How to Set Up Cookieless GA4 Tracking with Server GTM

To set up cookieless tracking in GA4, configure Advanced Consent Mode v2 in your web Google Tag Manager (GTM) container, send the visitor's consent state with each request, and route GA4 events through your server-side GTM (sGTM) container. When analytics_storage is denied, GA4 does not read or write Analytics cookies. It can still send cookieless pings for basic measurement and modeling.

Cookieless does not mean consent-free. Consent Mode reads the choice collected by your Consent Management Platform (CMP). It does not provide a consent banner or decide which consent defaults your business should use.

What Are GA4 Cookieless Pings?

Cookieless pings are measurements that Google tags send when analytics_storage is denied in Advanced Consent Mode. Google describes these events as anonymous and non-identifiable. They let Google Analytics 4 receive limited signals without reading or writing Analytics cookies such as _ga.

Cookieless pings still carry limited data. Depending on the event and consent settings, a request can include:

• The consent state for each supported consent type
• A timestamp
• Browser-supplied information such as the user agent and referrer
• Whether the current or previous page included ad-click information
• A random number generated on each page load

Without an Analytics cookie or another permitted persistent identifier, GA4 cannot recognize the browser as the same user across page views in the usual way. If the property meets Google's data thresholds, Google can use these pings for behavioral and conversion modeling. Modeled data is not guaranteed.

Basic vs. Advanced Consent Mode

Cookieless GA4 pings depend on which Consent Mode implementation you choose.

If you block the GA4 tag until a visitor accepts cookies, you have Basic Consent Mode. You will not send cookieless pings for visitors who decline.

What Server-Side GTM Changes

Your web container or Google tag turns on cookieless pings by setting the consent state. The browser then adds that state to the request sent to your server container.

The server container gives you a first-party collection endpoint and a controlled place to process events before forwarding them to GA4. Consent-aware server tags read the consent parameters and change their behavior. They must not override a visitor's denied choice.

The request path looks like this:

1. The CMP records the visitor's choice.
2. The web container updates Google Consent Mode.
3. The Google tag sends the event and consent parameters to your sGTM endpoint.
4. The GA4 client in the server container claims the request.
5. The server-side Google Analytics tag sends the permitted data to GA4.

Google's server-side guidance says Consent Mode only needs to be configured in the web container. The server container receives the result.

How to Set Up Cookieless Tracking in GA4

You need a CMP or consent banner, a GTM web container, a GTM server container, a deployed tagging server, and a GA4 property.

1. Create and Deploy the Server Container

Create a new container in Google Tag Manager and select Server as the target platform. Deploy it behind a first-party HTTPS endpoint such as https://metrics.example.com.

Hardal can host the tagging server for you. Add the server container's Config Key in Hardal, copy the generated Tagging URL, and click Add URL under Admin > Container Settings > Server Container URL in GTM. The Hardal sGTM setup guide covers each screen.

2. Set Consent Mode v2 Defaults Before GA4 Runs

Use a CMP template that supports Google Consent Mode or a custom template built with GTM's consent APIs. Set the default state before any Google tag sends measurement data. Your policy and legal requirements determine the correct defaults and regions.

A direct gtag.js implementation with denied defaults looks like this:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag() { dataLayer.push(arguments); }

  gtag('consent', 'default', {
    analytics_storage: 'denied',
    ad_storage: 'denied',
    ad_user_data: 'denied',
    ad_personalization: 'denied',
    wait_for_update: 500,
  });
</script>

Place the default command before the GTM container or Google tag. wait_for_update gives an asynchronous CMP a short window to return a saved choice before measurement begins.

If you use a GTM consent template, use setDefaultConsentState and updateConsentState, or let the CMP template handle those calls. Google advises against using queued gtag('consent', 'update', ...) commands inside a GTM custom template.

3. Update Consent After the Visitor Chooses

Map each CMP category to the matching Google consent type. Update the state on the same page where the visitor makes the choice and before any page transition.

For a direct gtag.js implementation, an accept-all update looks like this:

gtag('consent', 'update', {
  analytics_storage: 'granted',
  ad_storage: 'granted',
  ad_user_data: 'granted',
  ad_personalization: 'granted',
});

Send denied for every category the visitor rejects. Persist the choice through your CMP so the correct state is restored on the next page.

4. Route GA4 Requests to the Server Container

Open the Google tag in your web container. Under Configuration settings, add server_container_url and set its value to your first-party tagging URL.

For a direct Google tag implementation, use the same parameter in the config command:

gtag('config', 'G-XXXXXXXXXX', {
  server_container_url: 'https://metrics.example.com',
});

Replace the measurement ID and domain with your values. If your Content Security Policy restricts network requests, allow the server container URL for the transport methods your Google tag uses.

5. Configure the GA4 Client and Tag

Server containers include a Google Analytics client. In sGTM Preview, confirm that it claims the incoming GA4 requests. Then create the server-side Google Analytics tag, attach the required trigger, and publish both containers.

Do not create a second consent state in the server container. Confirm that the incoming event carries the state set by the web container and that the server tag respects it.

How to Verify Cookieless GA4 Tracking

Test denied and granted consent separately. Use a private browser window so old Analytics cookies do not distort the result.

1. Open Preview mode for the web and server containers.
2. Clear site data, reload the page, and reject Analytics storage.
3. In Tag Assistant, confirm that analytics_storage is denied before the GA4 event runs.
4. In browser storage, confirm that GA4 did not create or read _ga cookies.
5. In the Network panel, confirm that the request reaches your first-party sGTM domain.
6. In sGTM Preview, confirm that the GA4 client receives the request and the server-side tag applies the denied consent state.
7. Repeat the test after granting Analytics storage. Confirm that the consent state updates and normal GA4 measurement resumes.

Google encodes consent details in request parameters such as gcs and gcd, but their encoding can change. Use Tag Assistant to interpret them instead of hard-coding a parser.

Common Cookieless GA4 Setup Mistakes

• Blocking GA4 until consent: This creates a Basic Consent Mode setup, so denied visitors send no cookieless pings.
• Setting defaults after GTM loads: The first event can leave before the consent state is ready.
• Updating consent after navigation: The update may not apply to the event that triggered the page change.
• Treating sGTM as the consent source: The web container collects and sends consent. The server container enforces it downstream.
• Ignoring Consent Mode v2 fields: ad_user_data and ad_personalization are separate from ad_storage and analytics_storage.
• Calling the whole site cookieless: A CMP may store the visitor's choice in a necessary cookie. Cookieless GA4 means Analytics cookies are not read or written while analytics_storage is denied.

Cookieless GA4 FAQ

Can GA4 Work Without Cookies?

Yes. In Advanced Consent Mode, GA4 can send limited measurements when analytics_storage is denied. It cannot use Analytics cookies to recognize the browser across page views, so reporting and attribution differ from consented measurement.

Are Cookieless Pings Sent When analytics_storage Is Denied?

Yes, if you use Advanced Consent Mode and allow the Google tag to load. In Basic Consent Mode, the tag remains blocked and sends no pings after a visitor denies Analytics storage.

Do You Need Server-Side GTM for Cookieless GA4?

No. Consent Mode can send cookieless GA4 pings without sGTM. A server container adds a first-party endpoint and lets you control how consent-aware tags process and route those events.

Does Cookieless Mean No Consent Is Required?

No. Consent Mode does not replace a CMP or legal review. It changes Google tag behavior after your site communicates the visitor's choice.

Hardal's server-side hosting provides the sGTM runtime and a first-party tagging URL. Create a Hardal account when you are ready to connect your server container.

---

References

• Google: Consent Mode overview
• Google: Set up Consent Mode on websites
• Google: Implement Consent Mode with server-side Tag Manager
• Google: Set up Google Analytics in Tag Manager
• Google: Send data to server-side Tag Manager
• Hardal: Set up Google Tag Manager server-side hosting