Server-side tracking after iOS: what actually works in 2026

Every audit starts the same way: we compare platform-reported conversions against the client's actual sales data. The gap is almost always 20-40%. Not because ads stopped working, because the browser stopped talking.

The setup that works

One GTM Server container on your own subdomain. Browser events fire to it first-party, and the server forwards clean events to Meta (Conversions API), Google (Enhanced Conversions) and TikTok (Events API). Ad blockers can't see it because there's no third-party call to block.

Mistake one: no deduplication

Run browser pixel and CAPI in parallel, you should, and events need a shared event_id or Meta counts every purchase twice. We find missing or broken dedup in about half the accounts we audit.

Mistake two: weak event data

CAPI scores your event match quality. Send a bare purchase event and you're under 6.0. Send hashed email, phone, and the fbclid/fbc parameters and you're over 8.0, that's the difference between Meta matching 60% of your buyers and matching 90%.

Mistake three: consent mode ignored

If your CMP fires tags before consent resolves, you're either losing data or breaking compliance, pick your poison. Consent Mode v2 configured properly models the missing data instead of just losing it.

What it costs

A proper build runs A$1,800 one-off on our side, plus around A$40-60/mo for the server hosting. Against a A$10K monthly spend, recovering 25% of lost signal pays for itself fast. Then everything downstream, bidding, audiences, reporting, works on real numbers again.