The architecture in one pass
Browser (and apps) send events to a first-party endpoint. A routing layer you operate holds three responsibilities, in order: gate (is there consent for this purpose, is this player suppressed), shape (per-destination field allowlists, hashing where required), dispatch (your analytics, the warehouse, and the ad platforms' conversion APIs — with dedup keys so double-counting is impossible). Everything interesting about the design lives in the first two; the third is vendor documentation.
Design decisions that matter
| Decision | The position that survives audits |
|---|---|
| Consent as gate or annotation | Gate. Events without the required consent state are not enriched-and-parked for later — they are not dispatched, and marketing destinations never see them |
| Allowlist vs blocklist | Per-destination field allowlists. New fields default to not-sent; blocklists forget faster than schemas grow |
| RG suppression placement | In the routing layer itself, upstream of every marketing destination — not in each campaign tool's audience settings |
| Event vocabulary | The same names and identity key as the platform event schema; a second marketing-only vocabulary is a second source of disputes |
| Dedup discipline | Producer-assigned event IDs shared between browser and server paths, so migration and hybrid periods do not double-count conversions |
What it fixes — and what it merely relocates
- Fixed: your own funnel analytics stop degrading with browser policy; page performance improves as third-party tags leave the client; one place to answer "what do we send to whom".
- Relocated: consent complexity — now explicit in routing logic instead of implicit in tag configs. This is an improvement only if the routing rules are versioned, reviewed and owned like the configuration matrix rows they resemble.
- Not fixed: cross-site attribution. Server-side capture strengthens what you observe on your own properties; it does not resurrect the third-party view of the open web. Budget decisions still move to experiments.
Operating it
Treat the stack as a small data product: monitor event volumes per destination against baselines (a silent 20% drop in dispatched conversions is a bidding incident, not a curiosity), reconcile platform-reported conversions against server-dispatched counts weekly, log consent state with every dispatch decision, and rehearse the deletion path — when a player exercises rights or self-excludes, the propagation to every destination should be a runbook, not a research project.
Continue reading: Consent management — the gate this architecture enforces. First-party data strategy — the asset the clean stream builds.