owntag

Now available in every owntag SGTM container: An easy permission check to verify if your connected Google service account has the correct permissions to access Google BigQuery and / or Firestore. That way you can see at first glance if everything is set up correctly or if your GCP admin needs to adjust permissions again before you can started writing to BigQuery or storing and fetching data from Firestore. (Hat tip to Stefan Elbinger for the inspiration for this feature!)

The US Supreme Court just decided that the FTC can't and must not be independent from the US president. But the FTC is also the entity that the EU-U.S. Data Privacy Framework relies on. And EU law requires that this oversight be carried out by an _independent_ authority which means the highest US court just removed a core requirement of the framework. Once the Commission repeals it, even loading a script from a US server becomes a data transfer on shaky legal ground — your visitor's IP lands in the US the instant that request fires. Safe Harbor fell, Privacy Shield fell and it looks like the Data Privacy Framework just got a big step closer to falling as well. Betting your privacy compliance on a potential fourth transfer deal is not a strategy. Trust in the previous transfer protocol was already low and certainly hasn't improved with Donald Trump in office. Server-side tagging gives you a control point: decide what data leaves, minimise before it moves, and host on our infrastructure that is EU-owned and EU-controlled, not merely EU-located. Take control of your data flows now and save yourself the headache later.

The European Commission just awarded its Sovereign Cloud tender — a €180M, 6-year contract for EU institutions. Four providers were selected, including Scaleway, the infrastructure provider owntag runs on. The interesting part is how the Commission measured "sovereignty": They built a framework with Sovereignty Effectiveness Assurance Levels (SEAL-0 to SEAL-4), assessing providers across eight criteria including legal jurisdiction, supply chain transparency, and immunity from non-EU third-party disruption. Scaleway reached SEAL-3 (Digital Resilience) — the service, technology and operations are considered immune from supply chain disruption by non-EU parties. A level most US hyperscalers can't reach by design, largely because legal jurisdiction (CLOUD Act) is part of the assessment. We didn't pick Scaleway because of this tender. We picked them because they were already the strongest option for a server-side tracking product handling EU user data. Nice to see the Commission arrive at a similar conclusion.

A small but useful feature update: You can now switch your SGTM container in place by updating the container configuration string, while your container is running. If you want to change your underlying container configuration string, you can now do so without having to update your already connected custom domains or other owntag configuration.

You may have already noticed that Meta has finally updated its GTM Web Container template after years. But one entirely new addition hasn't really gotten attention:                                                                                                 Via the new tag, Meta also loads its "Conversions API parameter builder", a script from capi-automation.s3.us-east-2 .amazonaws.com that looks a bit shady at first glance. The library normalizes a few parameters and has some convenience functions for forwarding client-side data to the tracking server, which is then supposed to pass it on to the CAPI. Most of this is already handled by Server Side GTM on its own though.                                                               One specific additional feature is interesting however, as it deals with recovering the important fbclid ("Facebook Click ID"):                                                                                                                               1. The in-app browser often strips the fbclid from the URL before the page even loads                                                     2. Without the fbclid, the browser can't set an _fbc cookie and click→conversion attribution breaks 3. The parameter builder recovers the click ID by communicating directly with the native app:                                                 - iOS: window.webkit.messageHandlers.browserProperties.postMessage('clickID')       - Android: XHR to properties://browser/clickID                 4. It writes the click ID directly into the _fbc cookie, from where both the client-side pixel and the tag in SGTM can read the click ID again and attribution works once more.                                                                                                       SGTM can't do this on its own, because it only works with JavaScript in the browser, so it's quite an interesting addition. Watch out though if you need to adjust your Content Security Policy, if you use one, to allow the AWS domain.

Our new organizational structure in owntag Console has now been live for a week: Organizations! They neatly group a company's server side GTM containers into one unit that makes managing both user access as well as billing more convenient. User management is now also more detailed with more access levels so everybody can get the permissions they need to work effectively.

Why does Meta event want the IPv6 when it already gets the IPv4? Because IPv6 is much more fine-grained and has a much higher "resolution" in terms of user-recognition. While the Internet is already kind of running out of available IPv4 addresses, there are enough IPv6 addresses available to give every smartphone, computer, smart lightbulb and internet connected toothbrush its own IP address. On many connections, you can check this yourself when you visit a site like whatsismyipaddress.com on your desktop and your smartphone while on the same WiFi network. Your IPv6 ist most likely going to be different, but the two devices will share the same IPv4 address. Hence the IPv6 is a very useful way for Meta and others to discern between different devices (and thereby, people?) on the same network. owntag allows you to track via both IPv4 and IPv6 out of the box – just make sure to add both A and AAAA records in your subdomain's DNS settings.

We love our all-european tech stack that runs owntag, but sometimes there's just no way around Google Cloud's powerful tools like BigQuery or Firestore, especially if your organization already uses them for other systems too. That's why we've added ✨ Google Cloud Platform integration ✨ that allows every owntag user to add a Google Service Account, available today. This option dramatically broadens the use cases you can tackle with your Server Side GTM, especially for more advanced projects. You can, for example… ➡️ Log any information you care about to BigQuery, like data about your most important conversion events. Which click ID identifiers did the events carry? How many and which of your orders were processed by SGTM? ➡️ Use Firestore as a custom CDP by storing user-related information such as customer lifetime value to enrich events or hashed PII that you don't want in the frontend to achieve higher match rates in ad networks ➡️ Implement profit-tracking by storing sensitive margin data for your products in Firestore and retrieving it from there as eCommerce events come in. Tracking profit as opposed to revenue then allows you to make much more accurate decisions based on actual ROI rather than just ROAS Adding your Service Account to connect to Google also allows you to use Google's famous Pantheon suite of 14 (!) different tools that help gather, transform, and send data from SGTM. What will you build with it? Try it out :)

New feature ✅: IP Block is now available for all owntag users. Define up to 50 IPs or IP patterns that can't send requests to your SGTM to - keep internal traffic from inside your company from polluting your data - stop artificially inflating ROI measurement with people testing conversion flows on production systems - stop malicious bots and other suspicious sources sending requests to your SGTM