Skip to main content
Educational Resource

Web Tracking & Privacy:
A Complete Guide

Understanding GDPR, Consent Mode v2, first-party data, and how modern tracking technologies balance advertising effectiveness with user privacy.

Privacy Regulations Overview

Three major regulatory frameworks govern how websites can track user behavior. Each has different requirements, scopes, and enforcement mechanisms.

GDPR (EU)

General Data Protection Regulation (2018) — Applies to: EU/EEA residents

Key Requirements

  • Explicit consent required before placing non-essential cookies or tracking pixels
  • Users must be able to withdraw consent as easily as they gave it
  • Data controllers must document lawful basis for processing personal data
  • Right to erasure (right to be forgotten) applies to tracking data
  • Data Protection Impact Assessments required for high-risk processing
Penalties: Up to 4% of annual global turnover or €20M, whichever is higher
Official source

ePrivacy Directive (EU)

Directive 2002/58/EC (Cookie Law) (2002 (updated 2009)) — Applies to: All electronic communications in the EU

Key Requirements

  • Prior informed consent required before storing cookies on user devices
  • Applies to all tracking technologies, not just HTTP cookies (pixels, fingerprinting, local storage)
  • Exemptions only for strictly necessary cookies (session, security, load balancing)
  • Each EU member state has national implementation with enforcement variations
Penalties: Varies by member state (e.g., CNIL in France has issued €150M+ fines)
Official source

CCPA / CPRA (California)

California Consumer Privacy Act / California Privacy Rights Act (2020 / 2023) — Applies to: California residents (businesses meeting revenue/data thresholds)

Key Requirements

  • Right to know what personal information is collected and how it is used
  • Right to opt out of the sale or sharing of personal information
  • "Do Not Sell or Share My Personal Information" link required on websites
  • Sensitive personal information requires opt-in consent for specific uses
  • Businesses must honor Global Privacy Control (GPC) browser signals
Penalties: Up to $7,500 per intentional violation
Official source

Tracking Methods Compared

Web tracking has evolved from third-party cookies to server-side APIs. Each method has different privacy implications, effectiveness, and regulatory requirements.

MethodPrivacy RiskStatus (2026)Description
Third-Party Cookies
High
Blocked in Safari, partitioned in FirefoxCookies set by domains other than the website being visited, used for cross-site tracking and retargeting. Safari blocks them all and Firefox confines each to the site that created it. Chrome still allows them by default.
First-Party Cookies
Medium
Active (with limitations)Cookies set by the website domain itself. In Safari, cookies written by JavaScript expire after 7 days, or after 1 day when the visitor arrives from a tracker-classified site via a link with a query string. Cookies set by your own server in an HTTP response are not covered by those caps, unless the subdomain resolves through another company's hostname (CNAME cloaking), which WebKit caps at 7 days. Chrome limits any cookie lifetime to 400 days.
Client-Side Pixels
Medium-High
Active (reach varies by audience)JavaScript tags (Meta Pixel, Google Tag) running in the browser. Ad blockers can stop them from loading (29.5% of internet users aged 16 and over use one, per GWI Q2 2025), and they depend on the cookie rules of each browser.
Server-Side Tracking
Low-Medium
ActiveEvents sent from a server to advertising platforms, so the conversion no longer depends on a script running in the visitor's browser. Data is processed in a controlled server environment where PII can be hashed or redacted before transmission. Still requires a lawful basis, such as consent, under GDPR.
Conversion APIs (CAPI)
Low-Medium
Active (recommended)Platform-specific server-to-server APIs (Meta CAPI, Google Enhanced Conversions, TikTok Events API, Taboola S2S, Microsoft Ads Offline Conversions) that send hashed first-party data directly to ad platforms from your server or backend.

The Shift to First-Party Data

The deprecation of third-party cookies and stricter privacy regulations have accelerated the transition to first-party data strategies. First-party data is information collected directly from your audience — purchase history, email addresses, site behavior — with their knowledge and consent.

Why First-Party Data Matters

  • Higher accuracy — Data comes directly from your users, not inferred from cross-site behavior
  • Regulatory compliance — Collected with explicit consent under your privacy policy
  • Usable match keys — Meta and Google both accept hashed email and phone number as identifiers for server-side events, which does not depend on a third-party cookie
  • Less exposed to third-party cookie blocking — Not subject to the Safari and Firefox rules for cross-site cookies, although script-written first-party cookies are still capped in Safari

How Server-Side Tracking Enables First-Party Data

Server-side tracking processes conversion events on your server before sending them to ad platforms. This architecture enables several privacy-respecting features:

  • PII hashing — Email and phone are SHA-256 hashed on your server before transmission
  • Data minimization — Only necessary data fields are forwarded to each platform
  • Consent enforcement — Server logic can check consent status before sending any data
  • Audit trail — Server logs provide a verifiable record of what data was sent where

Sources

Figures on this page come from the publications below. For measured browser share, see our third-party cookie statistics. This guide is educational and is not legal advice.

Glossary of Key Terms

PII (Personally Identifiable Information)
Data that can identify a specific individual — email, phone, name, IP address, device IDs. Must be hashed (SHA-256) before sending to ad platforms.
Hashing
A one-way cryptographic function (typically SHA-256) that converts PII into a fixed-length string that cannot be reversed. Ad platforms match hashed values without seeing raw data.
Consent Management Platform (CMP)
A tool that manages cookie consent banners, stores user preferences, and signals consent status to tracking tags (e.g., Cookiebot, OneTrust, Didomi).
Data Minimization
GDPR principle requiring organizations to collect only the minimum personal data necessary for a specific purpose — no more than needed.
ATT (App Tracking Transparency)
Apple's iOS 14.5+ framework requiring apps to request explicit permission before tracking users across other apps and websites. Adjust measured a 38% global opt-in rate in Q1 2026. It governs apps, not how a browser handles cookies.
ITP (Intelligent Tracking Prevention)
Safari's privacy feature that blocks third-party cookies, caps the lifetime of cookies and other storage written by JavaScript, and restricts cross-site tracking mechanisms.
Global Privacy Control (GPC)
A browser-level signal that communicates a user's preference to opt out of data selling/sharing. Required to be honored under CCPA/CPRA.
EMQ (Event Match Quality)
Meta's score from 0 to 10 for how effectively the customer information in your server events can match them to Meta accounts. Meta says high-quality matching may improve attribution and performance, but publishes no score-to-cost figures.

Need Privacy-Compliant Server-Side Tracking?

SignalBridge handles PII hashing, consent enforcement, and server-side event delivery automatically — no GTM expertise required.