.svg)
In the Privacy Soapbox, we give privacy professionals, guest writers, and opinionated industry members the stage to share their unique points of view, stories, and insights about data privacy. Authors contribute to these articles in their personal capacity. The views expressed are their own and do not necessarily represent the views of Didomi.
Do you have something to share and want to take over the Privacy Soapbox? Get in touch at blog(at)didomi.io
The tagging market rarely moves with drama, and what’s been happening through spring 2026 is subtler, with a series of announcements from Meta and Google that, taken in isolation, look incremental. But read together, they describe something more significant.
Meta announced on April 15 a one-click server-side setup and an AI-enhanced Pixel that automatically extracts data from your site's pages. Google followed on May 20 at Google Marketing Live with a structural overhaul of Tag Manager: GTM containers become the Google Tag itself, routing data to Google's destinations through a single, centrally managed script. In parallel, Google is piloting the Tag Gateway, a server-side layer that upgrades existing tags through the advertiser's own CDN, without touching the page.
Both events point in the same direction: the black-boxing of server-side tagging.
How tagging actually works in 2026
To understand what's shifting, it helps to have a simple map of how tagging actually works.
Every tag on a website executes in one of two places: the browser (the client layer) or a server (the server layer). For most of the history of digital marketing, tags lived in the browser. Over the past three years, the server layer has grown significantly, and it has taken three distinct forms, depending on who hosts and controls it:
- The platform-hosted server: The advertising platform (Google or Meta) runs the server entirely. The advertiser configures nothing and maintains nothing. Maximum simplicity.
- The first-party managed server: The server runs under the advertiser's own domain, which helps with data quality and browser restrictions, but is operated by a specialized third party. The advertiser has a first-party setup without the technical overhead.
- The fully controlled first-party server: The server runs under the advertiser's domain and remains entirely under their control: editable logic, transparent routing, full visibility into what is collected and where it goes.
The spring 2026 announcements expand this first form, though not in identical ways. Meta's move is the pure case: the server sits at Meta. Google's is subtler. Tag Manager now centralizes routing to Google's destinations inside a Google-controlled script, and the Tag Gateway even runs through the advertiser's own CDN, which sounds first-party. But in both cases, the logic that determines what is collected and where it goes is written, updated, and executed by the platform, within a script that the advertiser does not author. The hosting varies; the opacity does not.
That is the thing to notice: a black box is not defined by where the server sits, but by who can read the routing.
What one-click actually costs
Meta's "Meta-enabled CAPI" is straightforward to summarize. One-click setup, server hosted by Meta, zero maintenance, and a claimed 17.8% reduction in cost per result. For a business without technical resources, the value proposition is obvious.
Google's version is less visible but points the same way. The unified Google Tag centralizes routing to Google's destinations inside one script, and the Tag Gateway pilot moves that script's delivery onto the advertiser's CDN. On paper, this looks first-party. In practice, the advertiser hosts a conduit whose logic they can neither edit nor inspect: the infrastructure address changes, the visibility does not.
In both cases, the platform absorbs the infrastructure and, in doing so, absorbs the visibility that comes with it. When the routing logic belongs to Meta or Google, the advertiser can no longer inspect the chain. They can configure inputs and read outputs. What happens in between is, increasingly, a black box.
On the client side, the same dynamic is playing out. Meta's AI-enhanced Pixel now automatically extracts product names, prices, and behavioral signals from the page's structure, without requiring a developer to write a single line of tagging code. Google has introduced visual tagging, still in restricted beta, that captures interactions from any field on a page. Powerful, frictionless, and largely invisible to anyone outside the platform.
Who’s carrying the liability?
There is one role in most organizations that this movement puts in a structurally difficult position: the Data Protection Officer (DPO).
The DPO is the person who must prove, to a regulator or in an audit, what data is leaving the organization's systems and on what legal basis. They are the ones signing off on data flows, fielding the regulator's questions, and carrying the compliance liability.
The legal environment around this has not softened. In February 2026, a German court found website operators co-responsible under GDPR for data sent through Meta's Business Tools. A DMA report from March 2026 showed that EU users who had chosen "less personalized ads" were sending 90% less signal to the platforms, which means that the capture on the other side of that choice is substantial and measurable.
The asymmetry is precise: platforms automate capture; advertisers handle compliance. The more the infrastructure moves into platform-hosted black boxes, the harder it becomes to defend that compliance position. A DPO cannot audit what they cannot see.
This gap is not closing. The Digital Omnibus, proposed by the European Commission in late 2025 (which could be adopted by the end of 2026), would move cookie rules from ePrivacy into the GDPR and introduce browser-level consent signals that will require tagging chains and consent platforms to speak a new common language. The regulatory bar is rising at the same moment that the technical infrastructure is becoming less transparent. Those two curves are moving in opposite directions.
You can’t audit a black box
The second and third forms of server-side infrastructure (first-party managed and fully controlled) are the only ones in which a DPO can realistically answer the question: What is leaving my systems and how?
With a platform-hosted server, the consent signal can be transmitted to the platform before data is processed, but what happens after the handoff is outside the advertiser's view. With a first-party server, whether managed by a third party or controlled entirely by the organization, the routing is visible: templates can be audited, destinations verified, and the chain documented.
This is not only a technical distinction but also a governance one. And as regulation becomes more demanding and enforcement more active, the difference between "we configured it correctly" and "we can prove what it does" is likely to matter more.
The next chapter of this story is already taking shape in the regulatory pipeline. The Digital Omnibus introduces the concept of browser-level preference signals, a mechanism that would require consent platforms, browsers, and tagging infrastructure to interoperate around user choices. That is not a problem that platform black boxes are designed to solve.
How we’re working on this at Didomi
At Didomi and Addingwell, this is the problem we work on. Didomi orchestrates consent, helping organizations collect, store, and operationalize user choices across their properties. Addingwell operates at the server layer, with an approach built on the third form, a server-side infrastructure that remains fully under the advertiser's control, is vendor-agnostic, with editable logic, and has transparent data flows.
The thesis behind both is that in a market that is moving toward simplicity through delegation, there is a distinct and growing need for organizations that want to understand and prove what they do with data, not just configure it and hope.
The 2026 announcements from Google and Meta will help many businesses implement server-side tagging that they couldn't before. But they are not designed for the DPO standing in front of a regulator. For that person, the question has never been "Is this easy to set up?" It has always been "Can I prove what it does?"
That question is not going away. If anything, it's getting harder to answer, which is exactly when it matters most to have an answer ready.
