How server-side tracking works.
Follow the purchase data.

Browser observations

Show what your site and tags signal or request. Browser restrictions, navigation and consent can affect what is visible.

Server-side conversions

Use supplied order data to prepare and dispatch eligible channel-specific purchases. Server dispatch still requires suitable data, account settings and consent.

First-party collection

Optionally uses a measurement subdomain belonging to your store. It supports collection and does not replace the order feed or platform connection.

Server-side conversions

CookieROAS processes supplied store orders and prepares eligible purchases for Google Ads through the Data Manager API or Meta through the Conversions API. An active connection, sufficient order data and the required consent are necessary.

The order-feed API is the general server connection. CMspecialist also has an FTPS/XML import for order number, timestamp, value and currency. Extra identification data must be supplied separately.

Google Enhanced Conversions

Your store can supply pre-normalized, SHA-256 hashed email addresses and phone numbers for Google Ads. CookieROAS does not read raw contact details from your pages for this purpose.

This requires suitable order data, enabled Enhanced Conversions and consent for advertising data use. Product details, quantities and prices can be supplied optionally. Hashing does not make personal data anonymous.

Click and campaign data

Available click identifiers and UTM parameters can be captured within the configured collection and consent boundaries. Google Ads gclid, gbraid or wbraid references come through a secure server reference from your store; the public snippet does not automatically collect these Google references for dispatch.

Meta uses available fbc and fbp data; fbclid may form the basis of fbc. This Meta connection does not include email or phone enrichment. Observing an identifier does not establish a server dispatch connection for its channel.

Recovering missing purchase measurements

CookieROAS compares orders with available purchase observations. For Google Ads, an eligible order without an observed browser conversion can be sent server-side. Suitable customer identifiers may also enrich an existing browser conversion.

No observation is not proof that nothing was measured. Unclear or conflicting information remains separate. Recovery needs sufficient order and identification data, the right conversion settings and consent. It cannot recover missing consent.

Order identity and duplicate dispatches

Stable order and event identifiers help recognize the same purchase. Dispatch jobs are recorded and temporary failures can be retried without creating a new task every time. For Meta, a shared event_id can connect browser and server events where your setup supports it.

You still need to review existing tags and other senders. Your configuration and the advertising platform determine whether the events are correctly deduplicated.

Order checks and dispatch status

Store orders are linked with available tracking observations and dispatch results. This can reveal amount or currency differences, missing observations and orders needing attention. Reliable order matching is required; mismatched amounts are highlighted rather than automatically corrected.

Observed, sent, failed and unknown are different states. A browser request does not prove platform processing. Even accepted server dispatch does not guarantee campaign attribution.

Consent

The snippet can observe consent updates from supported banners and Google Consent Mode. Adapters include Cookiebot, OneTrust, CookieYes, Complianz and Usercentrics. Dispatch checks required consent and considers the GPC privacy signal where required.

No observed consent is not treated as agreement. CookieROAS does not replace your cookie banner. Observing Consent Mode does not automatically control your existing tags.

First-party connection

Optionally, the snippet and measurement requests can run through a subdomain of your store. A Cloudflare Worker proxy and setup checks support this connection, which needs appropriate domain and Cloudflare configuration.

A store-owned measurement address does not guarantee protection from blockers or data loss. It does not change consent requirements.

Privacy-conscious processing

Measurement processing filters sensitive fields and can restrict URL data. Extended raw capture is a separate setting with mandatory AES-256-GCM encryption. Order recognition uses site-specific derived HMAC identifiers.

Retention settings, per-site access controls and source checks support careful processing. The actual collection depends on your settings. These techniques do not automatically establish legal compliance.

Monitoring

The optional monitoring add-on assesses incoming measurement evidence for established problems. Enabled email notifications can send incident and recovery messages. Missing or limited evidence remains unknown.

Browser requests, dataLayer signals, consent updates and measurement steps are distinct sources. An intention to fire a tag is different from an observed network request. Email needs recipients and working mail configuration.

Browser observations

One installed snippet loads the relevant measurement modules. These can observe dataLayer and gtag events, supported vendor functions and requests through fetch, XHR, sendBeacon and images. Additional browser diagnostics can help investigate interrupted steps.

A dataLayer purchase signal and a network request are separate observations. The snippet cannot fully observe every request in other domains, frames or workers, or prove what an advertising platform ultimately processes.

Google Ads

Server-side purchases, secure click references and optional hashed customer identifiers for Enhanced Conversions.

Meta

Purchase events with available fbc/fbp identifiers and event_id, without email or phone enrichment in this route.

Other channels

Observing Pinterest, TikTok, Microsoft Ads or LinkedIn is different from sending server-side purchases to those channels.