Server-side tag-management and consent

Collecting consent is a necessity and there are plenty of ways to get it (or at least to ask for it). However, respecting a user's choice requires particularly not using third party tools the user did explicitly not agree to.

In the world of client-side tag-managers that was easy. Basically, the consent-manager stores a boolean (true/false) value somewhere (local storage or a cookie in the browser) and the client-side tag manager reads this information. This can either happen by an event the consent-manager triggers (and passes the boolean value to the data layer) or some custom scripts.

However, we no long live in a world where only client-side tag-managers exist - and fror some good reasons. Of course, there is this third-party-cookie thing, but more importantly, server-side tag-managers can be used in a variety of ways, e.g. to asynchronously enrich collected data without impacting the performance of the user's client - basically the client sends a single request with raw data to server and this server enriches and distributes the information, including to third parties the user consented to.

But: If the server receives some raw data and in the end distributes it to third parties, how does it know if the user consented to sending that data to the corresponding third party? Obviously the consent needs to be passed alongside the raw data so the server can decide if it may pass it on. And how is this done? Let's look at an example...

Client-side data- and consent-collection

Everything I'm explaining here is very much tool-agnostic. However, to be able to show some screenshots: Let's presume we use the good old Google tag-manager (GTM), both client- and server-side. Additionally the data collector I'll be displaying here is a Snowplow tracker (the client-side GTM template can be easily found in the gallery), hence the server-side receiver is the Snowplow Client for GTM-SS:

Snowplow Client for GTM SS | Snowplow Documentation

Snowplow client configuration for Google Tag Manager Server-Side behavioral event processing integration.

Snowplow

If you, for some reason I am unlikely to understand, prefer to use the client-side tag and it's server-side counterpart (the GTM-SS client) for GA4, it'll work fine, just a little differently (i.e. weirder) 🤪

Also, to streamline things a little bit, let's focus on the setup for just one third-party: Meta (Facebook/Instagram). Namely, I would like to send pageviews (and other events) to their conversion API.

Consent in a variable

After collecting consent from the user, GTM will need to read the information somehow. Either with consent mode or any other way, at some point the user's choice on allowing us to send data to Meta will be stored in a GTM variable. How to get it in there is not the point here, but rather: How do we then pass it on to GTM-SS?

With Snowplow, adding event information to the already rich vanilla data means custom context. And in GTM, that means we'll create a custom-context-variable containing a JSON object. This variable will reference the other GTM variable containing the consent for Meta:

With a GA4 tag you'd probably add the value of the initial consent variable as value of a custom field. And add a custom field for each individual consent variable you have. So lot's of custom fields. But hey, as of June 2023 you can later remove those fields in GTM-SS before sending the data somewhere else 🥳 I guess that is a good thing?! Anyway...

Receiving data and consent in GTM-SS

In GTM-SS the Snowplow (or GA4) client picks up the data, including the consent-context (or field). Then, another variable can extract it:

Note: I set a default here. I can't really think of a case, when you want to send something to GTM-SS without collecting consent first, and hence, having the custom context available, but just in case 😉 OK, maybe you want to analyze interactions with your consent-manager. But that doesn't concern Meta anyway.

Triggering GTM-SS tag with consent

The last piece of the puzzle is then to dependently trigger the tag sending whatever data you want to send to it to the conversion API. That's easy enough:

And here we are: The GTM-SS tag sending data to the Meta conversion API will only be triggered if the user provided consent and the client-side GTM processed it accordingly.