What is first-party (server-side) tagging?

## Why it matters

Most tracking tags live on Google's domains. When you load googletagmanager.com, your browser sends data there directly. First-party tagging changes that: your server becomes the middle person. Instead of the browser talking to Google, it talks to a /g/collect endpoint on your own domain, and your server forwards the data onward.

This matters because third-party cookies are going away. Privacy regulations and browsers themselves are making it harder for Google's domains to store and read cookies. With first-party tagging, your site's domain does the cookie work, which is legal and stable.

But honest talk: first-party tagging is not a magic privacy win. It still sends data to Google. The cookies are on your domain, not Google's, but the events themselves aren't hidden from Google Analytics. What changes is the technical plumbing, not the data collection itself.

## How it works

First-party tagging runs a server-side GTM container. This container sits on a subdomain of your site, such as collect.example.com. When your page loads and wants to send an event, instead of posting to google-analytics.com/g/collect, it posts to collect.example.com/g/collect. Your server forwards the request to Google on the backend.

The request shape stays the same: still a /g/collect path, still the same query and body parameters describing the event, client ID, session, and device. That's why Scalpel Tags recognises it even though the hostname changed. The tool looks for the /g/collect path and v=2 (the GA4 version marker) on any domain.

The server container sits between your page and Google's servers. This gives you a few wins:

Cookie control. Your domain sets and reads the client ID cookie, not Google's. That means it's a first-party cookie, which browsers allow even without third-party cookie access.

Request enrichment. Your server can add data before forwarding: user information, authentication state, server-side event details that the browser doesn't know about.

Request filtering. Your server can block or modify requests. If you spot bad data, you can fix it server-side instead of redeploying client code.

Vendor access limits. Here's the catch: your browser only sees what leaves your domain. If your server-side container forwards to vendors you haven't heard of, you won't see those requests from the browser. That's the fan-out problem. Scalpel Tags can only decode requests that reach your domain's network stack. Whatever your server forwards to Google or other vendors is invisible to the extension.

## What does not matter

You might hear that first-party tagging is "more private." It isn't, not really. Cookies that live on your domain are still cookies. Your servers still send the same event data to Google that a browser would. First-party cookies last longer in some browsers (fewer restrictions), but that's a technical detail, not a privacy upgrade.

You also don't need first-party tagging if your site works fine with Google's default third-party setup. If your users have third-party cookies enabled or aren't in privacy-heavy regions, first-party tagging is extra complexity for little gain. Start with it only if you hit a real friction point: users see missing data, or a browser or regulation blocks your tags outright.

## Code example

A server-side GTM container forwarding a GA4 event looks like this. Your page sends to your domain:

// Browser code posts to your domain
fetch('https://collect.example.com/g/collect?v=2', {
  method: 'POST',
  body: 'tid=G-XXXXXXXXXX&cid=12345.67890&en=page_view&dl=https%3A%2F%2Fexample.com%2F&dt=Home'
});
Copy

Your server then forwards to Google:

// Server-side code (Node.js example)
app.post('/g/collect', (req, res) => {
  // Enrich or validate the request if needed
  req.body.user_id = getUserIdFromSession(req);

  // Forward to Google Analytics
  fetch('https://www.google-analytics.com/g/collect', {
    method: 'POST',
    body: req.body
  });

  res.status(204).send();
});
Copy

The path stays /g/collect, the body structure stays the same, but the request touches your domain first.

## How Scalpel Tags shows it

Scalpel Tags detects first-party collection by hostname and path. If a request hits any domain and carries /g/collect?v=2 or a POST to /g/collect with GA4 parameters, the tool decodes it as a GA4 hit. The hostname doesn't matter: www.example.com, collect.example.com, or any other domain, as long as the request shape matches.

In the hit table, a first-party request looks the same as one sent to Google's domain. Scalpel Tags shows the measurement ID, client ID, event name, and all other decoded fields. The only difference is the hostname in the URL.

## Related links

• GA4 Measurement Protocol
• GTM Container