Server-side tracking, analytics and first-party data you can trust

Setting up Google Analytics 4 properly starts with the business questions it must answer, not the tag. They become a measurement plan: which events are key, their parameters and naming, so the data still compares cleanly a year from now.

As Google Analytics and Google Tag Manager consultants, we document the data layer and configure what GA4 leaves unset by default: cross-domain tracking with booking engines or payment gateways, internal traffic and BigQuery export. For seasonal businesses such as hotels and travel, we also compare each season with the last, and each language separately.

• Key events: purchases, bookings, forms, calls or WhatsApp.
• Values, real or estimated, for leads too.
• Custom channel groups, including traffic from AI assistants.

Consent Mode v2 passes each visitor's cookie choice to Google tags. With European Economic Area traffic it is essential in practice: since March 2024, without those signals Google Ads cannot build audiences, run remarketing or personalise ads.

It uses four consent types: ad_storage, analytics_storage, ad_user_data and ad_personalization. Basic mode fires no Google tags until the visitor accepts; Advanced mode loads them anyway and sends cookieless pings for conversion modelling. Because it sends those pings even when the visitor has not accepted, we choose the mode with you and your legal adviser.

In Spain, Article 22.2 of the LSSI-CE and the AEPD cookie guide (May 2024) apply, and consent is still required: the Digital Omnibus proposed in November 2025 would move these rules into the GDPR, but as of October 2026 it is only a proposal.

• 'Reject' on the same layer and level as 'accept', with a similar mechanism.
• No cookie walls without a real alternative; consent grouped by purpose.
• Consent renewed at least every 24 months, as the AEPD recommends.

First-party data is what your company collects directly from customers and contacts, with their permission: forms, purchases, bookings, subscriptions and your CRM. It is the steadiest signal you have, because it sits in your own systems and does not depend on third-party cookies, and it is earned through a clear exchange: something useful in return for the data.

The work starts with CRM hygiene and an identifier that ties the form to the sale. Offline conversions then flow back to Google Ads and Meta, hashed and only for people who consented. Where the sale closes away from the website, as in a professional services firm or a training centre, that teaches campaigns which contacts became clients. A private clinic has a stricter limit: health data is a special category under the GDPR, so events record that someone asked for an appointment, never why, and no clinical information reaches ad platforms. The sequences built on that CRM belong to marketing automation.

A data clean room lets you match your first-party data with a platform's or a retailer's without either side seeing the other's individual records. It only pays off at a certain scale, for example for consumer brands investing in retail media. For most companies, being ready is enough: consistent identifiers, documented consent and connections such as Google Ads Data Manager. Our article on the future of digital marketing explains why first-party data carries more weight.

• CRM hygiene: consistent fields, duplicates resolved and the source of every contact.
• Documented consent: what each person agreed to, when and for what.
• Offline conversions: sales, appointments and qualified leads sent back to the platforms.