Table of content
A few months ago, we met the head of a fine Swiss e-commerce brand. His pride: being "data-driven". In his company, he assured us, no decision was made without data. Yet the audit of his tracking showed that a large share of his sales appeared neither in his dashboards nor in Google Ads or Meta. He was not steering with data: he was driving blindfolded.
In short
Ageing client-side tracking lets sales slip away, and ad algorithms learn from a truncated reality.
A privacy policy approved by a lawyer says nothing about how the code actually behaves.
The risk is twofold: weaker performance and technical non-compliance.
First-party server-side measurement that respects the visitor's choice reconciles both.
The silent sinking of your ad performance
This CEO's problem was neither budget nor talent, but an outdated measurement setup built entirely on scripts running in the browser. And the environment has changed:
Shorter cookies (ITP): Safari, widely used on iPhones, caps cookies set via JavaScript at 7 days. A customer who comes back to buy after ten days counts as a new visitor, and your loyalty analyses (LTV) become skewed.
Ad blockers: according to GWI (Q2 2025), 30.9% of Swiss internet users use one. Many stop your measurement scripts from loading.
Underfed algorithms: Google Ads and Meta Ads optimise from the conversions they receive. When some are missing:
they underestimate your campaigns;
they show your ads less to the profiles that buy;
your reported acquisition cost rises artificially.
The financial consequence is direct: you cut budgets on campaigns that may well be profitable, simply because you cannot see their results. To estimate your own gap, follow the method in our article on the cost of faulty tracking.
The unexpected culprit: a false sense of legal security

Faced with the results, the CEO's first reaction was denial: "Impossible. My lawyers approved everything last week. We are compliant."
That is the great misunderstanding. Having a privacy policy drafted by a good law firm does not guarantee that the site behaves the way it describes. An analogy:
The lawyer writes the highway code: they tell you what you are allowed to do.
The tracking expert is the mechanic: they check that the car has brakes and that the engine runs.
Here, the texts had been approved. But technically, advertising tags were sending data to US providers before the visitor made any choice, without valid consent. At the same time, legitimate transactions were not being measured.
The result: a double penalty.
Business: lost performance, for lack of reliable marketing data.
Legal: a real gap with the FADP and, for EU visitors, the GDPR, because the code did not keep the promises made to users. The FADP requires transparent information on processing and recipients; the EU additionally requires prior consent for non-essential cookies.
A signed PDF does not fix tracking. It only gives false reassurance while profitability erodes. Our FADP and GDPR compliance guide explains both levels of control.
Regaining control with first-party server-side measurement
To reconcile performance and compliance, the modern route is server-side tracking. Instead of letting the browser talk directly to Google or Meta, data passes through a server you control, on your own subdomain.
More complete measurement: first-party collection is more resilient to browsers' technical restrictions. Your dashboards get closer to the reality of your back office.
Better-fed algorithms: Google and Meta receive more reliable, deduplicated conversions and optimise on a sounder basis.
Verifiable compliance: the server acts as an airlock. You filter, minimise and control what goes to each provider.
Key point: server-side does not bypass blockers or consent. A refusal stays a refusal. It makes authorised measurement reliable, nothing more, and that is already a lot.
Data-driven or data-blind: the self-check

Before calling yourself data-driven, ask these questions:
Do sales in your back office and in GA4 roughly match for the last month?
Do you know which tags fire before the visitor makes a choice?
Does your privacy policy really list every tool on the site?
Are the conversions sent to Google Ads and Meta deduplicated?
Does someone check tracking after every site update?
A-Track tip
Have your privacy policy and your tracking reviewed together, by the lawyer and by the technical expert. The problem almost always lies in the gap between the two.
Conclusion: the facts don't lie
This CEO chose not to follow up, preferring to believe his lawyers were also handling the technical side. That choice will keep weighing on his margins.
Being data-driven does not mean having dashboards full of wrong figures. It means making sure the infrastructure that captures them is solid, durable and compliant. Start by comparing your real sales with your reports, then run our 15-point tracking audit checklist.
Are you running your online shop on complete figures?
A-Track compares your back-office sales with GA4, Google Ads and Meta, then checks that the code does what your privacy policy promises.
A free tracking and compliance audit, delivered within 48 hours.