Floodlight in Server-Side Tag Manager: Consent, Attribution and Practical Checks

Floodlight measures advertising conversions in Campaign Manager 360: recorded actions such as purchases or completed enquiries. Moving the tag into a server container changes the transport path, but does not remove the need to communicate and enforce consent choices. Two separate Google updates matter: server-to-server requests described in July 2025, and improved attribution described in June 2026.

Two dates, two different changes

The Tag Manager release note dated 28 July 2025 announces unconsented server-to-server requests from Floodlight tags to support conversion modelling, which estimates conversions that were not directly observed. The entry dated 22 June 2026 concerns missing browser context: server data can be joined with parallel browser signals when a GCLID is present. GCLID is Google’s advertising click identifier. The second entry describes attribution, meaning the assignment of a conversion to an advertising interaction.

Neither entry supplies a universal deduplication guarantee or a measured ratio of recovered conversions.

Consent signals can reach the server

In Google’s documented setup, the consent management platform supplies choices to the Google tag. The tag includes consent parameters in requests to the server container; the GA4 client, a receiving component in the server container, receives those requests, and compatible Google tags adapt to the signals. Consent Mode therefore is not confined to the browser. Custom senders and custom tags require separate validation: a browser setting cannot automatically govern an unrelated backend request.

There is a material documentation discrepancy. As checked on 24 October 2026, Google’s server-side Consent Mode guide still lists blocked HTTP requests for Floodlight with ad_storage: denied, while the July 2025 release note announces unconsented requests. These statements do not establish one reliable rule for every current container. A release note cannot replace a test of the deployed tag version and actual outgoing traffic.

Storage, advertising data and personalisation

• ad_storage concerns storage for advertising purposes.
• ad_user_data concerns sending user data to Google for advertising.
• ad_personalization concerns personalised advertising.
• analytics_storage concerns analytics storage.

A denied storage signal does not mean that every request is empty or anonymous. Google’s general Consent Mode documentation describes cookieless pings that can contain information such as time and referrer. Click information also depends on the product and redaction settings. The actual payload needs inspection; a missing advertising cookie alone proves little.

Attribution is not deduplication

Joining click context can improve attribution. Preventing a purchase from being counted twice is a different task. Google’s server-side Floodlight setup guide recommends removing equivalent web-container Floodlight tags after successful migration to avoid duplication. The same guide requires a server-side Conversion Linker.

Campaign Manager 360 multi-source conversions provide a separate example: an online tag and an offline Data Manager API upload need matching, unique transaction IDs. That mechanism must not be inferred from the June GCLID announcement. An implementation inventory should identify every sender, conversion activity, counting method and order identifier before a parallel path is enabled.

Practical checks for each consent state

1. Before interaction: a fresh test session establishes the initial consent state before measurement tags run.
2. After acceptance: the check covers the update in Tag Assistant, the request reaching the server, the receiving client, fired tags and outgoing destinations.
3. After refusal: separate cases cover denied advertising storage, denied advertising-data consent and denied personalisation; a single all-denied case can hide mapping errors.
4. After withdrawal: subsequent events and page loads need verification. An earlier accepted state must not remain silently effective.
5. Outside the browser path: the checks also cover custom backend senders, missing consent fields and region-specific defaults. Missing signals must not silently become permission in custom logic.

Each case needs a record of container and tag versions, consent values, event time, trigger result and the fields actually sent. Server Preview and browser network tools cover different parts of the path; responses may also cause browser-side requests. Debug exports should omit real customer data and credentials. A fired tag or successful HTTP response does not prove correct attribution, lawful processing or absence of duplicates in downstream reports.

The legal question follows the entire data path

Server-to-server transport is not a legal exemption. In Germany, storing or accessing information on a device falls under § 25 TDDDG, subject to its statutory exceptions. Any subsequent processing of personal data also needs assessment under data-protection law. The relevant questions include purpose, data fields, recipients, legal basis and retention. A technical granted signal is not proof that valid consent was obtained.