8 ms·

What is server-side conversion tracking?

60 points by marketingtech 5y ago

edoceo 5y ago
Oh, I remember this, from like 2000 (in CGI/Perl). Did it this way for ages then there was this ground-breaking company for ads called "DoubleClick" (I think) that did it all with cookies and js. Wonder whatever happened to them.
- DaiPlusPlus 5y ago
  DoubleClick became the world’s largest web ad broker and was bought by Google to shore-up their own AdSense + AdWords business. Due to cross-site “third-party” cookies being disabled in modern web-browsers and the HTTP Referer [sic] header being unofficially deprecated the only way for websites and ads to work together is by either IP address tracking or visitor fingerprinting. IPv4 address tracking is a blunt instrument that is next to useless when visitors are using ISPs with CG-NAT. But IPv6 makes every device addressable - and thus - followable. I imagine that eventually CPE (home internet modem and router) will offer some kind of IPv6 address randomisation system on a per-TCP-connection basis, though they’d all share the same 64-bit prefix (I think?) so it doesn’t mitigate per-residence tracking. (EDIT: Ah, so IPv6 does have privacy protection by rotating autoconfigured addresses on a regular basis: https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad... ) ————- I do believe the end of third-party cookies is going to make internet advertising significantly less profitable and more and more ad-funded sites will either add paywalls or shut-down. I’m surprised Google went this way, actually - I’d have thought a less-harmful way of protecting users’ privacy with balancing the need for attribution in advertising could be accomplished by, for example, auto-nuking cross-domain cookies after 24-hours.
  - bpodgursky 5y ago
    Google hasn't _really_ committed to a 3p cookie deprecation plan. They just kicked the deadline forward another year or two while they test out alternatives.
    - DaiPlusPlus 5y ago
      > Google hasn't _really_ committed to a 3p cookie deprecation plan I'd say it's pretty dang official now: https://digiday.com/marketing/cheat-sheet-google-extends-cookie-execution-deadline-until-late-2023-will-pause-floc-testing-in-july/ https://digiday.com/marketing/cheat-sheet-google-extends-coo... Don't forget the actions of other browser-vendors too, like Apple's Safari and Mozilla's Firefox, both of which have severely curtailed third-party cookies - and Google Chrome's Incognito mode also disables all third-party cookies. > They just kicked the deadline forward another year or two while they test out alternatives. Right, but the deadline still exists.
      - bpodgursky 5y ago
        I mean, it doesn't really exist, because the 2022 deadline got pushed when it became clear there wasn't another alternative ready. This one could just as easily slip.
  - bigiain 5y ago
    > DoubleClick became the world’s largest web ad broker and was bought by Google Do you _really_ thing the OP didn't know that???
extr 5y ago
I don't know how this shit works. But earlier this month I was showing my girlfriend a Halloween costume I googled on my phone. I visited the website for maybe 10 seconds, I did not log in or create an account. A few days later I got an email from PayPal offering me a $5 coupon for that website. WTFFFF. It made me want to go full-nuclear on the privacy front.
- Fordec 5y ago
  10 seconds is plenty of time to record IP addresses, do pixel tracking etc. Combine with data from a data broker and you probably have contact detail attribution. heck, the payment processor plugin probably on that costume's site that's all they needed considering the email came from Paypal, which I assume you have an account with. an IP address lookup table internal to Paypal would do it alone.
- nerdponx 5y ago
  Companies give Google and friends free unfettered access to your highly specific usage data that can be used to uniquely identify you, all without your consent or knowledge, and no way to opt out. In exchange, said companies get metrics on how well their ads are doing. It's ingenious. The incentives are set up entirely against you. The people who know and care the least about privacy decide what to do with your data, and they are enticed to hand it over by the promise of tracking ad spend, i.e. the promise of making their jobs easier and of making their success quantifiable.
  - kangaroozach 5y ago
    How could this be combatted? I assume just through legislation and possibly some type of random audit or bounty system to catch violators? Or could it be beaten by high privacy browsers like Brave and a system of shuffling through and sharing random anonymous online identities with strangers like Tor does with IP? Just to confuse the hell out of the ad platforms… What would the legislation even be though?
    - yjftsjthsd-h 5y ago
phibz 5y ago
This is nothing new. We were sharing impression data with client partners from the server side years ago.
scott00 5y ago
How in the world does this satisfy the advertisers? They send the personal identifying details of each customer to Google/FB, and then Google/FB tells them "oh yeah, that guy totally saw an ad"? The ad giants would never lie about such a thing... they will just fix all of the bugs that under report and just not have the time to get to all of those pesky over-reporting bugs.
- marketingtech 5y ago
  It doesn't. For the ad platforms, this lets them optimize their ads for better performance when they know which user profiles converted. For advertisers, it's used for directional guidance on the platform, e.g. ad campaign A converts at 3x the rate of ad campaign B. The famous quote in the industry is "Half the money I spend on advertising is wasted; the trouble is I don't know which half." This method gives you a better idea of which money is wasted, at least compared to something like a TV or a print ad. It gets more complex when you're advertising on multiple channels. For instance, if you see an ad on FB, Google the product, then buy it, both will take credit for a conversion even though your business only had one sale. There are more scientific methods for modeling advertising results from multiple channels [1], that leverage control groups (say you run a Google ad in New York and a TV ad in California and monitor which market sees a bigger spike in sales). [1] https://en.wikipedia.org/wiki/Marketing_mix_modeling https://en.wikipedia.org/wiki/Marketing_mix_modeling
- marcinzm 5y ago
  An advertiser knows exactly how many clicks and revenue they get from facebook or google campaigns (the click url includes that as query params). Down to the campaign level. That's not what this is about. This is about Facebook and Google being able to give even more detailed information on that revenue (ie: predicted view attribution, revenue by product shown, revenue by search term, etc.) and do even better automated targeting on those campaigns.
marketingtech 5y ago
For those who are referencing tracking pixels and say this isn't anything new, it's important to understand that this is the next evolution of that technology as a result of government regulations around privacy and browser/OS ecosystem changes from Google, Apple, and Mozilla. This data transfer won't occur at the browser layer for much longer - it won't be as technically feasible without cookies and it may not be legal given consent/opt-out requirements. Instead the data will pass directly from the advertiser's server to the ad platform's server. Of course this tech has existed for a long time - it's a basic API call - but it hasn't been widely adopted in the ad tech industry, while millions of websites are using tracking pixels. It is not a 1:1 replacement for tracking pixels and lacks some of those creepy features (you're unlikely to get tagged if you simply browse a website without giving up any personal info), but it offers new ones as well (the ability to send arbitrary data to an ad platform).
- yjftsjthsd-h 5y ago
  > and it may not be legal given consent/opt-out requirements. It would be a remarkably narrow law that made it illegal to do something client-side but not server-side. AFAIK it's usually about what data you collect and how you use it, not precise details about how it was collected and stored along the way.
  - marketingtech 5y ago
    The laws are around consent and the ability to revoke it, which can vary by the continent/country/state/city you're in as well as some other characteristics that may not be known at the time that the client-side code would execute. Server-side allows businesses to defer the data transfer until it's known whether specific consent is granted or revoked. It also allows you to more easily keep a record of the data shared with other parties in the event that a user withdraws prior consent or invokes a right to be forgotten. You then have the ability to tell your partners to also delete those data points.
majormajor 5y ago
> “The server-side option was built as part of our ongoing work to give advertisers more control over their users’ data,” said a Google spokesperson Wait. Whose data is it, Google?
tsjq 5y ago
does blocking 3rd party cookies suffice to get rid of this ?
- marketingtech 5y ago
  No, but it will decrease its effectiveness to some extent. One of the reasons this tech is gaining adoption is that it removes ad tech's dependence on 3P cookies.
dillondoyle 5y ago
I have this setup for our clients on FB. The reported ROAS is all over the place on FB right now. It goes from previously 1 = 100% return on investment. Now it sometimes says 10X numbers like 70, which I assume is of the data they could measure 70% roi. It seems to 'automagically' combine the offline conversion data with standard FBQ but I have no idea the match rates for the server-server data I send in and also importantly if it de-dupes. I've tried to experiment with voting data in the past, I want to try that more this election. Run get out the vote ads and optimize for actual early votes.
deleted 5y ago
[deleted]
pjmlp 5y ago
It is another example how Web apps are apparently more secure than native ones.

60 points by marketingtech 5y ago

Oh, I remember this, from like 2000 (in CGI/Perl). Did it this way for ages then there was this ground-breaking company for ads called "DoubleClick" (I think) that did it all with cookies and js. Wonder whatever happened to them.

DaiPlusPlus 5y ago
DoubleClick became the world’s largest web ad broker and was bought by Google to shore-up their own AdSense + AdWords business. Due to cross-site “third-party” cookies being disabled in modern web-browsers and the HTTP Referer [sic] header being unofficially deprecated the only way for websites and ads to work together is by either IP address tracking or visitor fingerprinting. IPv4 address tracking is a blunt instrument that is next to useless when visitors are using ISPs with CG-NAT. But IPv6 makes every device addressable - and thus - followable. I imagine that eventually CPE (home internet modem and router) will offer some kind of IPv6 address randomisation system on a per-TCP-connection basis, though they’d all share the same 64-bit prefix (I think?) so it doesn’t mitigate per-residence tracking. (EDIT: Ah, so IPv6 does have privacy protection by rotating autoconfigured addresses on a regular basis: https://www.internetsociety.org/blog/2014/12/ipv6-privacy-addresses-provide-protection-against-surveillance-and-tracking/ https://www.internetsociety.org/blog/2014/12/ipv6-privacy-ad... ) ————- I do believe the end of third-party cookies is going to make internet advertising significantly less profitable and more and more ad-funded sites will either add paywalls or shut-down. I’m surprised Google went this way, actually - I’d have thought a less-harmful way of protecting users’ privacy with balancing the need for attribution in advertising could be accomplished by, for example, auto-nuking cross-domain cookies after 24-hours.
- bpodgursky 5y ago
  Google hasn't _really_ committed to a 3p cookie deprecation plan. They just kicked the deadline forward another year or two while they test out alternatives.
  - DaiPlusPlus 5y ago
    > Google hasn't _really_ committed to a 3p cookie deprecation plan I'd say it's pretty dang official now: https://digiday.com/marketing/cheat-sheet-google-extends-cookie-execution-deadline-until-late-2023-will-pause-floc-testing-in-july/ https://digiday.com/marketing/cheat-sheet-google-extends-coo... Don't forget the actions of other browser-vendors too, like Apple's Safari and Mozilla's Firefox, both of which have severely curtailed third-party cookies - and Google Chrome's Incognito mode also disables all third-party cookies. > They just kicked the deadline forward another year or two while they test out alternatives. Right, but the deadline still exists.
    - bpodgursky 5y ago
      I mean, it doesn't really exist, because the 2022 deadline got pushed when it became clear there wasn't another alternative ready. This one could just as easily slip.
- bigiain 5y ago
  > DoubleClick became the world’s largest web ad broker and was bought by Google Do you _really_ thing the OP didn't know that???

extr 5y ago

I don't know how this shit works. But earlier this month I was showing my girlfriend a Halloween costume I googled on my phone. I visited the website for maybe 10 seconds, I did not log in or create an account. A few days later I got an email from PayPal offering me a $5 coupon for that website. WTFFFF. It made me want to go full-nuclear on the privacy front.

Fordec 5y ago
10 seconds is plenty of time to record IP addresses, do pixel tracking etc. Combine with data from a data broker and you probably have contact detail attribution. heck, the payment processor plugin probably on that costume's site that's all they needed considering the email came from Paypal, which I assume you have an account with. an IP address lookup table internal to Paypal would do it alone.
nerdponx 5y ago
Companies give Google and friends free unfettered access to your highly specific usage data that can be used to uniquely identify you, all without your consent or knowledge, and no way to opt out. In exchange, said companies get metrics on how well their ads are doing. It's ingenious. The incentives are set up entirely against you. The people who know and care the least about privacy decide what to do with your data, and they are enticed to hand it over by the promise of tracking ad spend, i.e. the promise of making their jobs easier and of making their success quantifiable.
- kangaroozach 5y ago
  How could this be combatted? I assume just through legislation and possibly some type of random audit or bounty system to catch violators? Or could it be beaten by high privacy browsers like Brave and a system of shuffling through and sharing random anonymous online identities with strangers like Tor does with IP? Just to confuse the hell out of the ad platforms… What would the legislation even be though?
  - yjftsjthsd-h 5y ago

phibz 5y ago

This is nothing new. We were sharing impression data with client partners from the server side years ago.

scott00 5y ago

How in the world does this satisfy the advertisers? They send the personal identifying details of each customer to Google/FB, and then Google/FB tells them "oh yeah, that guy totally saw an ad"? The ad giants would never lie about such a thing... they will just fix all of the bugs that under report and just not have the time to get to all of those pesky over-reporting bugs.

marketingtech 5y ago
It doesn't. For the ad platforms, this lets them optimize their ads for better performance when they know which user profiles converted. For advertisers, it's used for directional guidance on the platform, e.g. ad campaign A converts at 3x the rate of ad campaign B. The famous quote in the industry is "Half the money I spend on advertising is wasted; the trouble is I don't know which half." This method gives you a better idea of which money is wasted, at least compared to something like a TV or a print ad. It gets more complex when you're advertising on multiple channels. For instance, if you see an ad on FB, Google the product, then buy it, both will take credit for a conversion even though your business only had one sale. There are more scientific methods for modeling advertising results from multiple channels [1], that leverage control groups (say you run a Google ad in New York and a TV ad in California and monitor which market sees a bigger spike in sales). [1] https://en.wikipedia.org/wiki/Marketing_mix_modeling https://en.wikipedia.org/wiki/Marketing_mix_modeling
marcinzm 5y ago
An advertiser knows exactly how many clicks and revenue they get from facebook or google campaigns (the click url includes that as query params). Down to the campaign level. That's not what this is about. This is about Facebook and Google being able to give even more detailed information on that revenue (ie: predicted view attribution, revenue by product shown, revenue by search term, etc.) and do even better automated targeting on those campaigns.

marketingtech 5y ago

For those who are referencing tracking pixels and say this isn't anything new, it's important to understand that this is the next evolution of that technology as a result of government regulations around privacy and browser/OS ecosystem changes from Google, Apple, and Mozilla. This data transfer won't occur at the browser layer for much longer - it won't be as technically feasible without cookies and it may not be legal given consent/opt-out requirements. Instead the data will pass directly from the advertiser's server to the ad platform's server. Of course this tech has existed for a long time - it's a basic API call - but it hasn't been widely adopted in the ad tech industry, while millions of websites are using tracking pixels. It is not a 1:1 replacement for tracking pixels and lacks some of those creepy features (you're unlikely to get tagged if you simply browse a website without giving up any personal info), but it offers new ones as well (the ability to send arbitrary data to an ad platform).

yjftsjthsd-h 5y ago
> and it may not be legal given consent/opt-out requirements. It would be a remarkably narrow law that made it illegal to do something client-side but not server-side. AFAIK it's usually about what data you collect and how you use it, not precise details about how it was collected and stored along the way.
- marketingtech 5y ago
  The laws are around consent and the ability to revoke it, which can vary by the continent/country/state/city you're in as well as some other characteristics that may not be known at the time that the client-side code would execute. Server-side allows businesses to defer the data transfer until it's known whether specific consent is granted or revoked. It also allows you to more easily keep a record of the data shared with other parties in the event that a user withdraws prior consent or invokes a right to be forgotten. You then have the ability to tell your partners to also delete those data points.

majormajor 5y ago

> “The server-side option was built as part of our ongoing work to give advertisers more control over their users’ data,” said a Google spokesperson Wait. Whose data is it, Google?

tsjq 5y ago

does blocking 3rd party cookies suffice to get rid of this ?

marketingtech 5y ago
No, but it will decrease its effectiveness to some extent. One of the reasons this tech is gaining adoption is that it removes ad tech's dependence on 3P cookies.

dillondoyle 5y ago

I have this setup for our clients on FB. The reported ROAS is all over the place on FB right now. It goes from previously 1 = 100% return on investment. Now it sometimes says 10X numbers like 70, which I assume is of the data they could measure 70% roi. It seems to 'automagically' combine the offline conversion data with standard FBQ but I have no idea the match rates for the server-server data I send in and also importantly if it de-dupes. I've tried to experiment with voting data in the past, I want to try that more this election. Run get out the vote ads and optimize for actual early votes.

deleted 5y ago

[deleted]

pjmlp 5y ago

It is another example how Web apps are apparently more secure than native ones.