GTM Server-Side Variables: Advanced Data Customization and Scrubbing

In modern analytics, client-side tracking is becoming increasingly unreliable. Ad blockers, browser privacy features (like Apple's Intelligent Tracking Prevention), and strict privacy regulations make browser-based scripting fragile and insecure. Google Tag Manager (GTM) Server-Side Tagging addresses these challenges by shifting tag execution from the client's web browser to a secure, cloud-based server container (running on Google Cloud Platform or AWS).

Once the server container receives incoming telemetry, you can use server-side variables to process, structure, and filter this data. These variables act as gatekeepers, allowing you to sanitize personally identifiable information (PII) before sending events to third-party endpoints like Google Analytics 4, Meta, or TikTok.

---

1. Understanding GTM Server-Side Variable Types

Server-side GTM (sGTM) introduces unique variable types designed to inspect server requests:

Event Data Variables

The most common variable type in sGTM is the Event Data variable. When a client-side tracker (like a GA4 tag) fires, it sends an HTTP POST request containing a JSON payload to your server container. The Event Data variable extracts values from this payload:

• →page_location: The URL of the page where the event occurred.
• →client_id: The user's analytics identifier.
• →items: Product arrays for e-commerce tracking.

Request Header Variables

Unlike browser-based GTM, sGTM can read the HTTP request headers directly. This allows you to inspect:

• →User-Agent: The browser and operating system of the visitor.
• →X-Forwarded-For: The visitor's IP address (useful for geolocation mapping).
• →Referer: The page the visitor came from.

Cookie Variables

You can extract values from incoming cookies directly on the server. For example, reading the _ga cookie value or a custom cookie containing consent preferences (like cookie_consent_status).

---

2. Sanitizing PII in a Sandboxed Environment

To comply with regulations like GDPR and CCPA, you must avoid transmitting PII (such as email addresses, phone numbers, or physical names) to analytics servers.

In client-side GTM, developers often write custom JavaScript variables to strip PII. In sGTM, however, standard JavaScript is blocked to ensure security and sandboxing. Instead, you must build custom sGTM Templates using GTM's APIs.

Here is an example of the Sandboxed JavaScript code used inside a Custom Variable Template to scrub email addresses from query parameters:

// Sandboxed JavaScript for sGTM Custom Variable Template
const getRequestQueryString = require('getRequestQueryString');
const makeString = require('makeString');
const logToConsole = require('logToConsole');

// Retrieve the incoming request's query string
const queryString = getRequestQueryString();

if (!queryString) {
  return '';
}

// Convert input to a string safely
const inputStr = makeString(queryString);

// Regular expression to identify email patterns (e.g., [email protected])
// Note: Sandboxed JS uses a subset of RegExp APIs for performance safety
const emailPattern = /([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4})/g;

// Replace detected email strings with a redacted token
const sanitizedQuery = inputStr.replace(emailPattern, '[REDACTED_EMAIL]');

logToConsole('Original Query: ' + inputStr);
logToConsole('Sanitized Query: ' + sanitizedQuery);

return sanitizedQuery;

---

3. Step-by-Step Implementation: Scrubbing Outbound PII

Follow this process to configure a server-side data-scrubbing engine:

Step 1: Create a Custom Variable Template

1. In your sGTM Container, navigate to Templates > Variable Templates > click New.
2. In the Code tab, use the GTM sandboxed APIs (like getRequestQueryString and makeString) to retrieve and parse incoming request attributes.
3. Add the regex replacement rules to redact emails or search queries containing names.
4. In the Permissions tab, grant the template access to read the request query string. Save the template.

Step 2: Initialize the Variable

1. Navigate to Variables > click New under User-Defined Variables.
2. Choose the custom template you created in Step 1.
3. Name it var_sanitized_query_string.

Step 3: Reference the Variable in Outbound Tags

1. Open your Google Analytics 4 or Meta Conversions API tag.
2. Find the field for parameter overriding (like page_location or event_source_url).
3. Map the field to your new sanitized variable: {{var_sanitized_query_string}} instead of the raw event query parameter.

---

4. Performance and Server Cost Benefits

sGTM variables run on your cloud instances (e.g., Google App Engine). While this does add computing costs, optimizing how you use variables can save money:

1. Reduce Network Payload Size: By filter-scrubbing unnecessary variables at the server level, you reduce the size of the outbound requests sent to external servers.
2. Lighter Client JavaScript: Shifting the transformation and scrubbing logic to sGTM allows you to remove large client-side parsing libraries from your client bundle, speeding up browser load times and improving Core Web Vitals.

---

Official References

• →Google Tag Manager: Server-Side Tagging Developer Guide
• →Google GTM Template APIs Reference
• →W3C Web Performance Working Group
• →Google Developers: Web Vitals Documentation