Conversion APIs
Conversion APIs (CAPIs) send event data server-to-server rather than through browser pixels, improving data quality while raising distinct privacy compliance questions.
By Sergio Maldonado Elvira, Attorney, State Bar of California · FIP, CIPP/US, CIPP/E, CIPT
Published · Last reviewed
Key points
- →Ensure consent flows to server events
- →Maintain data minimization principles
- →Document data flows and retention
- →Navigate platform-specific requirements
CAPI privacy fundamentals
Server-side tracking doesn't bypass privacy requirements—it changes where they're implemented. CAPIs still process personal data (email hashes, IP addresses, transaction details) and require lawful basis. The key difference: browsers don't see the tracking, but legal obligations remain identical. Don't confuse technical invisibility with privacy compliance.
Consent signal propagation
When users decline tracking consent, that preference must flow through to your CAPI implementation. Technical challenges include: real-time consent signal sync to servers, preventing event transmission before consent confirmation, handling consent revocation for pending events, and maintaining consent audit trails server-side. Test thoroughly—consent gaps are a common CAPI pitfall.
Data minimization in CAPI events
CAPIs can transmit extensive data including PII like email addresses. Apply data minimization: only send data actually needed for conversion attribution, hash identifiers appropriately, avoid transmitting sensitive transaction details unless necessary, and configure appropriate data retention on receiving platforms. More data isn't better if it's not justified.
Platform-specific requirements
Each platform's CAPI has distinct requirements: Meta requires specific data processing terms, Google has ads data processing terms, and various platforms impose technical requirements for data formatting and transmission. Review and execute required legal agreements before implementation. Consider unified CAPI management solutions that handle multi-platform compliance.
Related reading
This guide is general information, not legal advice. Reading it does not create an attorney-client relationship. The law is stated as of January 28, 2026.
Got questions?
Every business is different. Let's discuss how these principles apply to your specific situation.
Book a call