As Facebook pushes a replacement for its increasingly weak tracker, advertisers weigh privacy risk and reward

“Server-side conversion tracking is shifting who is making those consent-driven decisions from the user in the browser to the publisher on the back end,” said Drew Lanenga, chief data scientist at Lytics, a customer data platform that allows advertiser clients to set up Facebook’s CAPI system. “The consumer has less control. And as technology puts people in less control, the responsibility falls onto brands,” he said.

Facebook has offered CAPI to all advertisers since September 2019 as a supplement to — and eventual replacement for — its tracking pixel. Brand advertisers and agency execs Digiday spoke to for this story said Facebook is pushing advertisers to get on board with the server-side tracking tech, selling it as the shiny, new measurement data hot rod they ought to be driving. And some advertisers are responding. Over the last six months, “our analytics engineering team, multiple times per week are getting requests to help our clients with [Facebook] CAPI implementations,” said Andrew Richardson, svp analytics and marketing science at Tinuiti. 

“We’re evolving our products to provide people with more visibility into and control over how their data is used for ads. This supports our efforts to collaborate with the industry on standards and to develop privacy-enhancing technologies, which will enable ad personalization while minimizing the amount of personal information we process,” a Facebook spokesperson told Digiday.

Replacing pieces in the ad measurement puzzle

Other ad tech firms such as Mixpanel, TransUnion’s Signal and Twilio Segment have introduced server-side conversion tracking products over the last few years and Google, in recent months, has more gradually rolled out some server-side conversion tracking capabilities. However, Facebook has a powerful influence on millions of advertiser choices, so the fact that, for nearly two years, the company has steered advertisers in the direction of server-side tracking that circumvents the browser has a big impact, said Tinuiti’s Richardson. “What is driving a lot of the eyes on server-side tracking is because of Facebook,” he said.

In general as cross-app tracking, the Facebook pixel and third-party cookies lose efficacy, “there is that break in the information loop for Facebook, which is why they are making a lot of noise” about using CAPI, said Farhad Divecha, founder of U.K.-based digital marketing agency AccuraCast.

While many advertisers have yet to implement server-side conversion tracking, those that have said they are detecting conversions they may have missed as a result of browser-based tracker deprecation. And, while Facebook’s CAPI doesn’t let advertisers completely get over walls Apple users can erect to evade trackers, the company does have a means of seeing around them. According to a Facebook spokesperson, if a Facebook or Instagram user opts out of tracking when using an Apple device, Facebook could use data gleaned through its server-side process about that user’s off-Facebook activity to target personalized ads to them if it’s been aggregated or de-identified first.

Switching to the server-side process “is critical for performance-based advertising on Facebook,” because it replaces how Facebook has been able to track via web browsers through its pixel, said T.K. Stohlman, president of Autoscale.ai, which uses CAPI for Facebook ads the company runs to promote Fanprint, a collegiate sports apparel brand that customizes products for niche groups like nurses who are Kansas Jayhawks fans.

Getting set up to use CAPI requires varying levels of technical work depending on whether companies want to enable it in their Facebook-integrated Shopify store, through a data platform service such as Lytics or Segment or to connect Facebook’s API to servers a company owns or manages, which may be more of an I.T. department burden. Either way, implementing the tracking process is “well worth doing,” said James Parker, chief solutions officer of data and planning at digital agency Jellyfish, noting that the agency’s clients that have set it up have right away spotted as many as 30% more conversions attributed to ads on Facebook show up as a result. 

Opening the data floodgates

The method allows advertisers to track when exposure to a Facebook ad led someone to look at a product page, add a product to an online shopping cart, download a report, download a mobile app, open an email, use a chatbot or even when it prompted them to do things in real life like make a purchase at a physical store or show interest in a service while talking to a customer rep on the phone. If fully tapped, the server-side process opens the Facebook platform to a variety of sources that feed data directly to Facebook’s servers via the Conversions API from servers that host an advertiser’s or retailer’s site or the platforms they use to track offline actions.

In turn, that data informs future ad targeting and optimization, enabling advertisers to continue doing what they’ve come to love Facebook for — retarget ads to people featuring a product they looked at — and allowing Facebook to build new audiences for advertisers to target people who are likely to have interest in those products.

“You don’t have to open those floodgates, though” said Richardson,” who said advertisers can choose solely to send Facebook email addresses or phone numbers to detect conversions. “The thing about CAPI is you as the brand get to choose what you put into it,” he said.

Facebook stresses that no data is being shared through CAPI that advertisers couldn’t share with the company before through its other tools such as its Offline Conversion API or App Events API. But CAPI requires a personally-identifiable data point like an email address, phone number or IP address in order to match the ad exposure to conversion events. And, while advertisers have been able to share that sort of personally identifiable data through Facebook’s pixel, the browser-based tech does not need that information to confirm a conversion. 

“In my experience, advertisers typically don’t send names, emails or phone numbers through the pixel,” said Ty Martin, founder of Facebook ad consultancy Audience Kitchen.

Server-side tracking keeps certain data out of the browser, especially sensitive data that advertisers want to make sure is secure. And Facebook’s developer specifications for CAPI say that hashing, which protects data privacy during transfer from server to server, is “needed” when passing customer information including emails, phone number, birthdate, names, address or location information and gender. 

Balancing risks of a ‘boundary crossed’

But hashing won’t be enough to convince some heavily regulated brands to switch, said Marilois Snowman, founder and chief executive architect of media tech consultancy Mediastruction. “A lot of the brands in healthcare and finance are going to be very wary of server-side conversion tracking due to regulatory and compliance constraints, and logistically it’s a challenge because of the requirements of their third-party processors who manage conversions outside of the brands’ owned web assets.”

While Tinuiti’s clients have shown increased interest in CAPI in recent months, Richardson said the majority of them are unwilling to take the risk of over-sharing with the platforms including Facebook. “They are thinking about the privacy risks of giving too much data to the platforms,” he said.

Facebook requires advertisers sharing people’s personal data with the platform to provide notice on pages using its trackers and links to opt out. However, advertisers aren’t going out of their way to notify people specifically about data sharing with Facebook through CAPI, according to Jellyfish’s Parker. Instead advertisers rely on existing privacy policies and terms and conditions that note that people’s personal information might be shared with marketing partners, he said. Facebook users who want to opt out from data sharing via CAPI or other measurement tools can disable it through a multi-step process in their Facebook settings. 

Facebook “has every intention to find ways to allow their customers to keep running ads,” said Algae’s MacLeod. But, with tools like server-side conversion tracking, “There could be a boundary crossed there, and we need to figure out how to properly monitor that and find the right balance,” she said, adding, “I have to also consider [the people] on the other end of the ads, so there’s a whole other side of this.”