# What does server-side tracking NOT fix, even after a full and correct implementation?

Reviewed by Martin Dejnicki, Director of SEO & AI Search · facts verified October 8, 2026 · canonical: https://deploi.ca/shopify/faq/server-side-tracking-limitations

## Short answer

Server-side tracking, even correctly implemented, does not fix declined consent, 48-hour deduplication windows or ad platforms' attribution models. Meta and TikTok deduplicate browser and server copies only within 48 hours ([Meta for Developers](https://developers.facebook.com/documentation/ads-commerce/conversions-api/deduplicate-pixel-and-server-events); [TikTok Business Help Center](https://ads.tiktok.com/resources/help/article/event-deduplication), October 2026), so late copies double count. Google Ads retired first click, linear, time decay and position-based models ([Google Ads Help](https://support.google.com/google-ads/answer/6259715), October 2026).

- **Meta deduplication window:** 48 hours from the first event_id. Browser and Conversions API copies are deduplicated only if they arrive within 48 hours of the first event with a given event_id ([Meta for Developers, Handling Duplicate Pixel and Conversions API Events](https://developers.facebook.com/documentation/ads-commerce/conversions-api/deduplicate-pixel-and-server-events))
- **TikTok deduplication window:** After 5 minutes, within 48 hours. TikTok merges or deduplicates matching Pixel and Events API events arriving after 5 minutes and within a 48-hour window from the first event ([TikTok Business Help Center, About event deduplication](https://ads.tiktok.com/resources/help/article/event-deduplication))
- **Google Ads attribution models:** Data-driven or last click only. First click, linear, time decay and position-based models are no longer supported; data-driven is the default for most conversion actions ([Google Ads Help, About attribution models](https://support.google.com/google-ads/answer/6259715))
- **Google's consent modelling bars:** 1,000 consented users a day in GA4; 700 Ads clicks a week. GA4 counts only users who granted analytics storage, on 7 of the previous 28 days, and needs 1,000 denied events a day for 7 days; Google Ads counts 700 ad clicks over 7 days per country and domain grouping ([Google Analytics Help, [GA4] Behavioral modeling for consent mode](https://support.google.com/analytics/answer/11161109); [Google Ads Help, About consent mode modeling](https://support.google.com/google-ads/answer/10548233))

## Deploi's call

Server-side tracking does not fix declined consent, deduplication windows, attribution models or a wrong event. Write that not-fixed list into the project charter before the build starts, and have the channel owners sign it. Nearly every disappointment we see with a server-side project is a scope expectation that was never stated, not an implementation defect. The build does what it says. The brief said more than the build could.

**CUSTOMIZE: Build server-side delivery, scoped to what it fixes, when**

- The charter lists what the build will not fix, and each channel owner has signed it.
- Browser and server copies of each event share an event ID that each platform's events manager shows as deduplicated.
- Consent state flows through every pixel and server event, the wiring [Deploi's consent-aware analytics record](https://deploi.ca/shopify/build-vs-buy/consent-aware-analytics) scores CUSTOMIZE (October 2026).

**WAIT: Hold the build while**

- The business case promises recovered revenue, or one cross-platform total that matches Shopify.
- A retry, batch or offline upload can land a server copy more than 48 hours after the browser event, outside the deduplication window ([Meta's deduplication guide](https://developers.facebook.com/documentation/ads-commerce/conversions-api/deduplicate-pixel-and-server-events); [TikTok's deduplication article](https://ads.tiktok.com/resources/help/article/event-deduplication), October 2026).
- The case leans on modelled conversions, Google's estimates for shoppers who decline cookies, while your Google Analytics 4 (GA4) property sits below Google's 1,000-event and 1,000-user thresholds ([Google Analytics Help](https://support.google.com/analytics/answer/11161109), October 2026).

## What does server-side tracking leave broken after a correct build?

A correct server-side build leaves eight things broken, because consent, the ad platforms and your own data set each one, not the route an event travels. They are the other half of [what moving to server-side tracking does recover](https://deploi.ca/shopify/faq/server-side-tracking-attribution-recovery-ios-cookies).

**Eight limits a correct server-side build leaves in place, and who sets each one**

| Still broken | Why a server hop cannot help | Documented by |
| --- | --- | --- |
| Declined consent | Shopify runs app pixels only after consent where it is required; Google's tags "don't store cookies" when it is denied | Shopify and Google, October 2026 |
| Attribution model | Google Ads dropped four rule-based models and kept last click; data-driven is the default for most conversion actions | Google, October 2026 |
| Deduplication window | Meta and TikTok deduplicate browser and server copies only within 48 hours of the first event | Meta and TikTok, October 2026 |
| Cross-device and logged-out journeys | A server sends the identity you have; it cannot create one | Deploi judgment |
| Walled-garden self-reporting | Each platform credits what it believes it caused, under its own window, so totals will not add up to Shopify revenue | Deploi judgment |
| View-through credit | Credit for ad impressions stays inside each platform | Deploi judgment |
| Modelling below thresholds | Google Analytics 4 (GA4) models declined-cookie behaviour only at 1,000 denied events and 1,000 consented users a day | Google, October 2026 |
| A wrong event | A duplicated or mis-valued purchase event is wrong in both transports | Deploi judgment |

Sources: [Shopify developer docs, About web pixels](https://shopify.dev/docs/apps/build/marketing/pixels); [Google Ads Help, About consent mode](https://support.google.com/google-ads/answer/10000067); [Google Ads Help, About attribution models](https://support.google.com/google-ads/answer/6259715); [Meta for Developers, Handling Duplicate Pixel and Conversions API Events](https://developers.facebook.com/documentation/ads-commerce/conversions-api/deduplicate-pixel-and-server-events); [TikTok Business Help Center, About event deduplication](https://ads.tiktok.com/resources/help/article/event-deduplication); [Google Analytics Help, [GA4] Behavioral modeling for consent mode](https://support.google.com/analytics/answer/11161109). Verified October 8, 2026.

## Why do Google's consent-mode modelling thresholds bite mid-market brands?

Google's consent-mode modelling thresholds bite mid-market brands because they count daily traffic and consent mix, which a server hop cannot change. Google Analytics 4 (GA4) models the behaviour of shoppers who decline analytics cookies only when a property clears two bars ([Google Analytics Help](https://support.google.com/analytics/answer/11161109), October 2026). It must collect "at least 1,000 events per day with analytics_storage='denied' for at least 7 days". It must also have "at least 1,000 daily users sending events with analytics_storage='granted' for at least 7 of the previous 28 days". Google tags must load "in all cases, not only if the user consents." Even past both bars, Google warns that "it's possible that even the additional data won't be sufficient for Analytics to train the model."

Google Ads sets its own, separate bar for modelled conversions: "a daily ad click threshold of 700 ad clicks over a 7 day period, per country and domain grouping" ([Google Ads Help](https://support.google.com/google-ads/answer/10548233), October 2026). So a brand doing meaningful revenue on modest traffic can miss both bars for good, and server-side tracking moves neither. [What that means for a $10M brand with a high order value](https://deploi.ca/shopify/faq/server-side-tracking-overkill-at-10m-per-year) works through the arithmetic.

## How does the 48-hour deduplication window inflate conversions?

The 48-hour window inflates conversions whenever a browser event and its server copy arrive more than two days apart, because Meta and TikTok only deduplicate inside it. Meta says events "are only deduplicated if they are received within 48 hours of when we receive the first event with a given `event_id`" ([Meta for Developers](https://developers.facebook.com/documentation/ads-commerce/conversions-api/deduplicate-pixel-and-server-events), October 2026). TikTok merges or deduplicates matching Pixel and Events API (application programming interface) copies "after 5 minutes and within a 48-hour window from the first event" ([TikTok Business Help Center](https://ads.tiktok.com/resources/help/article/event-deduplication), October 2026).

So any architecture that can send the server copy late double counts: a delayed batch job, a retried queue, an offline conversion upload joined days later. Meta's fallback method matches on its browser cookie ID (`fbp`) or your own customer ID (`external_id`). That method adds a second trap: "Server events will not be discarded if a browser event has not been received in the past 48 hours, even if an identical browser event arrives after the server event."

That means an implementation error here does not produce missing data, which is visible. It produces inflated data, which looks like success.

## What should you settle about each limit before the build starts?

Settle the limits server-side tracking leaves before the build starts, because each has a fix outside the route an event travels and needs an owner:

- **Consent:** measure the decline rate and treat it as a planning input, not a defect. Report consented conversions and total orders side by side so nobody mistakes one for the other.
- **Attribution model:** stop comparing platforms to each other. Compare each platform to itself over time, and all of them to Shopify order data.
- **Deduplication:** send `event_id` from both sides, verify it in each platform's events manager, and re-verify after every theme or app change.
- **Incrementality:** run a holdout. It is the only method on this list that answers whether the spend caused the revenue, and [a holdout design that separates recovered conversions from lift](https://deploi.ca/shopify/faq/elevar-meta-google-ad-spend-waste-claim) shows how.

> **When not to start the build yet**
> - **When the brief promises recovered revenue.** Server-side delivery recovers reporting on sales that already happened, not new sales.
> - **When a retry or batch job can send server events after the platforms' deduplication window closes.** Fix the timing first, or the build inflates every count it touches.

## Deploi's point of view

**What we've seen.** The item on this list that surprises teams most is deduplication. A 48-hour window sounds generous until a retry job re-sends server events that failed two or more days earlier, and the purchase count quietly rises.

**Where we disagree.** Vendors frame server-side tracking as recovering lost conversions, which invites the reader to imagine revenue appearing. What it recovers is reporting fidelity for events that already happened. Those are different claims, and only one of them survives a finance review.

**What this page adds.** the specific documented ceilings, the 48-hour deduplication windows on both Meta and TikTok, Google's retirement of four rule-based attribution models, and the separate GA4 and Google Ads modelling thresholds, which together explain why a correct implementation still leaves a gap.

## When this answer changes

- Meta or TikTok changes its 48-hour deduplication window.
- Google changes the GA4 modelling thresholds or the Google Ads bar of 700 ad clicks over 7 days.
- Google Ads restores a rule-based attribution model or retires last click.
- Shopify changes how app pixels wait for consent where consent is required.

## Sources

1. [Shopify developer docs, About web pixels](https://shopify.dev/docs/apps/build/marketing/pixels), checked October 8, 2026
2. [Google Ads Help, About consent mode](https://support.google.com/google-ads/answer/10000067), checked October 8, 2026
3. [Google Ads Help, About attribution models](https://support.google.com/google-ads/answer/6259715), checked October 8, 2026
4. [Meta for Developers, Handling Duplicate Pixel and Conversions API Events](https://developers.facebook.com/documentation/ads-commerce/conversions-api/deduplicate-pixel-and-server-events), checked October 8, 2026
5. [TikTok Business Help Center, About event deduplication](https://ads.tiktok.com/resources/help/article/event-deduplication), checked October 8, 2026
6. [Google Analytics Help, [GA4] Behavioral modeling for consent mode](https://support.google.com/analytics/answer/11161109), checked October 8, 2026
7. [Google Ads Help, About consent mode modeling](https://support.google.com/google-ads/answer/10548233), checked October 8, 2026
8. [Deploi Build vs. Buy, Should You Build or Buy Server-Side Tracking on Shopify?](https://deploi.ca/shopify/build-vs-buy/server-side-tracking-and-data-layer), checked October 8, 2026, Deploi research
9. [Deploi Build vs. Buy, Should You Build or Buy Consent-Aware Analytics on Shopify?](https://deploi.ca/shopify/build-vs-buy/consent-aware-analytics), checked October 8, 2026, Deploi research