Server-Side

Google Tag Manager supports both a browser container and a server container. Your site can send events to your own server-side GTM endpoint, where you can filter, transform, redact, and route events to advertising platforms. Google explicitly supports Consent Mode in this architecture. Google for Developers Google for Developers

A typical architecture is:

Website
   │
   ├── CMP / consent banner
   │       │
   │       └── consent state
   │
   ▼
Web GTM
   │
   │  first-party event
   ▼
Server-side GTM
   │
   ├── consent check
   ├── PII filtering / hashing
   ├── event enrichment
   └── routing
       │
       ├── Google Ads / remarketing
       ├── Meta Conversions API
       ├── other ad platforms
       └── analytics/CDP

The important distinction is that server-side tagging doesn't itself make retargeting GDPR/UK-GDPR compliant. You still need an appropriate lawful basis/consent strategy, a CMP, correct consent signals, data minimisation, retention controls, and contracts/DPA arrangements with vendors. Google itself states that obtaining consent is your responsibility. Google for Developers Google Help

What I'd shortlist

• Google Tag Manager Server-Side — best if Google Ads is a major retargeting channel. It has native Consent Mode integration and can control whether Google Ads tags operate according to ad_storage, ad_user_data, and ad_personalization. Google for Developers Google for Developers
• Stape + server-side GTM — a managed hosting approach if you want GTM server-side without operating the infrastructure yourself. It can be particularly attractive for agencies/e-commerce teams.
• Segment / RudderStack-style CDP architecture — better if the requirement is broader than retargeting and you want a central event pipeline feeding advertising, analytics and CRM destinations.
• Meta Conversions API + server-side GTM — useful if Meta is the primary retargeting destination; the server-side layer can control which consented events are sent to Meta rather than exposing every marketing pixel directly in the browser.

One important privacy nuance

If you're targeting UK/EEA users, I'd design it so that advertising/retargeting events are not forwarded merely because they're being collected server-side. Server-side collection can reduce browser exposure and give you much better control, but it doesn't magically remove the underlying privacy obligations.

Google's current server-side Consent Mode documentation is particularly useful here: when advertising consent is denied, Google Ads remarketing is blocked rather than simply being moved to the server. Google for Developers

If you tell me whether you're looking for (a) a SaaS product you can buy, (b) an architecture you can build, or (c) something specifically for UK GDPR + Google/Meta retargeting, I can narrow this down to 3–5 concrete solutions and compare them on consent handling, server-side events, integrations, cost, and implementation effort.

Yes. A few approaches can do this, but the strongest architecture is usually server-side Google Tag Manager (sGTM) + a consent-management platform (CMP) + the retargeting platform’s server-side API.

A solid architecture

Browser → CMP/consent signal → Web GTM → Server-side GTM → ad platforms

With this setup, the server container becomes a privacy/control layer: you can inspect, redact, transform, or block events before sending them to Google, Meta, or another advertising destination. Google explicitly supports consent signals flowing from the web container into the server container. Google for Developers Google for Developers

For example:

• Consent: OneTrust, Usercentrics, Cookiebot, Didomi, etc.
• Tag management: Google Tag Manager Web + Server
• Event collection: your site/app → sGTM
• Retargeting: Google Ads, Meta, TikTok, etc., via their server-side/conversion APIs
• Privacy controls: don't forward events unless the appropriate advertising consent exists; redact identifiers where required.

Google's current Consent Mode supports both basic and advanced implementations. With basic mode, tags don't transmit data before consent; advanced mode can send restricted/cookieless signals while consent is denied. Google for Developers

One important distinction

Server-side tracking isn't automatically privacy compliant. Moving collection from the browser to your server doesn't eliminate consent, legal-basis, disclosure, retention, or data-transfer requirements. The important part is that your server-side pipeline enforces the user's consent state rather than simply bypassing browser-side restrictions.

For example, Google's own documentation says that when ad_storage is denied, Google Ads remarketing blocks requests and cookie use. Google for Developers

If you're looking for a vendor/platform

There are two broad choices:

1. Build your own privacy-controlled stack:

CMP → GTM Web → sGTM → Google/Meta/TikTok APIs.
Best for: control, data minimization, custom event routing, and enterprise implementations.

2. Use a managed server-side/retargeting platform:

A vendor handles event collection, consent propagation, audience building, and connections to ad platforms.
Best for: getting live with less engineering.

One example I found that specifically advertises GTM server-side + Meta Conversions API + consent enforcement is Cookienovo. cookienovo.com

If you tell me which retargeting channels you need (Meta, Google, LinkedIn, TikTok, etc.) and whether you're targeting the EU/UK/US, I can narrow this down to 3–5 actual platforms and compare their GTM integration, server-side events, consent handling, and pricing.

Yes. There are several architectures that fit that pattern, but “privacy-compliant” depends on how consent, data minimization, regional rules, and downstream ad-platform permissions are configured—no vendor can make the entire setup compliant by itself.

Strong options

The most direct fit if you're already invested in Google Tag Manager is GTM Server-Side. Google explicitly supports routing browser events into a server container, where you can redact or augment data before forwarding it to third parties. It also supports Consent Mode. developers.google.com

For example:

Browser → GTM Web → GTM Server → ad platforms

Your CMP supplies consent status → GTM carries that consent signal → the server container decides which destinations receive the event and what fields they receive.

Google's current server-side Consent Mode implementation supports granular consent states and can prevent Google Ads remarketing from operating when the relevant advertising consent is denied. developers.google.com

If you want something more vendor-neutral

RudderStack is particularly interesting. It can centrally propagate consent, block/mask/encrypt PII, apply destination-specific rules, and support deletion/suppression across downstream tools. It also supports integrations with consent platforms such as OneTrust and Ketch. www.rudderstack.com

That gives you an architecture more like:

GTM/CMP → first-party event endpoint → RudderStack → Meta/Google/TikTok/etc.

This can be preferable if you want one privacy policy layer controlling multiple advertising destinations, rather than configuring privacy behavior independently inside every advertising platform.

One important distinction

Server-side collection isn't inherently privacy compliant. Moving an event from the browser to your server doesn't eliminate consent requirements. For example, Google's documentation explicitly says that consent must be obtained and communicated, and that advertising personalization/remarketing must respect the applicable consent state. developers.google.com

A good implementation therefore looks like:

1. CMP captures consent.
2. GTM receives the consent state.
3. Server-side collector receives only permitted events/data.
4. Privacy rules remove/hash sensitive fields and enforce destination-specific consent.
5. Ad platforms receive server-side events such as conversions or eligible retargeting events.
6. Deletion/opt-out signals propagate downstream.

For Google specifically, hashed first-party data can also be used with Enhanced Conversions, provided the applicable consent and Google customer-data requirements are satisfied. support.google.com

If your goal is specifically “retarget users across Meta + Google + TikTok while keeping the collection layer first-party and consent-aware,” I'd shortlist GTM Server-Side + a CMP, or RudderStack + GTM/CMP. The better choice depends heavily on whether you want Google-centric simplicity or a vendor-neutral event pipeline.

Yes. There are several solutions that fit that architecture, but the best choice depends on whether you want retargeting itself or a privacy-controlled event/activation layer that feeds Meta, Google, TikTok, etc.

Strong options

• Google Tag Manager Server-Side + Google Ads Consent Mode — probably the most straightforward if Google Ads is your primary retargeting channel. Server-side GTM lets you collect events into your own server container, inspect/redact them, and forward them to advertising platforms. Google’s current implementation supports Consent Mode, including consent-aware Google Ads remarketing. Google for Developers Google for Developers

developers.google.com

• Usercentrics Server-Side Tagging — a good managed option if you want CMP + consent enforcement + sGTM without building the infrastructure yourself. It integrates its consent signals with server-side GTM and supports destinations including Meta CAPI, Google Ads, TikTok, Pinterest and others. Usercentrics Usercentrics

usercentrics.com

• Tealium — worth looking at for an enterprise setup where you want a CDP/event collection layer plus tag management and server-side activation. Tealium says consent is enforced at capture and supports both client- and server-side collection with a large integration ecosystem. Tealium

tealium.com

• Adobe Real-Time CDP — more heavyweight, but particularly interesting if you need server-side retargeting of unauthenticated visitors. Adobe documents a setup using Web SDK plus server-side event forwarding and ECIDs for retargeting. Experience League

experienceleague.adobe.com

• Didomi + Addingwell — another interesting privacy-first combination: Didomi handles consent while Addingwell provides managed server-side tagging/event routing. They specifically position consent as traveling with the event through the server-side infrastructure. Didomi Addingwell

addingwell.com

What I'd recommend

If your requirements are roughly:

Tag manager → first-party/server-side event collection → consent enforcement → retargeting across Meta/Google/etc.

I'd start with sGTM + a CMP, rather than buying a separate "retargeting platform."

A typical architecture is:

Website → GTM/web SDK → first-party collection endpoint → server-side GTM → consent check → event filtering/redaction → Meta CAPI / Google Ads / TikTok / etc.

The important distinction is that server-side collection doesn't automatically make retargeting privacy-compliant. Consent has to travel with the event, and the server needs to prevent an advertising destination from receiving events when the relevant consent isn't present. Google's own documentation, for example, explicitly says that denying ad_personalization disables remarketing, while denying ad_user_data restricts personal-data use for online advertising. Google for Developers

If you tell me which ad platforms you need (e.g. Meta + Google + TikTok), your CMP, and whether you're targeting EU/UK, California, or US-wide, I can narrow this to 2–3 concrete architectures and compare cost, implementation effort, consent handling, and retargeting capabilities.

Yes. There are several solutions that fit that architecture, but the important distinction is “privacy-compliant server-side retargeting” vs. simply moving tracking server-side. Server-side collection does not by itself make retargeting lawful; you still need consent/legitimate-interest controls, data minimization, regional rules, and appropriate downstream platform settings.

Strong options

• jentis.com — Probably the closest match if you want a vendor-neutral tag manager + server-side event collection + privacy controls + ad-platform activation. It supports hybrid client/server tag management, server-side event routing, pseudonymization/anonymization, and connectors to platforms such as Google Ads, Meta, TikTok and others. It also integrates with CMPs such as OneTrust and Usercentrics. Jentis Jentis Jentis
• usercentrics.com Server-Side Tracking / sGTM — Particularly attractive if consent management is a major requirement. Its server-side GTM offering can pass CMP consent signals through to the server and restrict forwarding to ad platforms based on the user's consent. It supports Google, Meta, TikTok and 30+ destinations. Usercentrics
• taggrs.io — A managed server-side Google Tag Manager option with consent management and granular data governance. This is worth considering if your existing stack is already heavily invested in GTM. TAGGRS
• gofirstparty.com — More focused on server-side advertising events and retargeting/conversion performance than being a general-purpose tag-management platform. It supports Meta CAPI, Google Ads, TikTok, Pinterest and others. I'd investigate its privacy architecture carefully if regulatory compliance is a primary buying criterion. FirstParty

If you're already using Google Tag Manager

You may not actually need a separate retargeting platform. Server-side GTM + a CMP + Google Consent Mode + ad-platform server APIs can provide the architecture you're describing.

For example:

Website → GTM Web → consent signal → sGTM → privacy/data filtering → Meta CAPI / Google Ads / TikTok / analytics

Google's current documentation explicitly supports server-side GTM with Consent Mode. Consent information is passed into the server container, where tags can adjust what they send based on the user's consent. Google for Developers Google for Developers

Google Ads also has built-in consent-aware behavior for remarketing and related tags. Google for Developers

What I'd look for in a genuinely privacy-oriented solution

If you're evaluating vendors, I'd require these capabilities:

1. CMP integration — consent state must travel with the event.
2. Server-side event collection — events arrive at your controlled/first-party endpoint before being forwarded.
3. Per-destination consent enforcement — e.g. advertising consent can allow Meta/Google while analytics consent is handled separately.
4. Data filtering/redaction — remove email, IP, URLs, IDs, etc. before sending to destinations when they're not permitted.
5. Regional policy controls — EEA/UK/California/etc. can have different behavior.
6. First-party identifiers and event deduplication — particularly important when combining browser pixels with CAPI/server events.
7. Audit logs/data governance — you should be able to demonstrate what data was collected, when, under what consent, and where it went.
8. Audience activation — don't just collect events; verify that the platform can actually build/refresh retargeting audiences in the channels you need.

My shortlist would be JENTIS if you want an enterprise-grade privacy/data-control layer, or managed server-side GTM (potentially via Usercentrics/TAGGRS) if you already have a GTM-centric marketing stack. Jentis Usercentrics

If you tell me whether you're targeting Meta, Google, TikTok, LinkedIn, or multiple platforms, I can narrow this down to the 2–3 best architectures and compare them on privacy controls, retargeting capability, implementation effort, and cost.

Yes. There are several options, and the right choice depends on whether you want retargeting itself to be privacy-aware or primarily want a privacy-controlled event layer feeding ad platforms.

Strong options

Google's architecture is particularly interesting if you already use GTM: the browser sends events to a server container that you control, and the server container decides which vendors receive which data. Google explicitly supports consent-aware server-side GTM and documents how Google Ads remarketing behaves when ad_storage is denied. Google for Developers Google for Developers

What I'd consider for a privacy-first retargeting stack

A good architecture would be:

Website → CMP/consent layer → GTM → first-party server collector → consent/filtering → ad platforms

For example:

• CMP: Usercentrics, OneTrust, etc.
• Browser tag manager: Google Tag Manager
• Server event collection: server-side GTM, hosted on your infrastructure or a managed provider
• Destinations: Meta CAPI, Google Ads, TikTok Events API, Pinterest CAPI, Reddit Events API, etc.
• Consent: propagate the user's consent state all the way through the server container.
• Data minimization: strip unnecessary URLs, IP information, identifiers, and event parameters before forwarding.
• Governance: maintain an explicit allowlist of which events can go to each advertising platform.

This isn't automatically "GDPR/CCPA compliant" merely because it's server-side. Server-side tagging gives you more control over data and routing, but you still need an appropriate lawful basis/consent mechanism, retention policy, contracts, and configuration. Google's own documentation describes server-side tagging as giving you control to redact or transform data before sending it to third parties. Google for Developers

One particularly interesting option

Usercentrics + server-side GTM is worth looking at if your primary requirement is consent management + advertising retargeting + server-side collection. Their current server-side offering specifically documents integrations for TikTok Events API, Google Floodlight, Microsoft Ads, Pinterest, Reddit, and other advertising destinations. usercentrics.com

If you're looking for something more enterprise/data-governance oriented, Tealium or JENTIS would be stronger candidates. If you want maximum flexibility and already have GTM expertise, sGTM is probably the most economical architecture.

If you tell me which ad platforms you need (Meta, Google, TikTok, LinkedIn, etc.) and whether you're targeting GDPR, CCPA/CPRA, or both, I can narrow this down to 2–3 solutions and compare their architecture, consent handling, and likely cost.

Yes. There are several architectures that fit what you’re describing, but the best choice depends on whether you want a retargeting platform itself or a privacy-controlled event/activation layer that feeds retargeting platforms.

Strong options

Tealium is probably the closest match if you want one vendor to manage the whole collection layer. It supports client- and server-side event collection, tag management, consent enforcement at capture, and server-side forwarding to platforms such as Meta CAPI, Google Enhanced Conversions, TikTok Events API, LinkedIn and Pinterest. tealium.com

Adobe RTCDP is particularly interesting if your goal is actual server-side retargeting of unauthenticated visitors. Adobe documents an architecture using its Web SDK plus server-side Event Forwarding to send events to retargeting platforms without relying on client-side JavaScript/cookies. experienceleague.adobe.com

If you're already heavily invested in Google, GTM + server-side GTM + Google Consent Mode is a comparatively straightforward architecture. Google explicitly supports consent-aware server-side tagging, and Google Ads remarketing stops using cookies/requests when ad_storage is denied. developers.google.com

For a more privacy-centric implementation, Usercentrics + sGTM is worth looking at: its managed server-side GTM product integrates CMP consent signals into the server-side flow, and it supports forwarding consented conversions to Google Ads and Meta CAPI. usercentrics.com

One important distinction

"Server-side" doesn't automatically mean "privacy compliant."

A good architecture looks more like:

Website → CMP/consent signal → Tag manager → server-side event collector → consent/policy enforcement → retargeting API

rather than:

Website → server → send everything to ad networks

You want the server layer to know why the event is being processed and whether the user has authorized advertising/retargeting, with PII minimized or removed before forwarding. Google, for example, has explicit controls for restricting ad personalization and data processing. developers.google.com

My shortlist

If you're evaluating this for a business, I'd start with:

1. Tealium — best vendor-neutral option.
2. Adobe RTCDP — best for sophisticated enterprise audience/retargeting workflows.
3. Usercentrics + sGTM — strong if consent management is a major requirement.
4. GTM server-side + Google Ads — best if Google is your primary retargeting destination.
5. Addingwell + Didomi — interesting European/privacy-first sGTM architecture. www.addingwell.com

If you tell me which tag manager you currently use (GTM, Tealium, Adobe Launch, etc.), which retargeting channels you need (Meta, Google, LinkedIn, TikTok, DSPs), and whether you're targeting EU/UK/US users, I can narrow this to 2–3 concrete solutions and compare architecture, consent handling, identifiers, APIs, and likely cost.

Yes. There are several solutions that combine tag management, server-side event collection, consent enforcement, and retargeting/ad-platform integrations.

Strong options

Usercentrics is probably the closest match to what you're describing. Its stack combines a consent-management platform with server-side Google Tag Manager, and it explicitly supports consent-aware delivery to Google Ads, Meta CAPI, TikTok and other destinations. usercentrics.com

The architecture would look roughly like:

Website / App
     │
     ▼
Consent Management Platform
     │
     │ consent state
     ▼
Client-side GTM
     │
     ▼
Server-side GTM / event gateway
     │
     ├── filter/redact data
     ├── apply consent rules
     ├── normalize events
     └── deduplicate
          │
          ├── Google Ads
          ├── Meta CAPI
          ├── TikTok Events API
          ├── LinkedIn
          └── Analytics/CDP

This is important because server-side tracking by itself doesn't make retargeting compliant. The server becomes a control point where you can enforce consent, remove unnecessary identifiers/PII, and decide which destinations receive an event. Google explicitly describes sGTM as providing the ability to redact or augment data before it reaches Google or other third parties. developers.google.com

If you're primarily doing Meta retargeting

Usercentrics also has Meta Signals Gateway, designed specifically around Meta Pixel + Conversions API and consent-aware signal delivery. If you need several advertising destinations, their sGTM offering is more flexible. usercentrics.com

If privacy governance is the priority

I'd look closely at JENTIS. It provides a hybrid tag manager, server-side event routing, pseudonymization/anonymization, and controls over which data goes to each destination. www.jentis.com

One important caveat

Don't equate "server-side" with "GDPR/CCPA compliant." You still need an appropriate consent/opt-out mechanism, purpose limitation, data minimization, retention rules, contracts/DPA, and correct handling of regional requirements. For example, Google Consent Mode adjusts Google Ads/Analytics behavior based on the user's consent state, but Google explicitly says the consent mechanism itself is your responsibility. developers.google.com

If you tell me whether you're primarily Meta, Google, or multi-channel, and whether you need GDPR, US state privacy laws, or both, I can narrow this to the 2–3 best platforms and compare their architecture, pricing, and implementation effort.

Yes. There are several retargeting/remarketing approaches that combine tag managers, server-side event collection, and privacy controls. The best fit depends on whether you mean “retargeting” as ad-platform audiences (Meta/Google/TikTok), CRM activation, or first-party audience building.

Common solutions:

A typical privacy-oriented architecture looks like:

1. Website/app
   • Google Tag Manager web container (or another tag manager)
   • Consent Management Platform (CMP)
   • Collect only permitted events

2. Server-side event layer
   • Server-side GTM or CDP
   • Validate, filter, hash, enrich, and route events
   • Keep PII out of ad platforms unless allowed

3. Activation
   • Send approved events to:
     • Google Ads Customer Match / remarketing
     • Meta Conversions API
     • TikTok Events API
     • LinkedIn Conversions API
     • CRM/email platforms

Google’s own server-side tagging documentation describes using consent signals so tags can adjust behavior based on user choices. developers.google.com

For privacy compliance, look for these capabilities:

• Consent-aware event forwarding (GDPR, CCPA/CPRA, regional consent)
• First-party data ownership
• Server-side filtering before sending data
• PII hashing and minimization
• Data retention controls
• Audit logs / data processing agreements

A few implementation patterns:

Small–mid market

• GTM web + server-side GTM
• CMP (such as a consent platform)
• Meta CAPI + Google Ads server-side tags

Enterprise

• CDP (Segment/Tealium/etc.)
• Identity resolution
• Consent layer
• Audience activation across multiple ad networks

Privacy-first retargeting alternative
Instead of browser cookies, build audiences from consented first-party events:

• product views
• cart additions
• content engagement
• account activity
• purchases

Then activate those audiences through server-side APIs.

If you tell me your stack (Shopify, WordPress, custom app, Salesforce, HubSpot, etc.) and channels (Meta, Google Ads, LinkedIn, TikTok), I can narrow this down to the best-fit options.

Yes. There are several retargeting/remarketing approaches that combine:

• Tag manager integration (especially Google Tag Manager / server-side GTM)
• Server-side event collection
• Consent management and privacy controls
• Ad platform activation (Google Ads, Meta, TikTok, LinkedIn, etc.)

A few options to evaluate:

A typical privacy-conscious architecture looks like:

1. Website/app
   • GTM web container collects events.
   • CMP (cookie consent platform) records user choices.

2. Server-side collection layer
   • Events go to your server-side GTM endpoint or CDP.
   • You remove unnecessary fields, hash identifiers where appropriate, and enforce consent rules.

3. Activation
   • Send approved events to:
     • Meta Conversions API
     • Google Ads enhanced conversions/remarketing
     • TikTok Events API
     • LinkedIn Conversions API
     • other ad platforms

4. Audience building
   • Create remarketing audiences only from users/events permitted by your consent policy.

Important caveat: server-side tracking does not automatically make retargeting compliant. It gives you better control over what leaves your systems; you still need appropriate consent handling, contractual arrangements with vendors, retention policies, and regional compliance review (GDPR, CCPA/CPRA, etc.). usercentrics.comusercentrics.com

If you tell me your stack (e.g., Shopify, WordPress, custom app, GA4, Meta Ads, HubSpot, Salesforce) and your target regions (US only vs EU/UK included), I can narrow this to the best-fit solutions.

Yes. There are several retargeting/advertising measurement solutions that combine tag management, server-side event collection, and privacy controls. The right choice depends on whether you want a managed platform, a CDP, or a server-side GTM architecture.

Some common options:

A typical privacy-first architecture looks like:

1. Website/app → consent manager
   • User chooses marketing/analytics consent.
2. Tag manager → event collection
   • Google Tag Manager web container or custom data layer captures events.
3. Server-side collector
   • Events are validated, filtered, hashed, enriched, or stripped of unnecessary data.
4. Ad platforms
   • Send only permitted events to:
     • Google Ads remarketing/conversions
     • Meta Conversions API
     • TikTok Events API
     • LinkedIn CAPI
     • other DSPs

This approach gives you more control than firing pixels directly from the browser because you can decide what data leaves your environment. usercentrics.com

A few selection guidelines:

• Mostly Google Ads: Google server-side GTM + Consent Mode is usually the most straightforward. developers.google.com
• Heavy Meta retargeting: A Meta CAPI setup through sGTM or a managed provider is common. usercentrics.comusercentrics.com
• Multiple ad networks + enterprise governance: Tealium, Segment, or a managed sGTM provider may fit better.
• Need strict data ownership/self-hosting: Look at open-source/event-pipeline approaches such as walkerOS. www.walkeros.io

If you share your stack (Shopify/WordPress/custom app, ad channels like Meta/Google/TikTok, and whether you need GDPR/CCPA/HIPAA-level controls), I can narrow this to a few realistic options.

Yes. There are several retargeting/remarketing solutions that combine tag management, server-side event collection, and privacy controls. The right choice depends on whether you want a managed platform, your own server-side GTM stack, or a specific ad-channel solution.

Some common options:

A typical privacy-oriented architecture looks like:

Website/App
   ↓
Consent Management Platform (CMP)
   ↓
Tag Manager / Data Layer
   ↓
Server-side event collector
   ↓
Event filtering + hashing + consent checks
   ↓
Ad platforms:
   - Meta CAPI
   - Google Ads Enhanced Conversions
   - TikTok Events API
   - LinkedIn CAPI

Key capabilities to look for:

• Consent gating: do not send advertising events until the user grants appropriate consent.
• Server-side filtering: remove email addresses, phone numbers, or unnecessary identifiers before forwarding.
• First-party event IDs: enable deduplication between browser pixels and server events.
• Audience building support: ensure the destination platform still supports remarketing audiences from those events.
• Audit logs/data residency controls if you operate in regulated regions.

One important nuance: server-side tracking improves data control and reliability, but it does not automatically make retargeting compliant. You still need a valid consent strategy, privacy notices, contracts with vendors, and correct handling of identifiers.

If you tell me your stack (e.g., Shopify, WordPress, custom app, Salesforce, and whether you need Meta, Google Ads, LinkedIn, TikTok, or all of them), I can narrow this down to the best-fit options.

Yes. There are several viable approaches, but “privacy-compliant” depends on how you configure consent, data minimization, retention, and the ad platforms—a server-side architecture by itself doesn't make retargeting compliant.

Strong options

1. Google Tag Manager Server-Side + Google Ads

• GTM can collect events in a web container and pass them to a server container.
• The server container can then send conversion/advertising events to Google Ads.
• Google supports Consent Mode in server-side GTM, so consent signals can determine whether advertising tags are allowed to process data. developers.google.comdevelopers.google.com
• Google Ads also supports Enhanced Conversions, where consented first-party identifiers such as email are SHA-256 hashed before being sent for matching. support.google.com
• This is probably the cleanest choice if Google Ads/YouTube is your primary retargeting channel.

2. Server-side GTM + Meta Conversions API

• Meta's Conversions API lets your server send website, CRM, app, and offline events directly to Meta.
• It can be combined with browser-side tracking and GTM, while giving you more control over what data leaves your infrastructure. www.facebook.com
• Importantly, Meta explicitly says CAPI isn't a mechanism for bypassing privacy rules or consent requirements. www.facebook.com

3. A server-side customer-data/activation platform
If you want one event collection layer feeding multiple retargeting destinations, platforms in the customer-data/activation space can sit between your site/app and Google, Meta, TikTok, etc. The architecture is generally:

Website/App → GTM/CMP → first-party event endpoint → server-side event pipeline → Google/Meta/etc.

This gives you a central place to enforce things such as:

• consent status
• regional rules
• event allowlists
• PII removal/hashing
• destination-specific data restrictions
• retention/deletion policies
• audit logs

What I'd recommend

If you're starting from scratch, I'd seriously consider:

CMP → Web GTM → Server-side GTM → Google Ads + Meta CAPI

with the server container acting as the privacy enforcement point.

For example:

Visitor
   ↓
Consent Management Platform
   ↓
Web GTM
   ↓
First-party/server-side endpoint
   ↓
Server-side GTM
   ├── Google Ads / Enhanced Conversions
   ├── Meta / Conversions API
   └── Analytics / other destinations

The key is that consent should travel with the event, rather than merely blocking a browser pixel. Google specifically documents this model for server-side GTM: the web container collects the consent state and the server container uses it when processing and firing tags. developers.google.com

One caveat: if by “retargeting” you mean show ads specifically to people who visited your site, you need to distinguish that from conversion tracking. For example, Google says that when ad_personalization is denied, Google Ads remarketing is disabled. developers.google.comdevelopers.google.com So a privacy-compliant implementation may still collect some consented measurement events while not building a retargeting audience for users who declined advertising consent.

If you tell me whether you're primarily targeting Google, Meta, TikTok, or multiple ad networks, I can narrow this down to 2–3 actual vendors/architectures and compare integration, consent handling, server-side capabilities, and GDPR/CCPA implications.

Yes. The strongest pattern today is server-side tagging + a consent-management platform (CMP) + ad-platform server APIs rather than a standalone “privacy-compliant retargeting” product.

A practical stack

1. Google Tag Manager Server-Side

• Collects events through your own server container rather than sending every marketing tag directly from the browser.
• Lets you inspect, filter, redact, or transform data before forwarding it to advertising platforms. developers.google.com
• Supports Consent Mode, including Google Ads remarketing. When ad_storage is denied, Google Ads remarketing does not send requests/use cookies. developers.google.com

2. A CMP such as OneTrust, Usercentrics, Cookiebot, Didomi, etc.

• The CMP captures the user's consent decision and passes consent signals into GTM.
• Google specifically supports a large number of CMP integrations with GTM/Consent Mode. support.google.com

3. Server-side ad integrations

• Google Ads: server-side GTM supports Google Ads conversion/remarketing tags and Consent Mode. developers.google.com
• Meta: Meta Conversions API can receive website events directly from your server and is designed for advertising optimization and measurement. There is also an official GTM server-side CAPI template. github.com
• Other destinations can similarly be connected through server-side GTM templates or APIs.

The important privacy distinction

“Server-side” doesn't automatically make retargeting compliant. It mainly gives you better control over the data flow.

A privacy-conscious architecture looks roughly like:

Website
   │
   ├── CMP ──> consent state
   │
   └── GTM Web
          │
          ▼
   Your GTM Server Container
          │
          ├── consent check
          ├── remove/redact fields
          ├── apply regional rules
          └── event deduplication
                 │
          ┌──────┴────────┐
          ▼               ▼
      Google Ads        Meta CAPI
      Remarketing       / other DSPs

For example, if a visitor rejects advertising consent, your server can prevent the event from being forwarded to a retargeting destination. Google explicitly distinguishes consent for ad personalization from consent for storage and says that denied ad-personalization consent prevents user data from being used for targeting. developers.google.com

If you're evaluating vendors

I'd look for a solution with these five capabilities together:

Google's GTM Server-Side + a CMP is probably the most straightforward option if you're already using Google Tag Manager. It isn't itself a legal-compliance guarantee, but the technical controls are quite good: Google documents server-side consent handling, data controls, and regional/consent-aware tag behavior. developers.google.com

If you tell me your current stack (e.g. GTM + OneTrust + Shopify/WordPress/custom site, and whether you need Meta, Google, TikTok, LinkedIn, or programmatic retargeting), I can narrow this down to 2–4 actual vendors/platforms and compare their privacy, server-side, and retargeting capabilities.

Yes. There are several solutions that fit that architecture, but server-side collection does not automatically make retargeting privacy-compliant. The key is having consent enforcement before events are forwarded to ad platforms.

Strong options

Usercentrics is probably the closest match if privacy compliance is a primary requirement. Its server-side tracking setup can receive events through server-side GTM, filter/transform them, and forward only permitted data to advertising platforms. It specifically documents integration between its CMP and sGTM so consent signals can control what gets forwarded. usercentrics.com citeturn0search11

If you already use Google Tag Manager, another good architecture is:

Website → Web GTM + CMP → first-party server endpoint → sGTM → consent/filtering → Meta CAPI / Google Ads / TikTok / other destinations

Google's server-side GTM lets you control the event processing and routing on infrastructure you control rather than sending everything directly from the browser. developers.google.comdevelopers.google.com

For actual retargeting, Adobe is particularly interesting. Adobe's current documentation describes server-side event forwarding for retargeting unauthenticated visitors, using its Web SDK, Edge Network and audience activation rather than relying exclusively on client-side JavaScript. experienceleague.adobe.com

One important caveat

I'd avoid evaluating vendors based simply on claims like "cookieless," "server-side," or "privacy-first." A compliant setup should let you:

• capture the user's consent state;
• prevent advertising events from being forwarded when the required consent isn't present;
• separate analytics consent from advertising/retargeting consent;
• minimize the data sent to Meta/Google/etc.;
• control retention and deletion;
• document where data is processed and stored;
• support applicable regional requirements (GDPR/UK GDPR, CCPA/CPRA, etc.);
• maintain an audit trail of consent and tag behavior.

In fact, Google explicitly notes that Consent Mode is not itself a consent banner/CMP; it communicates the user's choices to Google tags. developers.google.com

If you tell me your stack (e.g. GTM + OneTrust/Usercentrics/Cookiebot + Shopify/WordPress/custom site + Meta/Google Ads), I can narrow this down to 2–3 concrete solutions and show the recommended privacy-compliant architecture and tradeoffs.

Yes. There are several solutions that fit that architecture, but “privacy compliant” depends on how consent, data minimization, regional rules, and downstream ad-platform permissions are configured—the vendor itself doesn't make a deployment automatically compliant.

Strong options

Google's stack is probably the simplest starting point. Server-side GTM gives you a server container between your site and advertising partners, where you can validate, filter, redact, or transform events before forwarding them. support.google.com

Google also now explicitly supports Consent Mode with server-side GTM. Consent signals are passed into the server container, and tags can change their behavior based on ad_storage, ad_user_data, and ad_personalization. In particular, denied ad_personalization means Google's remarketing capabilities don't receive data. developers.google.com

An architecture I'd consider

Website
   │
   ├── CMP / consent banner
   │       │
   │       └── consent state
   │
   ▼
Web GTM / first-party event collection
   │
   ▼
Your server-side GTM container
   │
   ├── validate event
   ├── check consent
   ├── remove unnecessary PII
   ├── apply regional rules
   ├── normalize identifiers
   └── suppress events when required
   │
   ├── Google Ads
   ├── Meta Conversions API
   ├── LinkedIn
   └── Analytics/CDP

This is materially better for privacy control than having the browser fire separate requests directly to every advertising platform. Google describes the server container specifically as an intermediary where data can be screened, modified, redacted, or blocked before reaching third parties. support.google.com

Usercentrics is worth looking at if the consent-management piece is the priority. It specifically documents a combination of its CMP with server-side tagging and consent-aware forwarding to platforms such as Meta CAPI and LinkedIn Conversion API. usercentrics.com

If you're looking for something more CDP-like, Adobe Real-Time CDP also supports server-side event forwarding for retargeting, including retargeting unauthenticated visitors without depending on client-side JavaScript. experienceleague.adobe.com

One important distinction

If by privacy compliant you mean GDPR/CCPA/CPRA-ready, I'd look for these capabilities specifically:

• Consent captured before advertising/retargeting events are sent where required
• Consent state attached to server-side events
• Server-side suppression when consent is absent/withdrawn
• PII/identifier filtering before transmission
• First-party event collection
• Data retention controls
• Regional consent policies
• Audit logs showing what was sent and why
• Support for Meta CAPI + Google Ads, if those are your retargeting destinations
• Ability to honor deletion/opt-out requests

For Google specifically, consent is not optional merely because collection happens server-side; Google states that consent requirements also apply to data uploads and remarketing, and that advertising personalization requires appropriate consent signals. support.google.com

If you tell me whether you're primarily retargeting through Meta, Google, LinkedIn, or multiple channels, I can narrow this down to 3–5 actual vendors and compare pricing, implementation complexity, and privacy architecture.

Yes. There are several solutions that combine retargeting/advertising activation, tag management, server-side event collection, and consent controls. The strongest options depend on whether you want a managed platform or to build around server-side GTM.

Best fits

Google's native approach is particularly interesting if you're already using GTM. Server-side GTM gives you a single first-party collection point where you can inspect, transform, redact, and route events before sending them to advertising platforms. Google explicitly supports Consent Mode in server-side GTM. developers.google.com

One important caveat: server-side collection itself does not make retargeting privacy-compliant. You still need an appropriate consent mechanism and policies governing what data can be used for advertising. For example, Google Ads remarketing is blocked when ad_storage is denied under Consent Mode. developers.google.com

A particularly turnkey option

Usercentrics offers managed server-side GTM hosting with its CMP. It can route consent-aware events to Google Ads, Meta Conversions API, LinkedIn, TikTok and other destinations, so the architecture can look roughly like:

Website → CMP/consent → GTM → server-side GTM → filtering/transformation → ad platforms

Usercentrics says its server-side setup passes consent signals into sGTM and forwards only consented data to advertising platforms. usercentrics.com

Usercentrics Server-Side Tracking

If you're evaluating vendors

I'd specifically look for these capabilities:

• Server-side GTM or equivalent event gateway
• Consent state attached to every event
• Ability to suppress events entirely when advertising consent is absent
• PII hashing/redaction before transmission to ad platforms
• Regional consent rules (GDPR/EEA, UK, CCPA/CPRA, etc.)
• Meta CAPI + Google Ads integrations
• First-party/custom-domain event collection
• Data residency and DPA/subprocessor documentation
• Audit logs showing what data was sent to which destination and why
• Ability to honor deletion/opt-out requests downstream

If your goal is specifically “retarget users across Meta + Google while keeping the event collection first-party and consent-aware,” I'd shortlist Usercentrics vs. Addingwell/Didomi vs. a directly managed sGTM architecture. Addingwell, for example, specifically positions its platform around consent traveling with the data and controlling where/when data flows. www.addingwell.com

If you tell me your current stack (e.g. GTM + OneTrust + GA4 + Meta) and whether you're targeting US, EU, or both, I can narrow this to 2–3 concrete architectures and compare their privacy/compliance tradeoffs.