GTM Server Side - Extend Your Cookie Lifetime with IP Alignment

2025-04-25

By: John Hansfeldt

Analytics Specialist

ITP, or Intelligent Tracking Prevention, is a feature in Apple’s Safari browser designed to protect user privacy by limiting how long cookies can be used for tracking. Over time, ITP has become more restrictive, now targeting even consented first-party cookies set via JavaScript, not just third-party ones.

One of the key challenges is that cookies set by tracking scripts often expire after just 24 hours. This makes it harder to follow user behavior across sessions, reducing the accuracy of campaign measurement and attribution. To counter this, many companies have turned to server-side tagging solutions with the goal of regaining control over cookie duration and improving data quality.

However, these setups are frequently misconfigured. A common issue is that the server-side implementation isn’t properly aligned with the website’s main domain and IP address, which means cookies may still be treated as less trustworthy and expire quickly. One critical but often overlooked factor is IP alignment, without it, even a well-intentioned server-side setup may fall short of its goal.

Hosting GTM Server-Side on a Subdomain

Historically, businesses commonly implemented Google Tag Manager Server-side (GTMss) on a subdomain, such as gtm.example.com. At the time, this method satisfied early ITP requirements for maintaining extended cookie lifespans and provided a straightforward way to deploy server-side tracking.

However, newer iterations of ITP have classified cookies set on subdomains as less trustworthy. This change significantly shortens cookie lifespans, negatively affecting attribution and data quality.

Google now advises transitioning GTMss implementations to path-based configurations (e.g., example.com/gtm). A path-based setup naturally positions tracking requests in a same-orgin context, typically ensuring IP alignment and resolving cookie lifespan issues. However, careful configuration is necessary to ensure tracking requests are routed through the same IP as the main domain.

What Is IP Alignment?

IP alignment ensures tracking requests sent via GTMss share the same public-facing IP address as your main website. ITP considers IP addresses aligned when the first two octets match (e.g., 192.168.x.x). This alignment is critical for maintaining cookie lifespan, thereby preventing premature expiration caused by browser restrictions.

In the example above the IPs would be considered aligned.

Implementing Google Tag Manager Server-Side with Same-Origin

Hosting GTMss with same-origin means that it is hosted on the main domain of the website. It means configuring GTMss so that it is reached by use of a path-based setup like example.com/metrics instead of a subdomain. A path-based setup ensures that cookies set by the server-side setup are recognized as first-party and helps align with the website’s IP address.

The two common technical solutions to achieve IP alignment include:

Load Balancers: These route incoming tracking requests through the main website’s IP, handling path-based URL rewrites (e.g., /metrics) to direct traffic seamlessly to GTMss.

Content Delivery Networks (CDNs): Like load balancers, CDNs help route tracking requests via the same public IP. Additionally, CDNs provide global performance optimization, security enhancements, and reliable traffic management.

Both approaches function as intermediaries, ensuring tracking data remains first-party.

Choosing between these solutions depends on your existing infrastructure, technical capabilities, and cost considerations. Leveraging your current CDN or load balancer infrastructure typically provides the most efficient solution.

As shown in the diagram below, both solutions act as a middleman between the user’s browser and your website and tagging server, enabling IP alignment and first-party treatment of tracking data.

It is important to note that there is no one-size-fits-all solution. The optimal approach depends on your infrastructure, budget, and technical expertise. Some companies may find load balancers suitable, while others might benefit more from CDNs. In both cases, it’s typically necessary that your existing web server is already routed through the load balancer or CDN to allow proper IP alignment for GTMss.

Verifying Your GTM Server-Side Setup for IP Alignment

The easiest way to check if your GTMss IP align with your websites, is to check the requests in the networks tab:

Check the GTMss Request IP: Open your browser’s developer tools (e.g., Chrome DevTools) and find a request that you are routing through the server, such as a GA4 request. Look at the Remote Address in the network tab and take note of the IP.

Check the Website’s Server IP: While still in network requests, filter by Doc type and find the file that loaded the website content (common names for these are index.html, your-website.html or the websites domain name). Check its Remote Address.

Compare the IP Addresses: If the first two octets (XXX.XX.) of the IPs match, they are considered aligned, meaning tracking requests will be treated as first-party, assuming the rest of your setup is correct. In the examples above, the IPs are aligned, ensuring tracking remains unaffected by ITP. If they don’t match, your setup is likely impacted by browser restrictions, leading to shorter cookie lifespans.

Key Takeaways

By adapting to these new requirements, businesses can maintain robust tracking capabilities, improve marketing performance, and stay ahead in an evolving privacy-first landscape. Transitioning to a GTMss setup behind the same IP isn’t just a technical adjustment, it’s a strategic move to future-proof your analytics and marketing efforts.