Why I picked an EU server-side tracking provider for my DACH clients (and why GDPR is about more than server location)

Over the last couple of years, server-side tracking has become the new standard in our industry. Especially for service businesses running Google Ads, it makes a real difference: the more complete the conversion data, the better the bidding strategies can work. Server-side tracking closes a big part of the gap that ad blockers and Safari's cookie limits leave behind.

In this post, I don't want to explain why it matters, but how I chose the provider for my clients.

Most providers look the same, so what is the difference?

When I first looked into server-side tracking, I wanted to find the best provider for my clients. But most providers are very similar: similar plans, similar limits, similar prices.

So I started asking what else separates them, and what actually happens with the data once it runs through their servers.

For me, that is an important question, because almost all of my clients are based in Germany, Austria or Switzerland. Here, data protection (the GDPR, and in Switzerland the revised FADP) is more than a legal requirement. It is a core value for businesses and their customers alike, and for my clients in healthcare it matters even more.

And it's not only about my clients' data. It is also our responsibility to protect the data of their website visitors, people who trust that their data won't end up somewhere it shouldn't. I see it as part of my job to take responsibility for that too.

Many providers are US companies: Why the CLOUD Act matters

Going through the providers, I noticed that most of them are US companies. That is not a problem in itself. But I had an intuitive thought: if the provider is a US company, the data might not be 100% safe in the EU, even if the servers are in Europe. Since this topic is important to me and my clients, I wanted to look into it properly.

And there is something to it: the US CLOUD Act (2018). It can require US companies to hand over data to US authorities, no matter where the data is stored. So a US provider with servers in Frankfurt is still a US provider.

And the CLOUD Act isn’t the only US law at play. A well-known example is the Schrems II ruling. In 2020, the European Court of Justice struck down the EU-US Privacy Shield, because US surveillance laws gave authorities access to European data without effective protection for EU citizens. 

Its successor, the EU-US Data Privacy Framework, has been in place since 2023. It survived a first court challenge in September 2025, but an appeal is now pending at the same court that struck down Privacy Shield. So it holds for now, but I didn’t want my clients’ tracking to depend on it. TAGGRS explains the legal background in more detail in its article on European server-side tracking.

Why I went with TAGGRS: Data sovereignty under EU law

After that, it was clear to me that server location alone is not enough. What matters is that the provider itself is independent from US jurisdiction.

I also like to support local providers where I can. For me, local is not only DACH, but Europe too, and TAGGRS from the Netherlands is local in that sense. On top of that, they offered the most advantages: an EU company under EU law and the GDPR, which gives my clients real data sovereignty. Most other providers can't say that. For my German-speaking clients, that means a lot less to worry about.

One thing worth adding: an EU provider doesn't replace consent. Tracking still only runs with valid consent. What changes is who can access the data afterwards.

A check that should be standard

What I noticed along the way: hardly anyone looks at this. Plans and prices get compared, but who owns the provider and which law it falls under rarely comes up.

In my opinion, that should be a standard check in our industry, especially for businesses that are based in the EU themselves. Three questions are enough:

• Where is the provider headquartered, and who owns it?
• Does it run on European-owned infrastructure, or on a US cloud like Google Cloud, AWS or Azure?
• Can you choose the hosting region and document it for your data protection officer?

More on server-side tracking in general (costs, setup, when it doesn't pay off yet) in my article: Server-Side Tracking: Why It Becomes Essential in 2026.