GDPR and CCPA Review of the Ad Tracking Stack

Moving tags to your own server changes nothing about their legal basis. Article 82 of the French Data Protection Act governs any read or write on the user's terminal, whoever's domain the request lands on, and CNIL's 40 million euro decision against Criteo in June 2023 turned on the inability to prove consent existed for the identifier, not on where the code ran. Buyers usually call me after a server-side migration has been sold to them as the fix. It is a data quality project with a compliance bill attached. The map: I inventory every identifier leaving the browser or app for an advertising destination and treat each one as its own question. The Meta browser and click identifiers, Google's client and session identifiers, gclid and wbraid, ttclid, msclkid, the hashed email inside enhanced conversions and advanced matching, the order value and item identifiers riding a purchase event, and the raw IP a server-side container forwards by default unless somebody tells it not to. For each: what it identifies, the basis it relies on, the role the recipient holds, where it physically lands, and what happens to it when consent is withdrawn. Roles, which nobody wants to settle: The pixel and conversion API flows to the large platforms are not processor relationships, and the terms you already accepted say so. Parts of this are joint controllership in the Fashion ID sense, which changes your notice, your handling of an access request, and who answers when a user asks for deletion. I write the position in one page, and that page gets reused every time the question comes back. United States layer: Where California, Colorado, Connecticut and Texas traffic is material, the same pixel becomes a sale or a share, and the Global Privacy Control has to be honoured server-side rather than painted onto a preferences page. The enforcement pattern is settled and specific: Sephora, then DoorDash, then Healthline's 1.55 million dollar settlement in July 2025 over article-level signals that suggested a diagnosis. If you publish health-adjacent content, read that last one before we speak. What you get: The identifier map. The basis position per destination. A transfer check on every recipient against its current certification status. A data protection impact assessment where systematic profiling for advertising triggers Article 35. The processor and controller terms needing renegotiation, with names against them. A switch-off list ordered by exposure against measurement loss, so your growth lead can argue with it using numbers. Not included: Consent platform selection or banner implementation, which is separate work and should follow this. Attribution modelling or rebuilding measurement after tags come off: I will tell you what breaks and roughly by how much, I will not rebuild your reporting. Filings, registrations, or acting as your data protection officer. What I refuse: Server-side configurations that recover events for people who refused. That is the request behind half the enquiries I get, it arrives described as deduplication or as modelling, and the answer is no. Fingerprinting-based identity graphs likewise. Google removed the fingerprinting prohibition from its platform policies in February 2025 and the ICO called the change irresponsible when it was announced. A platform policy is not a legal basis, and ePrivacy did not move. Who should not book this: Teams briefed to keep the current data volume. The output reduces what you collect. If the instruction from above is that nothing may drop, the honest sequence is to fix the instruction first, and I would rather say that now than three weeks in.