Short answer: tracking happens in the visitor's browser, and the browser is an increasingly hostile place. Visitors say no to cookies, ad blockers stop the scripts and Safari deletes cookies after seven days. Consent Mode, server-side tagging and Conversions API help you lose fewer of the signals you're allowed to collect. Nothing more.
Why do ad platforms show fewer conversions than you actually get?
Think of a conversion as a letter. The visitor clicks your ad, buys something, and a script in the browser writes to Google or Meta: “the person who clicked this ad just bought.” To match the letter to the click, the script remembers the visitor with a cookie.
The letter can go missing in three places:
- Cookie consent. If the visitor says no in your banner, the script isn't allowed to set the cookie. In my accounts, somewhere between half and four in five visitors say yes, depending on the banner. The rest are invisible to the platform, even though they buy just as much.
- Ad blockers. They block Google's and Meta's tracking scripts too. Studies vary too much for me to give you a number, but you'll notice it on desktop and in tech-savvy B2B sectors.
- Safari and iOS. Apple's Intelligent Tracking Prevention limits cookies set by scripts to seven days, and in some cases to a single day. If someone comes back and buys on day twelve, the link to the ad is gone. In many European markets, iPhones make up a large share of mobile traffic.
In the accounts I've compared, the platform often sees between half and three quarters of the conversions in the order system. So the report looks worse than reality. More seriously, the algorithm that sets your bids can only optimise for what it can see.
What is Google Consent Mode v2, in plain English?
Consent Mode lets your site tell Google's tags what the visitor chose in the cookie banner. Version 2 became mandatory in March 2024 for anyone using Google's advertising features with visitors in the European Economic Area. It adds two signals to the existing ones for advertising and analytics cookies: whether Google may use the visitor's data for advertising (ad_user_data) and whether ads may be personalised (ad_personalization).
There are two modes. Basic mode: if the visitor says no, Google's tags don't load at all. Nothing is sent. Simple and clean, but you lose all data on that visitor.
Advanced mode: the tags load, but after a no they only send anonymous “pings” without cookies or identifiers: that a page loaded, that a conversion happened, from which country, roughly when. Nothing that ties the event to a person. Google combines the pings with patterns from the people who said yes to model how many conversions the people who said no probably made, and adds those to your reports and bidding.
Keep your expectations realistic: modelling is a statistical estimate, not a measurement. Google needs a certain volume before it kicks in, so an account with 20 conversions a month often sees no effect, and even large accounts don't recover the whole gap. You can't build audiences from those people either. That's the whole point.
What is server-side tagging, and what does it fix?
Server-side tagging (for Google, that's a server container in Google Tag Manager) moves your tracking tags from the visitor's browser to a server you control, on a subdomain such as ss.yoursite.com. The browser sends a signal to your server, which then talks to Google, Meta and LinkedIn.
It gives you three things:
- Longer cookie life in Safari. A cookie set by your own server isn't treated as harshly as one set by a script, so the link between click and purchase survives longer than seven days.
- Fewer lost signals. The traffic goes to your domain, not to google-analytics.com or facebook.com, so some ad blockers let it through. Not all of them (the more aggressive ones catch on), but some.
- Control over what gets sent. You can strip out fields and see exactly what each platform receives. A plus for privacy, not a minus.
What it doesn't do is get around consent. If the visitor says no, your server has to respect that. Server-side tagging is a pipe, not a loophole. I run it myself on adcoacher.se, so I know what it costs: Google's documentation estimates roughly $40 per server instance per month and recommends three instances in production. Budget for it as an ongoing cost, not a one-off.
What is the Conversions API on Meta and LinkedIn?
Conversions API (CAPI) is the platforms' own version of the same idea: instead of Meta's pixel in the browser reporting the purchase, your server sends the event straight to Meta. LinkedIn has its own version with the same name, and Google has Enhanced Conversions: your site sends a hashed email address (turned into an unreadable code) and Google matches it to a signed-in user.
Meta recommends running the pixel and CAPI side by side, with an event ID that merges the duplicates. That's where a lot of setups go wrong: without deduplication every purchase is counted twice, and the report suddenly looks fantastic. Shopify, WooCommerce and similar platforms have ready-made integrations that handle this; use them.
Same caveat as before: if the visitor says no to marketing cookies, you can't send their purchase and email address to Meta just because it goes through your server instead of the browser. It's the same personal data, just taking a different route.
What makes sense for a small business?
Here's the order I recommend. It's deliberately boring:
Step 1: a proper consent banner. Not one that says “we use cookies” with an OK button. One where saying no is as easy as saying yes, that's connected to Consent Mode and that actually stops the scripts after a no. It's a legal requirement in the EU and the foundation for everything else. Explaining in plain language what you track also gets more people to say yes; my own privacy policy shows what that can look like without the legalese.
Step 2: Consent Mode v2 in advanced mode, if you're comfortable with anonymous pings being sent after a no. The only cost is the time to set it up.
Step 3: Enhanced Conversions and CAPI through ready-made integrations. The cheapest way to win back the signals Safari loses.
Step 4: server-side tagging when the budget justifies it. My rule of thumb: below about €3,000 a month in ad spend, the server and setup are rarely worth it. Above about €4,500 they almost always are, because a few percent better data for your bidding is worth more than the server costs. In between, it depends on your share of iPhone traffic and how much you rely on automated bidding.
A word of warning: this is where people overpromise the most
This is where I see the most sales pitches that don't hold up. “We restore 100% of your conversions.” “Server-side makes you independent of cookie consent.” “With CAPI you track every visitor.” All three are either false or describe something that isn't allowed in the EU, where national data protection authorities have little patience for banners that don't do what they say.
The honest truth: you'll never see all your conversions in Google Ads or Meta again. Some customers don't want to be tracked, and that's their right. What you can do is stop losing the ones who said yes, and add measures that don't rely on tracking: ask new customers how they found you, and compare ad spend with total sales month by month. Less precise, but closer to the truth. Setting up measurement you own and understand is what I help with in analytics and tracking.
What to do next
- Open your site in a private window, say no in the banner and check the Network tab in your browser's developer tools: no requests should go to facebook.com or google-analytics.com. If they do, your banner is just decoration.
- Compare last month's conversions in Google Ads and Meta with your order system or booking calendar. The gap is your baseline.
- Check in Google Tag Manager, or with your banner provider, that Consent Mode v2 sends all four signals.
- Turn on the ready-made CAPI and Enhanced Conversions integrations in your shop or website platform, and check that purchases aren't being counted twice.
- If you spend more than about €4,500 a month, get a quote for server-side tagging and ask exactly what gets sent when someone says no. The answer should be “nothing that identifies the person.”
Want to see quickly where your advertising leaks the most? The quick analysis is five questions and takes two minutes.
