Server-side tracking: what it is, what it fixes and what it can't

Server-side tracking means a server you control records the event, such as a click or a payment, instead of JavaScript in the visitor's browser.

The browser can still send the request, but the log entry, the cookie and any forwarding to Google Analytics 4, Google Ads or Meta happen on your infrastructure.

That removes several losses: blocked scripts, the 7-day limit Safari Intelligent Tracking Prevention puts on script-written cookies, and beacons that die with the tab. Consent and cross-device identity stay as they were.

How do browser tags and server records differ?

A server-side record is an event that a machine you operate logs, and a client-side tag is JavaScript running in the visitor's browser.

The two differ in 3 ways: where the code runs, how long the cookie lasts and what each side can see. Cookie lifetime decides the most for a SaaS product.

Safari Intelligent Tracking Prevention (ITP 2.1, shipped in Safari 12.1 on February 21, 2019) caps a JavaScript cookie at 7 days, so a trial that pays on day 14 keeps its source only if something outlasted that cap.

A cookie set in a redirect response keeps the 365-day expiry you chose. The server never sees scroll depth or form fields, and the browser never sees the Stripe charge unless the buyer reaches the thank-you page.

Which four setups share the name?

What stays broken after the move to a server?

Do server-set cookies still meet Safari's rules?

A cookie set in a server response escapes the 7-day script cap, but Safari applies other rules to servers, CNAMEs and link decoration.

Statcounter's September 2026 data puts Safari at 46.38% of US mobile usage, and 18.27% worldwide, so a Safari cap touches a large share of mobile traffic in the US.

WebKit's November 2020 post cites a study that found 1,762 websites using CNAME cloaking for 56 trackers. WebKit's tracking prevention page adds that ITP detects third-party IP address cloaking too, with the same 7-day cap, and leaves that term undefined.

A CNAME to another subdomain of your site is not capped. Google's custom domain guide, last updated on June 27, 2025, says a server container left on its default provider domain can set JavaScript cookies only.

Stape's Cookie Keeper power-up, per its documentation, restores cookies that Safari 16.4 and later expire after 7 days.

Does recording on a server remove the need for consent?

Consent is required in many setups, because a server does not remove the legal question. The EDPB's Guidelines 2/2023 reached version 2.0 on 7 October 2024, after a consultation that ran from 16 November 2023 to 18 January 2024.

They treat tracking links and tracking pixels as falling under Article 5(3) of the ePrivacy Directive (2002/58/EC). Sending the link to the device counts as storage, and collecting the identifier counts as gaining access.

Being covered does not automatically require consent, since exemptions are assessed case by case. UK and US state rules differ, so take legal advice on your own setup.

TrackRev's pixel waits for grantConsent() when data-requires-consent is set, and in our setup the redirect itself runs no script.

What does a server container cost?

A Google Cloud Run server container costs about $45 per server a month, and Google recommends 2 servers, so the floor is $90 a month or $1,080 a year.

Stape Pro costs $17 a month on yearly billing for 500K requests, and Stape Free covers 10K requests.

Two Cloud Run servers cost $880 a year more than Stape Pro at $200 a year, per Stape's pricing page.

For source-to-payment attribution alone in our experience building TrackRev I would skip the container at first, since the redirect and the webhook cover the click and the charge, the events that decide the answer.

When is browser-side tracking enough?

Browser-side tracking is enough when the payment lands within 7 days of the click and no partner is paid from the result.

Safari 12.1 and later cap script-written cookies at 7 days, or 1 day after link decoration under ITP 2.2 (April 24, 2019).

For example, a trial that converts on day 14 needs a response cookie, because Google Analytics 4 files the charge under Direct.

Meta Ads and Google Ads optimization needs both sides: the tag captures the session and the Stripe backend sends the conversion.

How do you set this up for a SaaS product?

How do you log the click and set the cookie?

A logged click is a row your own server writes before the landing page loads, and it takes 2 of the 6 steps. First (step 1), put a redirect on a domain you own.

Share links like go.example.com/spring-launch, and tag every one, since an untagged click logs a blank channel. The route writes a click row with visitor ID, link, timestamp, user agent and referer, then answers 302.

Node.js crypto.randomUUID() returns a version 4 UUID for the visitor ID. A cache may reuse a 301 without asking again, so a repeat click behind a 301 can skip your server.

Second (step 2), send the visitor cookie on the redirect with SameSite=Lax, Secure and a Domain on your registrable domain, so subdomains can read it.

MDN's Set-Cookie reference says Lax also sends it on cross-site top-level navigations such as an email click, and Strict does not. Append the ID to the destination as vid and accept only UUID-shaped values on the landing page.

1import { randomUUID } from "node:crypto";2 3app.get("/:slug", async (req, res) => {4  const link = await db.links.findBySlug(req.params.slug);5  if (!link) return res.redirect(302, "https://www.example.com");6 7  const vid = req.cookies.vid ?? randomUUID();8 9  await db.clicks.insert({10    linkId: link.id,11    visitorId: vid,12    userAgent: req.get("user-agent"),13    referer: req.get("referer"),14    at: new Date(),15  });16 17  res.cookie("vid", vid, {18    maxAge: 365 * 24 * 60 * 60 * 1000, // Express takes milliseconds19    domain: ".example.com",20    sameSite: "lax",21    secure: true,22    httpOnly: true,23  });24 25  const target = new URL(link.destination);26  target.searchParams.set("vid", vid);27  res.redirect(302, target.toString());28});

How do you bind the ID to the signup and the payment?

A bound ID is a visitor ID saved on the user row and on the Stripe payment, and it takes 2 more of the 6 steps.

Third (step 3), read the ID in the request that creates the account and save it beside the email, since a script cookie may be gone when someone signs up 8 days after the click.

For example, a user who clicked on May 1 and signed up on May 9 still carries the May 1 visitor ID. A phone click and a laptop purchase share no ID until a login or email joins them.

Fourth (step 4), pass the ID to Stripe Checkout as client_reference_id or in metadata. Both fields come back on the Stripe Checkout Session in the checkout.session.completed event, the same event Stripe retries for up to 3 days.

The Stripe metadata attribution setup post has the field mapping.

How do you read charges and test the result in Safari?

Fifth (step 5), read charges through a Stripe webhook. Verify the Stripe-Signature header against the raw request body and return a 2xx before any heavy work. Stripe retries a failed delivery for up to 3 days in live mode.

Stripe's libraries reject a timestamp more than 5 minutes old by default.

Store each Stripe event ID, since the same event can arrive twice and out of order, and serve the endpoint over TLS 1.2 or 1.3, the only versions Stripe supports.

Sixth and finally (step 6), test in Safari. Click a tracked link in Safari 17 or later and read the cookie's expiry on the Storage tab of Safari Web Inspector.

A date 365 days out means the response cookie survived, and a date 7 days out means something capped it. The Safari ITP attribution post covers the remaining rules.

How does TrackRev record clicks on the server?

TrackRev is SaaS affiliate software that logs every click on our own redirect server, and we built TrackRev with link tracking and revenue attribution inside it.

A visit to a tracked link reaches TrackRev's redirect first, which logs the click, sets a 365-day visitor-ID cookie and forwards the visitor with a 302 response. A pixel on the landing page then reads the _vid parameter.

Revenue attribution starts at $29 a month on Indie, billed monthly for 1 site. Payments sync from Stripe, Paddle Billing, Polar, Lemon Squeezy, Creem and Dodo Payments. A team that needs only a click log can use a standalone tracker.