Server-Side Tracking in a Cookieless World — The Implementation Guide

// Server-side event pipeline
const trackingPipeline = {
  // Step 1: Collect events on your server
  collect: async (event: TrackingEvent) => {
    // Set first-party cookie with server (HttpOnly, Secure, SameSite)
    // This survives ITP because it's a true first-party, server-set cookie
    const sessionId = getOrCreateSession(event.request);
    
    return {
      ...event,
      sessionId,
      userId: resolveUserId(event.request),
      timestamp: Date.now(),
      serverTimestamp: true,
    };
  },
 
  // Step 2: Enrich with server-side data
  enrich: async (event: TrackingEvent) => ({
    ...event,
    userAgent: event.request.headers["user-agent"],
    ip: hashForPrivacy(event.request.ip),  // Hashed, never stored raw
    geo: await geoLookup(event.request.ip),
    customerData: await lookupCustomer(event.userId),
  }),
 
  // Step 3: Fan out to destinations
  send: async (event: EnrichedEvent) => {
    await Promise.allSettled([
      sendToGA4(event),
      sendToMeta(event),
      sendToKlaviyo(event),
      sendToDataWarehouse(event),
    ]);
  },
};

async function sendToGA4(event: EnrichedEvent) {
  const payload = {
    client_id: event.sessionId,
    user_id: event.userId || undefined,
    events: [{
      name: mapEventName(event.type),
      params: {
        session_id: event.sessionId,
        engagement_time_msec: event.engagementTime || 100,
        page_location: event.url,
        page_title: event.pageTitle,
        // E-commerce specific
        ...(event.type === "purchase" && {
          transaction_id: event.orderId,
          value: event.revenue,
          currency: "USD",
          items: event.items?.map(formatGA4Item),
        }),
      },
    }],
  };
 
  await fetch(
    `https://www.google-analytics.com/mp/collect?measurement_id=${GA4_ID}&api_secret=${API_SECRET}`,
    { method: "POST", body: JSON.stringify(payload) }
  );
}

async function sendToMeta(event: EnrichedEvent) {
  if (!["purchase", "add_to_cart", "initiate_checkout"].includes(event.type)) return;
 
  const payload = {
    data: [{
      event_name: mapMetaEventName(event.type),
      event_time: Math.floor(event.timestamp / 1000),
      event_id: event.eventId,  // For deduplication with pixel
      action_source: "website",
      user_data: {
        em: event.customerData?.email ? hash(event.customerData.email) : undefined,
        ph: event.customerData?.phone ? hash(event.customerData.phone) : undefined,
        fn: event.customerData?.firstName ? hash(event.customerData.firstName) : undefined,
        ln: event.customerData?.lastName ? hash(event.customerData.lastName) : undefined,
        client_ip_address: event.ip,
        client_user_agent: event.userAgent,
        fbc: event.cookies?.fbc,   // Facebook click ID
        fbp: event.cookies?.fbp,   // Facebook browser ID
      },
      custom_data: {
        value: event.revenue,
        currency: "USD",
        order_id: event.orderId,
      },
    }],
  };
 
  await fetch(
    `https://graph.facebook.com/v18.0/${PIXEL_ID}/events?access_token=${ACCESS_TOKEN}`,
    { method: "POST", body: JSON.stringify(payload) }
  );
}

// Generate a unique event ID on the server
const eventId = `evt_${orderId}_${Date.now()}`;
 
// Pass the same event ID to both:
// 1. Server-side API call (includes event_id)
// 2. Client-side pixel (inject event_id into the dataLayer)
 
// Meta and GA4 will deduplicate based on event_id
// Result: Each conversion counted exactly once

// Set via your server — NOT via JavaScript
function setTrackingCookie(res: Response, sessionId: string) {
  res.setHeader("Set-Cookie", [
    `_sid=${sessionId}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=31536000`,
    // HttpOnly: Not accessible to JavaScript (survives ITP longer)
    // Secure: HTTPS only
    // SameSite=Lax: Sent on top-level navigations
    // Max-Age=1year: Browser may cap this, but server-set cookies get more time
  ]);
}