Server-side tracking under UK GDPR: a marketer's compliance checklist

What to take away

Server-side tracking moves collection off the browser, but it does not move you outside UK GDPR or the PECR rules on storing information on a device.
Consent mode still governs whether identifiers are read or written, and a cloud container is a processor of whatever you send it.
You need a documented lawful basis, a retention rule and a data flow record before the first tag fires.
The difficult parts are governancevendor contracts, data minimisation and a tested rollback route.
Setups differ, so take qualified advice on your own facts before you sign off a design.

What changes when collection moves to a server

Server-side tracking means the browser sends one stream of data to a container you control, usually in a cloud environment. Vendor tags then run inside that container rather than in the page.

Browser to container to vendors

Browser sends one data stream
Container you control in cloud
Vendor tags run inside container
IP, cookie ID, hashed email are personal data
Denied consent mode blocks ad identifiers

That is an engineering change, not a legal one. An IP address, a cookie ID and a hashed email address can all be personal data under the UK GDPR.

The same rules follow the data wherever it lands. Moving collection to your own domain changes who holds it first, not whether the law applies.

Consent mode changes what the tags may do. In the denied state, tags should not read or write advertising identifiers, and the container should pass only the signals you have agreed to collect.

The two legal tests that still apply

PECR governs storing information on, or accessing information stored in, a person's device. This applies whether a page script or your server writes the cookie. Consent is needed unless the storage is strictly necessary for a service the person requested, as the ICO's guidance on direct marketing and privacy and electronic communications sets out.

PECR and UK GDPR duties

PECR

Scope: Device storage access
Core duty: Consent unless strictly necessary
Extra rules: Applies to server cookies
Accountability: ICO enforcement

UK GDPR

Scope: Personal data processing
Core duty: Lawful basis required
Extra rules: Purpose, minimisation, retention
Accountability: Records and reasoning

The UK GDPR adds purpose limitation, data minimisation, retention limits and accountability. The ICO's UK GDPR guidance sets out the principles and the records you should hold.

The Data Protection Act 2018 supplements the UK GDPR and carries the enforcement framework the ICO works within.

A six-step compliance checklist

Map the data flow and minimise collection.Record each purpose, the events and fields collected, where the data goes, who receives it and which identifiers are involved. Remove fields that are not needed for the stated purposes.
Check device storage and access under PECR.Regulation 6(1) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) requires consent before storing information on, or accessing information on, a person's device, unless the regulation 6(4) exception applies. Check the ICO's Cookies and similar technologies guidance and record how consent and withdrawal are handled.
Choose a UK GDPR lawful basis for each processing purpose.The Article 6 bases are consent, contract, legal obligation, vital interests, public task and legitimate interests. Select and document the basis for each purpose; PECR consent for device storage or access does not, by itself, settle the UK GDPR basis. If relying on legitimate interests, document the purpose, necessity and balancing test.
Confirm roles and supplier terms.Decide whether each party is a controller, joint controller or processor for each activity. Where a supplier is a processor, put the required Article 28 terms in place, including instructions, security, sub-processors and deletion or return of data.
Set and apply retention periods.The UK GDPR does not prescribe one universal retention period for marketing measurement data. Set and justify a period for each data type and purpose, record the period or deletion trigger, and ensure deletion covers server logs and downstream copies where applicable.
Keep the required records and test the controls.Maintain the Article 30 record of processing activities where required, assess whether a data protection impact assessment is needed under Article 35, and test consent withdrawal, deletion and rollback before launch.

Six-step compliance checklist

Map the data flow
Set consent mode before launch
Choose and record lawful basis
Minimise the payload
Write retention into container config
Test consent withdrawal

Where server-side setups go wrong

The table below pairs the claims we hear most often with the requirement each one tends to miss.

Common claim	What the rules require
The data never touches the browser, so consent is not needed	Storage on, or access to, a device still needs consent unless it is strictly necessary under PECR
It is our own server, so we are the only controller	A vendor may be a controller or joint controller for its own purposes, so check the contract
Hashing an email makes it anonymous	Hashing is pseudonymisation and stays personal data if you can re-identify the person
Server logs are technical data, not marketing data	Using them to build profiles or measure campaigns brings them inside the GDPR purpose rules
Consent mode handles everything	Consent mode carries signals; your lawful basis and retention rules still need writing down

Contracts are the weak point. Ask each vendor whether it acts as a controller for its own purposes, and settle that before you switch on the container. Our seven contract questions for a measurement supplier walk through data roles, sub-processors and exit terms. Use these questions in the review:

Which party is the controller or processor for each purpose?
What documented instructions and permitted uses apply to the data?
Which data types and people are covered by the contract?
Which sub-processors are used, and how will changes be notified?
What security measures apply, and how are personal data breaches reported?
Where is the data processed, and what safeguards apply to any international transfers?
When will data be deleted or returned, and what audit and exit arrangements apply?

Documentation a reviewer will ask for

Keep a short record: purposes, lawful basis, fields collected, recipients, retention periods and any transfer route. A reviewer should be able to follow it without asking you questions.

If you are rebuilding collection mid-year, a ninety day plan sets the order of work: expose the current flow, test it, then decide what to keep.

Keep the record with the container configuration, so a change to one prompts a review of the other.

This article is general guidance, and your own facts need a qualified adviser.

Common questions

Does server-side tracking remove the need for a cookie banner?

No. PECR applies to storing information on a device and to accessing it, and a server-set cookie is still storage. You need consent unless the storage is strictly necessary for a service the person requested.

Is a first-party server container a data processor?

Often yes, if a vendor runs or hosts the container for you, but the roles depend on the contract and on what the vendor does with the data. Some vendors act as controllers for their own purposes.

Can we rely on legitimate interests for server-side tracking?

Rarely for advertising, because the person cannot easily avoid the processing and the intrusion is hard to justify. Document the balancing test if you try, and expect scrutiny.

What must we do when someone withdraws consent?

Stop measuring them, including in server logs and in any warehouse copy. Confirm the deletion route works before launch, not after a complaint.