At least 68,262 websites run Google Tag Manager’s server-side tagging container as of August 2026, according to BuiltWith’s technology-usage tracker. That is a floor rather than a full count: unlike a client-side pixel, a server-side container sits on the site owner’s own subdomain, so it is harder for any outside scanner to detect. The number matters because it marks the point where server-side tracking stopped being a large-publisher experiment and became a normal part of the analytics stack for tens of thousands of ordinary websites.
How many websites run server-side tracking?
BuiltWith’s live crawl currently counts 68,262 websites actively running Google Tag Manager’s server-side tagging container, plus 26,579 additional sites where the technology was detected in the past but is no longer live, for roughly 94,800 sites that have set one up at some point. Of the currently live sites, 21,178 are in the United States, meaning the other 47,084 are spread across the rest of the world.
Figure 1: Live GTM server-side tagging containers detected worldwide. Source: BuiltWith technology tracker, live snapshot, August 2026.
Figure 2: Server-side GTM detections by region and status. Source: BuiltWith, live technology tracker, August 2026.
Warning
BuiltWith’s numbers come from an ongoing web crawl, not a survey, and the total pool of sites it scans is not published, so treat this as a live, rolling count rather than a fixed historical fact. Because a server-side container runs on a first-party subdomain the site owner controls, some installations will not surface in any outside scan at all, which means the true adoption figure is very likely higher than what any crawler can see.
The direction is the more reliable part of this data than any single snapshot: a technology that once required a dedicated engineering team and a Google Cloud project now shows up on tens of thousands of ordinary marketing sites, most of them well outside the Fortune 500.
Why are businesses moving tracking off the browser?
The short answer is signal loss. In IAB’s State of Data 2024 report, based on a survey of more than 500 advertising and data decision-makers at brands, agencies, and publishers, 95% expected continued signal loss or new privacy legislation through 2024 and beyond. Seventy-two percent anticipated decreased access to browser history, real-time signals, and location data, and 82% said the makeup of their organization had already been affected by signal loss.
More than half of respondents expected the resulting measurement gaps to make it harder to track conversions, attribute performance to a channel, and measure return on ad spend. Server-side tracking does not eliminate that gap. It changes where the data collection point sits, moving it from a script the browser can block to a server-to-server call the site owner controls, which keeps first-party data flowing even when a browser refuses to load a third-party script.
A compliant cookie policy generator is the other half of this fix: server-side collection still needs a public, current policy that discloses what is collected and who it is shared with, which is exactly the document most sites forget to update when they change how tracking works under the hood.
Companies are not chasing server-side tracking out of curiosity. They are responding to a browser landscape that increasingly will not carry a third-party cookie at all.
Which browsers block third-party cookies by default?
Safari’s Intelligent Tracking Prevention has blocked third-party cookies by default since 2020, Firefox’s Enhanced Tracking Protection has done the same since 2019, and Brave blocks them by default through its built-in Shields. Chrome and Microsoft Edge, which together carry the large majority of global browser traffic, still allow third-party cookies with an opt-out in privacy settings rather than a default block.
Figure 3: Approximate share of global browser traffic by default third-party cookie policy. Source: StatCounter Global Stats, browser vendor policy pages; rolling monthly data, figures are approximate.
| Browser | Approx. global share (2026) | Blocks 3rd-party cookies by default | Default protection |
|---|---|---|---|
| Chrome | ~65% | No (opt-out in settings) | Privacy Sandbox (most APIs being retired) |
| Safari | ~18% | Yes, since 2020 | Intelligent Tracking Prevention |
| Edge | ~5% | No (opt-out in settings) | Tracking prevention, balanced by default |
| Firefox | ~3% | Yes, since 2019 | Enhanced Tracking Protection |
| Brave | ~1% | Yes, by default | Shields |
Source: StatCounter Global Stats (approximate, rolling); Apple WebKit, Mozilla, and Brave policy documentation.
A pixel that depends only on a third-party cookie already fails silently for roughly a fifth of global traffic before any consent banner is even shown, which is the practical case for collecting first-party data server-side rather than relying on the browser alone. For the full picture of how quickly that reliance is fading, see our third-party cookie phase-out numbers for 2026.
What happened to Chrome’s cookie deprecation plan?
Chrome never finished deprecating third-party cookies. Google confirmed on April 22, 2025 that it would not ship a separate consent prompt for third-party cookies, and that the cookies would stay on by default with existing browser settings as the only opt-out path. Six months later, on October 17, 2025, Google went further and announced it would retire most of the Privacy Sandbox APIs built to replace third-party cookies, including Topics, Protected Audience, and Attribution Reporting, citing low adoption of the replacement APIs alongside continued regulatory pressure.
Figure 4: Chrome’s reversal on third-party cookie deprecation and the Privacy Sandbox wind-down. Source: Google Privacy Sandbox announcements, 2024 to 2026.
The practical result is a split web rather than a clean deprecation: Chrome and Edge keep third-party cookies alive with an opt-out that few users touch, Safari, Firefox, and Brave keep blocking by default, and the Privacy Sandbox APIs that were supposed to bridge the two are being switched off rather than finished. That split, not a hard cutoff date, is what keeps server-side and first-party data collection on marketing teams’ roadmaps.
Does server-side tracking still require consent?
Moving a tag from the browser to a server changes where data is collected, not whether consent law applies to it. The FTC’s 2023 settlement with GoodRx, a 1.5 million dollar civil penalty, and its settlement with BetterHelp, 7.8 million dollars returned to consumers, both centered on sensitive health data shared with ad platforms through tracking integrations the companies had not properly disclosed to users. Server-side integrations were part of both cases; the FTC’s position was that a data flow does not need to be visible in a browser’s network tab to count as sharing.
Figure 5: The consent test a server-side integration has to pass, regardless of where the tag runs. Source: synthesized from FTC GoodRx and BetterHelp settlement findings.
Regulators have made clear that the technical location of a tracking script is not the test that matters. What matters is whether the data collected, wherever the request originates, is disclosed and consented to the way the law requires.
How does server-side tracking compare to client-side tracking?
The two approaches solve different parts of the same problem, and most mature setups now run both rather than replacing one with the other.
Figure 6: Rough positioning of common tracking methods by setup complexity and data reliability. Editorial synthesis, not a survey result.
| Factor | Client-side tracking | Server-side tracking |
|---|---|---|
| Blocked by Safari/Firefox/Brave defaults | Yes, largely | Partially avoided (first-party request) |
| Blocked by ad blockers targeting known domains | Often | Rarely, if hosted on the site’s own subdomain |
| Setup and maintenance effort | Low | Higher (server, DNS, ongoing config) |
| Still requires disclosed, valid consent | Yes | Yes |
Neither column changes the underlying legal requirement in the last row. Server-side tracking recovers data that browser blocking would otherwise lose; it does not change what a business is allowed to collect without telling visitors first. The same shift is playing out on the ad-buying side too, where our cookieless advertising market data for 2026 covers how targeting itself is adapting alongside measurement.
The Bottom Line
More than 68,000 websites now run a server-side tagging container, and that count is a floor rather than a ceiling because the setup is built to be hard to detect from outside. The reason is straightforward: roughly a fifth of global browser traffic blocks third-party cookies by default, Chrome abandoned its own replacement APIs rather than finishing them, and 95% of advertising decision-makers expect signal loss to keep getting worse. None of that changes the consent requirement. The FTC’s GoodRx and BetterHelp settlements show that a data flow moved server-side is still a data flow, and it still needs a current, accurate cookie policy and valid consent behind it.
Frequently Asked Questions
How many websites use server-side tracking? At least 68,262 live websites run Google Tag Manager’s server-side tagging container, according to BuiltWith’s technology tracker (August 2026). Because server-side containers sit on the site owner’s own subdomain rather than loading a public third-party script, this is a floor, not a ceiling; BuiltWith itself lists 26,579 additional sites that used the setup historically and no longer show as live.
Why are businesses moving tracking off the browser? Mainly signal loss. In IAB’s 2024 State of Data survey of over 500 advertising and data decision-makers, 95% expected continued signal loss or new privacy legislation, 72% anticipated reduced access to browser history and location data, and 82% said signal loss had already changed how their organization is structured.
Do Safari and Firefox block third-party cookies by default? Yes. Safari’s Intelligent Tracking Prevention and Firefox’s Enhanced Tracking Protection have blocked third-party cookies by default since 2020 and 2019 respectively, and Brave blocks them by default through its built-in Shields. Chrome and Edge, which together carry most of the global browser share, still allow third-party cookies with an opt-out.
Is server-side tracking exempt from consent requirements? No. Moving a tag from the browser to a server changes where data is collected, not whether consent law applies. The FTC’s 2023 settlements with GoodRx (1.5 million dollars) and BetterHelp (7.8 million dollars) both involved server-side data shared with ad platforms without the disclosed consent required for health information.
Sources and References
- BuiltWith. (2026). “GTM Server Side Tagging Usage Statistics.” Live technology-detection tracker, snapshot August 2026.
- IAB. (2024). “State of Data 2024: How the Digital Ad Industry Is Adapting to the Privacy-by-Design Ecosystem.” Survey of 500+ advertising and data decision-makers.
- StatCounter Global Stats. (2026). Browser Market Share Worldwide. Rolling monthly data.
- Apple WebKit. Intelligent Tracking Prevention overview and policy documentation.
- Google Privacy Sandbox. (2025). Third-party cookies update and Privacy Sandbox API retirement announcement.
- Federal Trade Commission. (2023). GoodRx enforcement action, 1.5 million dollar civil penalty.
- Federal Trade Commission. (2023). BetterHelp enforcement action, 7.8 million dollars returned to consumers.
Note: All figures verified as of August 2026. Browser share, technology-adoption counts, and Privacy Sandbox timelines are rolling or forward-looking, so headline figures here are refreshed at least twice a year.
