Server-side tracking and DSGVO — how can we set this up in Germany without getting fined?

Don't buy into this agency fairy tale of "we moved it to the server side ditch the cookies, no consent needed." German regulatory authorities (especially in Bavaria and Baden-Württemberg) know this playbook inside out. The moment you read a single byte off an end user's device for marketing, you fall under TDDDG. There's no loophole.

Here's the key technical detail to watch out for: If your server container passes the incoming request's IP address, User-Agent, and referrer header to the ad platform in their raw state, that is legally considered a direct transfer of personal data. You need to strip the last octet of the IP address and generalize timestamps on your own proxy server first.

You have to separate two different laws here: TDDDG Section 25 governs access to data stored on the device (cookies or fingerprinting) and mandates consent. DSGVO Article 6 governs the processing of the resulting personal data (like IP addresses). Even if server-side tracking gives you tighter control under DSGVO, it doesn't get you past the TDDDG hurdle on its own.

edit: I wrote something wrong above, sorry about that.

We set up a similar architecture on an independent server hosted in Frankfurt. We pay about 80 EUR a month for hosting. We only forward data via the server for users who opted in through the consent banner. Our tracking data loss from ad blockers dropped from 28% down to around 9%, but we don't route a single line of data without prior consent.

A consultant pitched us the exact same idea last year, so we disabled the consent banner. Two months later, we got a formal warning (Abmahnung) from a competitor's lawyer; we were hit with a 1.800 EUR legal fee and a cease-and-desist penalty. We reverted right back to the old consent system. In Germany, it's definitely not worth the risk.

Will the server-side container be hosted in a data center within the EU? Do you also plan to match offline customer IDs (like hashed emails) when sending data to ad networks?

id say dont listen to marketers all they care about is the conversion chart. if a fine comes its the legal entity taking the hit. hook the consent mechanism up to the server; if theres no consent the server shouldnt fire requests to third parties either.

If your company employs or contracts an external Data Protection Officer (Datenschutzbeauftragter), it is a legal requirement to have this architectural change reviewed under a Data Protection Impact Assessment (DSFA). Your privacy policy (Datenschutzerklärung) must also be updated to reflect this new data flow.

Exactly, and not many people know this. Everything goes well for the first three months; problems arise in the fourth.

Of course, it varies if your situation is different.

I'd appreciate it if you shared the outcome. Trying to do this alone is the most expensive way.

If I understood correctly, you're saying: Start with a small trial; don't commit to everything at once.

Forgotten test environments are more often the entry point than live systems.

You're right. The harder it is to reverse a decision, the slower you should make it.

Just because everyone does it doesn't mean it's right. If I were you, I'd go this route.

i disagree with you on this point. if permission and scope aren't in wrtiing don't start that test.

that's all, sorry if I went on too long.

I agree with this. Don't rely on a single measure; go layer by layer.

Hope this helps.

I was thinking the same thing. Most time waste accumulates in tasks waiting for approval.

If you have questions, write them; I'll answer as best I can.

I agree with this. Hasty decisions become decisions you have to fix six months later.

Proven by experience.

I agree, and I'd like to emphasize that. Hasty decisions become decisions you have to fix six months later.

Trying to do this alone is the most expensive way.

i didn't know that... payment information changes are never verified through the channel they came from.

correct me if I'm wrong.