{"id":12930,"date":"2026-10-02T19:17:56","date_gmt":"2026-10-02T17:17:56","guid":{"rendered":"https:\/\/voctos.net\/server-side-tagging-arab-markets\/"},"modified":"2026-10-02T21:36:04","modified_gmt":"2026-10-02T19:36:04","slug":"server-side-tagging-arab-markets","status":"publish","type":"post","link":"https:\/\/voctos.net\/ar\/server-side-tagging-arab-markets\/","title":{"rendered":"Server-Side Tagging for Arab Websites: Hosting Regions, First-Party Domains and Data Laws"},"content":{"rendered":"<p>Server-side tagging moves your tags off the browser and onto a server you control. For Arab websites, the hard decisions are where that server runs and what it forwards. On 2 October 2026 we counted 16 live public cloud regions in six Arab countries, and found only 2 of 29 Arab brand homepages loading Google&#8217;s tag from their own domain.<\/p>\n<blockquote>\n<p><strong>Key takeaways<\/strong><\/p>\n<ul>\n<li>16 public cloud regions were live in Arab countries on 2 October 2026: 6 in the UAE, 5 in Saudi Arabia, 2 in Qatar, and 1 each in Bahrain, Morocco and Egypt. Egypt&#8217;s only one is Huawei Cloud&#8217;s Cairo region.<\/li>\n<li>Google Cloud Run runs in Doha (me-central1) and Dammam (me-central2), but neither supports Cloud Run domain mapping, so a first-party subdomain needs a load balancer.<\/li>\n<li>Of 29 Arab brand homepages we checked, 20 ran a Google tag, 2 served it from their own domain, and 3 of the 20 declared a Consent Mode default.<\/li>\n<li>Saudi, UAE and Egyptian law all restrict sending personal data abroad. A server container can strip IPs and identifiers first; it does not give you a lawful basis or consent.<\/li>\n<\/ul>\n<\/blockquote>\n<h2>What is server-side tagging, and how does it differ from Google tag gateway?<\/h2>\n<p>With server-side tagging, a tagging server sits between the browser and your vendors. The page sends one stream of events to your own subdomain, and a server container decides what each vendor gets. Google tag gateway for advertisers is the lighter option: your CDN proxies Google&#8217;s scripts and hits through your domain, but nothing in that path rewrites the data.<\/p>\n<p>Google renamed first-party mode to Google tag gateway on 8 May 2025, per the <a href=\"https:\/\/support.google.com\/tagmanager\/answer\/4620708?hl=en\" target=\"_blank\" rel=\"noopener\">Tag Manager release notes<\/a>. After Cloudflare came Akamai and Fastly (May 2026), then Google Cloud and CloudFront (June 2026). <a href=\"https:\/\/developers.cloudflare.com\/google-tag-gateway\/\" target=\"_blank\" rel=\"noopener\">Cloudflare<\/a> offers it free.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Setup<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Scripts and hits go through<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Can change data before vendors see it<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Standard client-side tags<\/td>\n<td style=\"padding:12px 16px\">Google and vendor domains, straight from the browser<\/td>\n<td style=\"padding:12px 16px\">No<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Google tag gateway for advertisers<\/td>\n<td style=\"padding:12px 16px\">A path on your domain, via your CDN, then Google<\/td>\n<td style=\"padding:12px 16px\">No, Google tags are only proxied<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Server-side Google Tag Manager<\/td>\n<td style=\"padding:12px 16px\">Your subdomain and your tagging server<\/td>\n<td style=\"padding:12px 16px\">Yes, per tag and per vendor<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/tag-manager\/gateway\/setup-guide\" target=\"_blank\" rel=\"noopener\">gateway setup guide<\/a> recommends it &#8220;for the most durable tag configuration&#8221;. Managed hosts sit in between; Stape lists one Arab zone, ME Center (Qatar), on its <a href=\"https:\/\/stape.io\/helpdesk\/documentation\/sgtm-server-locations-zones\" target=\"_blank\" rel=\"noopener\">server zones page<\/a>.<\/p>\n<h2>Arab-country cloud regions in October 2026<\/h2>\n<p>Sixteen public cloud regions were live in Arab countries when we checked official provider pages on 2 October 2026. Google&#8217;s tagging server ships as a Docker image, so it can run on any of them, but only Google Cloud offers the guided Cloud Run setup. Microsoft and AWS have announced Saudi regions that are not live yet.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Provider<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Live regions in Arab countries<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Count<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Access notes<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\"><a href=\"https:\/\/docs.cloud.google.com\/run\/docs\/locations\" target=\"_blank\" rel=\"noopener\">Google Cloud<\/a><\/td>\n<td style=\"padding:12px 16px\">Doha, Qatar (me-central1); Dammam, Saudi Arabia (me-central2)<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">Cloud Run in both, Tier 2 pricing. <a href=\"https:\/\/docs.cloud.google.com\/docs\/dammam-region-access\" target=\"_blank\" rel=\"noopener\">Dammam<\/a>: Saudi-billed customers buy through CNTXT; others need invoiced billing<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\"><a href=\"https:\/\/docs.aws.amazon.com\/global-infrastructure\/latest\/regions\/aws-regions.html\" target=\"_blank\" rel=\"noopener\">AWS<\/a><\/td>\n<td style=\"padding:12px 16px\">UAE (me-central-1); Bahrain (me-south-1)<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">Opt-in regions<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/reliability\/regions-list\" target=\"_blank\" rel=\"noopener\">Microsoft Azure<\/a><\/td>\n<td style=\"padding:12px 16px\">UAE North, Dubai; UAE Central, Abu Dhabi; Qatar Central, Doha<\/td>\n<td style=\"padding:12px 16px\">3<\/td>\n<td style=\"padding:12px 16px\">UAE Central access is restricted<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\"><a href=\"https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/General\/Concepts\/regions.htm\" target=\"_blank\" rel=\"noopener\">Oracle Cloud<\/a><\/td>\n<td style=\"padding:12px 16px\">Riyadh; Jeddah; Abu Dhabi; Dubai; Casablanca, Morocco<\/td>\n<td style=\"padding:12px 16px\">5<\/td>\n<td style=\"padding:12px 16px\">None stated<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\"><a href=\"https:\/\/www.alibabacloud.com\/help\/en\/cloud-migration-guide-for-beginners\/latest\/regions-and-zones\" target=\"_blank\" rel=\"noopener\">Alibaba Cloud<\/a><\/td>\n<td style=\"padding:12px 16px\">Dubai (me-east-1); Riyadh (me-central-1)<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">Riyadh is a partner region<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\"><a href=\"https:\/\/support.huaweicloud.com\/intl\/en-us\/intl_faq\/en-us_topic_0115884695.html\" target=\"_blank\" rel=\"noopener\">Huawei Cloud<\/a><\/td>\n<td style=\"padding:12px 16px\">ME-Riyadh; AF-Cairo, Egypt<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">Cairo is the only region we found in Egypt<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Announced, not live<\/td>\n<td style=\"padding:12px 16px\">Azure Saudi Arabia East; AWS Saudi Arabia; Google Cloud Kuwait<\/td>\n<td style=\"padding:12px 16px\">0<\/td>\n<td style=\"padding:12px 16px\"><a href=\"https:\/\/news.microsoft.com\/source\/emea\/2026\/08\/microsoft-announces-saudi-arabia-east-datacenter-region-will-be-available-in-november-2026\/\" target=\"_blank\" rel=\"noopener\">Microsoft<\/a>: November 2026; <a href=\"https:\/\/www.aboutamazon.com\/news\/aws\/aws-cloud-region-saudi-arabia\" target=\"_blank\" rel=\"noopener\">AWS<\/a>: December 2026; Kuwait announced January 2023, no date<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Three details change the build. Cloud Run domain mapping works in ten regions, none in the Middle East, and Google&#8217;s <a href=\"https:\/\/docs.cloud.google.com\/run\/docs\/mapping-custom-domains\" target=\"_blank\" rel=\"noopener\">custom domain guide<\/a> calls it not production-ready anyway, so in Doha or Dammam you front the service with a global external Application Load Balancer. A card-paying account cannot deploy to Dammam. And &#8220;in country&#8221; only describes where the server processes and logs requests; a forwarded event still travels to the vendor&#8217;s endpoint.<\/p>\n<p>Egypt has no Google, AWS, Azure, Oracle or Alibaba region. Huawei&#8217;s Cairo region, <a href=\"https:\/\/www.huaweicloud.com\/intl\/en-us\/news\/20240523155312706.html\" target=\"_blank\" rel=\"noopener\">launched 21 May 2024<\/a>, is the in-country option, using Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/tag-manager\/server-side\/manual-setup-guide\" target=\"_blank\" rel=\"noopener\">manual setup guide<\/a>. We have not tested it.<\/p>\n<h2>What did our crawl of 29 Arab brand homepages show?<\/h2>\n<p>Server-side tagging is rare on Arab brand homepages. On 2 October 2026, 20 of the 29 homepages we reached ran a Google tag within 4.5 seconds. Only 2 loaded Google&#8217;s tag script from their own domain, the visible sign of first-party serving. Three of the 20 declared a Consent Mode default before tags ran.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Signal in the live page (2 Oct 2026)<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Sites<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Base<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Google tag running within 4.5 seconds<\/td>\n<td style=\"padding:12px 16px\">20<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Google tag script served from the brand&#8217;s own domain<\/td>\n<td style=\"padding:12px 16px\">2<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Consent Mode default declared<\/td>\n<td style=\"padding:12px 16px\">3 (15%)<\/td>\n<td style=\"padding:12px 16px\">20 with a running Google tag<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">At least one Meta, TikTok, Snap or X pixel<\/td>\n<td style=\"padding:12px 16px\">14<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Meta \/ TikTok \/ Snap \/ X pixel<\/td>\n<td style=\"padding:12px 16px\">12 \/ 9 \/ 7 \/ 5<\/td>\n<td style=\"padding:12px 16px\">29 homepages<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The two first-party sites, a Saudi pharmacy and an Egyptian retailer, showed no Consent Mode default in our window. Fourteen sites fired social pixels straight from the browser, traffic a server container would take over through conversions APIs.<\/p>\n<p>Our signal undercounts: a site loading gtag.js from Google but sending hits to its own server would pass unseen. Treat 2 of 29 as a floor.<\/p>\n<h2>What do Saudi, UAE and Egyptian laws say about sending tag data abroad?<\/h2>\n<p>All three countries restrict transfers of personal data abroad, and tag hits carrying IP addresses, cookie IDs or hashed emails can identify a person. A server container helps you send less. You still need a lawful basis and consent, and an event forwarded to a foreign vendor is still a transfer abroad.<\/p>\n<p>This is a summary of official texts, not legal advice.<\/p>\n<ul>\n<li><strong>Saudi Arabia.<\/strong> PDPL Article 29 governs transfers. SDAIA&#8217;s <a href=\"https:\/\/dgp.sdaia.gov.sa\/wps\/wcm\/connect\/e5bbede0-1119-4f70-b4ef-f043ce58d780\/Regulation+on+Personal+Data+Transfer+Outside+the+Kingdom..pdf?MOD=AJPERES\" target=\"_blank\" rel=\"noopener\">transfer regulation<\/a> (version 2.0, August 2024) requires safeguards such as standard contractual clauses for exempted transfers, plus a risk assessment showing data is kept to the minimum. See our <a href=\"https:\/\/voctos.net\/saudi-pdpl-marketing-compliance\/\">Saudi PDPL guide for marketers<\/a>.<\/li>\n<li><strong>UAE.<\/strong> Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, sets cross-border rules (<a href=\"https:\/\/u.ae\/en\/about-the-uae\/digital-uae\/data\/data-protection-laws\" target=\"_blank\" rel=\"noopener\">u.ae<\/a>). Article 22 covers countries the UAE Data Office treats as adequate; Article 23 adds grounds such as a contract binding the recipient to equivalent protection (<a href=\"https:\/\/cms.law\/en\/are\/legal-updates\/UAE-legal-reforms-new-UAE-data-protection-law\" target=\"_blank\" rel=\"noopener\">CMS summary<\/a>).<\/li>\n<li><strong>Egypt.<\/strong> Law No. 151 of 2020, Article 14, allows transfer abroad only to equal or stronger protection and with a License or Permit from the Personal Data Protection Center (<a href=\"https:\/\/www.acc.com\/sites\/default\/files\/program-materials\/upload\/Data%20Protection%20Law%20-%20Egypt%20-%20EN%20-%20MBH.PDF\" target=\"_blank\" rel=\"noopener\">unofficial translation<\/a>). Our <a href=\"https:\/\/voctos.net\/consent-mode-tracking-arab-websites\/\">Consent Mode study of Arab websites<\/a> covers the Executive Regulations timeline.<\/li>\n<\/ul>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">A server container can<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">It does not<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Drop or truncate the visitor IP before forwarding<\/td>\n<td style=\"padding:12px 16px\">Give you a lawful basis<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Strip emails and tokens from URLs and parameters<\/td>\n<td style=\"padding:12px 16px\">Collect consent; the browser banner does that<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Hash contact fields to each vendor&#8217;s SHA-256 spec<\/td>\n<td style=\"padding:12px 16px\">Anonymise them; vendors hash-match to find the person<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Give one control point per vendor for a transfer risk assessment<\/td>\n<td style=\"padding:12px 16px\">Keep data in the country once a vendor abroad receives it<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Developer playbook: server-side GTM for an Arab site<\/h2>\n<p>The build has four parts: gtag.js or a web container on the page, a first-party subdomain such as metrics.brand.com, a tagging server, and a server container. Requests go from the browser to metrics.brand.com, through a load balancer into Cloud Run, where the server container sends each event on to GA4, Google Ads, Meta, TikTok or OpenAI.<\/p>\n<ol>\n<li>Create a server container in Tag Manager and provision Cloud Run. Check the region in the Cloud Run console afterwards.<\/li>\n<li>Keep minimum instances at 2 and maximum at 10, CPU always allocated, as in Google&#8217;s deploy command. Run exactly one preview server.<\/li>\n<li>Build a global external Application Load Balancer with a serverless endpoint group and a managed certificate, then add the DNS record below.<\/li>\n<li>Add the server URL in Tag Manager&#8217;s container settings, set <code>server_container_url<\/code> on the web Google tag, and let the server&#8217;s GA4 client serve gtag.js.<\/li>\n<li>Add the subdomain to <code>img-src<\/code>, <code>connect-src<\/code> and <code>frame-src<\/code>, per Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/tag-manager\/server-side\/send-data\" target=\"_blank\" rel=\"noopener\">send-data guide<\/a>.<\/li>\n<\/ol>\n<pre><code>; DNS: Cloud Run behind a global external Application Load Balancer\nmetrics.brand.com.   300  IN  A      203.0.113.10   ; load balancer static IP\n; DNS: managed host that gives you a CNAME target instead\nmetrics.brand.com.   300  IN  CNAME  your-host-target.example.net.\n\n# Cloud Run: two warm instances in Doha\ngcloud run services update server-side-tagging \\\n  --region me-central1 --min-instances 2 --max-instances 10 --no-cpu-throttling\n\n&lt;!-- Page: load gtag.js from your subdomain and send hits there --&gt;\n&lt;script async src=\"https:\/\/metrics.brand.com\/gtag\/js?id=G-XXXXXXX\"&gt;&lt;\/script&gt;\n&lt;script&gt;\n  window.dataLayer = window.dataLayer || [];\n  function gtag(){dataLayer.push(arguments);}\n  \/\/ Consent Mode default goes here, before config\n  gtag('js', new Date());\n  gtag('config', 'G-XXXXXXX', {\n    server_container_url: 'https:\/\/metrics.brand.com',\n    site_language: location.pathname.startsWith('\/ar') ? 'ar' : 'en'\n  });\n&lt;\/script&gt;<\/code><\/pre>\n<p><strong>Region.<\/strong> Pick by audience, then residency. Gulf audiences fit Doha or Dammam. Egypt-heavy sites have no Google region at home, so time a test service in two candidate regions from real users first.<\/p>\n<p><strong>Cost.<\/strong> Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/tag-manager\/server-side\/cloud-run-setup-guide\" target=\"_blank\" rel=\"noopener\">Cloud Run setup guide<\/a> prices each server at about $45 a month (1 vCPU, 0.5 GB), recommends at least 2, and expects 2 to 10 servers to handle 35 to 350 requests per second. The load balancer, geo headers and request logging add more; Google advises turning request logging off above about 1 million requests a month.<\/p>\n<p>Want this priced against your own traffic? <a href=\"https:\/\/www.voctos.com\/web-development\/\" target=\"_blank\" rel=\"noopener\">Scope my server-side tagging build<\/a>.<\/p>\n<h2>What should the server container strip or add before data leaves?<\/h2>\n<p>Decide, per vendor, which fields it needs and which it never gets. That usually means removing or truncating the IP for analytics, cleaning personal data out of URLs, and hashing contact fields only for ad platforms that match on them, only when consent allows. Google&#8217;s transformations cover most of it.<\/p>\n<table style=\"width:100%;border-collapse:collapse;font-size:14px\">\n<thead>\n<tr style=\"background:#0a2e1a;color:#fff\">\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Destination<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">What its docs ask for<\/th>\n<th style=\"padding:13px 16px;text-align:left;font-weight:600\">Server-side change<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">GA4<\/td>\n<td style=\"padding:12px 16px\"><code>ip_override<\/code> in common event data<\/td>\n<td style=\"padding:12px 16px\">Exclude or rewrite it with a <a href=\"https:\/\/developers.google.com\/tag-platform\/tag-manager\/server-side\/transformations\" target=\"_blank\" rel=\"noopener\">transformation<\/a>; strip emails from <code>page_location<\/code><\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">Meta Conversions API<\/td>\n<td style=\"padding:12px 16px\">SHA-256 contact fields; unhashed real <code>client_ip_address<\/code> (<a href=\"https:\/\/developers.facebook.com\/docs\/marketing-api\/conversions-api\/parameters\/customer-information-parameters\" target=\"_blank\" rel=\"noopener\">docs<\/a>)<\/td>\n<td style=\"padding:12px 16px\">Share <code>event_id<\/code> with the Pixel; truncating the IP lowers matching<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">TikTok Events API<\/td>\n<td style=\"padding:12px 16px\">Pixel plus Events API with deduplication (<a href=\"https:\/\/ads.tiktok.com\/help\/article\/events-api\" target=\"_blank\" rel=\"noopener\">docs<\/a>)<\/td>\n<td style=\"padding:12px 16px\">Send matching events and IDs from both sides<\/td>\n<\/tr>\n<tr style=\"background:#fff;border-bottom:1px solid #e5e7eb\">\n<td style=\"padding:12px 16px;font-weight:600;color:#0a2e1a\">OpenAI Conversions API<\/td>\n<td style=\"padding:12px 16px\">Lowercase SHA-256 hex for email, phone and names; raw IP (<a href=\"https:\/\/developers.openai.com\/ads\/conversions-api\" target=\"_blank\" rel=\"noopener\">docs<\/a>)<\/td>\n<td style=\"padding:12px 16px\">Reuse the Pixel&#8217;s <code>event_id<\/code> as the API <code>id<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Our <a href=\"https:\/\/voctos.net\/chatgpt-ads-conversion-tracking\/\">ChatGPT Ads conversion tracking guide<\/a> covers the OpenAI side in full. Consent travels with each hit, per Google&#8217;s <a href=\"https:\/\/developers.google.com\/tag-platform\/tag-manager\/server-side\/consent-mode\" target=\"_blank\" rel=\"noopener\">server-side consent guide<\/a>, but Meta, TikTok and OpenAI tags need an explicit consent condition on their triggers. Without one, the server forwards events the banner was meant to stop.<\/p>\n<h2>How do you run one container for \/ar and \/en?<\/h2>\n<p>Use one web container, one server container and one tagging subdomain per registrable domain. Arabic and English paths on the same host share cookies and the same endpoint, so splitting containers by language only doubles maintenance. Send the language as an event parameter, register it as a custom dimension, and filter reports on it.<\/p>\n<p>Take the language from the URL path, not the <code>lang<\/code> attribute: in our crawl, 3 of 27 Arabic homepages declared the wrong language or none. Our <a href=\"https:\/\/voctos.net\/arabic-website-hreflang-lang-dir-audit\/\">lang, dir and hreflang audit<\/a> has the breakdown. Country domains such as brand.sa and brand.ae each need their own metrics subdomain in the container settings, with matching paths.<\/p>\n<h2>How do you know it is working?<\/h2>\n<p>Open Chrome DevTools, filter the Network panel by your subdomain and reload. gtag.js and the collect requests should go to metrics.brand.com, not to googletagmanager.com or google-analytics.com. Then confirm in Tag Manager&#8217;s server preview and in GA4 DebugView that each event arrives with only the fields you meant to send.<\/p>\n<ol>\n<li>In the Network panel, <code>\/g\/collect<\/code> hits land on your subdomain with 2xx status codes.<\/li>\n<li>In server preview, the GA4 client claimed each request, and outgoing requests carry no raw emails or untouched <code>ip_override<\/code>.<\/li>\n<li>In <a href=\"https:\/\/support.google.com\/analytics\/answer\/7201382\" target=\"_blank\" rel=\"noopener\">GA4 DebugView<\/a>, events arrive with <code>site_language<\/code>.<\/li>\n<li>Decline consent and repeat. The vendor requests should stop.<\/li>\n<\/ol>\n<h2>Failure modes we would check first<\/h2>\n<p>Broken server-side setups fail in predictable places: hits that never reach the subdomain, a preview mode that will not load, a security policy blocking requests, a region the account cannot use, and conversions counted twice. Each shows up in DevTools or the server preview within minutes.<\/p>\n<ul>\n<li><strong>Hits still reach google-analytics.com:<\/strong> one template, often the English layout or checkout, lacks <code>server_container_url<\/code>.<\/li>\n<li><strong>Preview will not connect:<\/strong> Google&#8217;s manual guide needs a load balancer or CDN timeout above 20 seconds.<\/li>\n<li><strong>CSP errors in the console:<\/strong> the subdomain is missing from <code>connect-src<\/code>.<\/li>\n<li><strong>Dammam deploy fails:<\/strong> the billing account is card-based.<\/li>\n<li><strong>Conversions double:<\/strong> Pixel and server events lack a shared event ID.<\/li>\n<\/ul>\n<h2>How we checked<\/h2>\n<p>We loaded each brand&#8217;s Arabic homepage in desktop Chrome on 2 October 2026, waited up to 4.5 seconds, and read the live page with JavaScript, recording Google tag IDs, the origin of Google&#8217;s tag script, Google&#8217;s consent object and ad pixel globals. The same day we read each cloud provider&#8217;s official region page.<\/p>\n<ul>\n<li>One page per site, one visit; tags that load on scroll, click or after consent are not counted.<\/li>\n<li>The 4.5-second window cuts off deferred loading by design.<\/li>\n<li>Our connection was in Cairo, and at least one regional retailer redirected us to its Egypt store.<\/li>\n<li>No Core Web Vitals field data was collected.<\/li>\n<li>8 of 37 sites (22%) returned a bot challenge or blank page and are excluded.<\/li>\n<li>The cloud table covers six providers&#8217; public regions only.<\/li>\n<\/ul>\n<h2>Our read<\/h2>\n<p>Decide what you need to change before you decide where the server sits. If your site runs only Google tags behind Cloudflare, Akamai, Fastly or CloudFront, Google tag gateway is a free, low-maintenance first step. Move to a server container once you send Meta, TikTok or OpenAI conversions, or need to strip data before it leaves.<\/p>\n<p>Host in Doha or Dammam when residency or Saudi billing gives you a reason; otherwise pick by measured latency. Never sell server-side tagging as compliance. It makes data minimisation provable, while the lawful basis and consent still come from the page.<\/p>\n<p>So the first check is not a region at all. Can you name every field each vendor receives today? If you can, choose a region and build. If you cannot, inventory the pixels already on your pages first. <a href=\"https:\/\/www.voctos.com\/web-development\/\" target=\"_blank\" rel=\"noopener\">Audit my tags before we move them server-side<\/a>, or if organic reporting depends on those GA4 numbers, <a href=\"https:\/\/www.voctos.com\/seo\/\" target=\"_blank\" rel=\"noopener\">keep my SEO data clean through the migration<\/a>.<\/p>\n<h2>FAQ<\/h2>\n<h3>Does server-side tagging make our site PDPL compliant?<\/h3>\n<p>No. A server container can drop IPs, remove emails from URLs and block a vendor, which helps you show data minimisation. It does not create a lawful basis, collect consent or stop a transfer abroad when it forwards events to a foreign vendor. Saudi, UAE and Egyptian law still apply. This is not legal advice.<\/p>\n<h3>Can we host our tagging server inside Saudi Arabia?<\/h3>\n<p>Yes. Google Cloud Run runs in Dammam (me-central2), and Oracle, Alibaba Cloud and Huawei Cloud also run Saudi regions. Saudi-billed Google customers must buy through CNTXT, and other accounts need invoiced billing for Dammam. Hosting there keeps processing in the Kingdom, but data forwarded to a vendor leaves it.<\/p>\n<h3>Is Google tag gateway enough, or do we need a server container?<\/h3>\n<p>Tag gateway is enough when you only run Google tags and want them loading from your own domain through your CDN. It cannot rewrite data or feed Meta, TikTok or OpenAI conversion APIs. Choose a server container when you need to strip fields, hash identifiers or control several vendors from one place.<\/p>\n<h3>How much does server-side GTM cost to run on Cloud Run?<\/h3>\n<p>Google estimates about $45 a month per server with 1 vCPU and 0.5 GB of memory, and recommends at least two servers, so roughly $90 before other charges. Load balancing, request logging and geo headers add to that. Doha and Dammam sit in Cloud Run&#8217;s Tier 2 pricing, so check the calculator.<\/p>\n<h3>Our site has Arabic and English versions. Do we need two containers?<\/h3>\n<p>No. Arabic and English paths on one domain share the same cookies and tagging subdomain, so one web container and one server container cover both. Send the language as an event parameter taken from the URL path, because 3 of 27 Arabic homepages in our crawl declared the wrong language or none.<\/p>\n<p><script type=\"application\/ld+json\">\n{\n  \"@context\": \"https:\/\/schema.org\",\n  \"@graph\": [\n    {\n      \"@type\": \"BlogPosting\",\n      \"@id\": \"https:\/\/voctos.net\/server-side-tagging-arab-markets\/#article\",\n      \"headline\": \"Server-Side Tagging for Arab Websites: Hosting Regions, First-Party Domains and Data Laws\",\n      \"description\": \"16 public cloud regions were live in Arab countries in October 2026, yet only 2 of 29 Arab brand homepages served Google's tag first-party. Regions, setup, data laws and checks for server-side GTM.\",\n      \"datePublished\": \"2026-10-02\",\n      \"dateModified\": \"2026-10-02\",\n      \"inLanguage\": \"en\",\n      \"author\": {\n        \"@type\": \"Person\",\n        \"name\": \"Reem Sameh\",\n        \"jobTitle\": \"Senior Full-Stack Web Developer\",\n        \"url\": \"https:\/\/voctos.net\/team\/reem-sameh\/\",\n        \"worksFor\": {\n          \"@type\": \"Organization\",\n          \"name\": \"VOCTOS\",\n          \"url\": \"https:\/\/www.voctos.com\/\"\n        }\n      },\n      \"publisher\": {\n        \"@type\": \"Organization\",\n        \"name\": \"VOCTOS\",\n        \"url\": \"https:\/\/www.voctos.com\/\",\n        \"logo\": {\n          \"@type\": \"ImageObject\",\n          \"url\": \"https:\/\/voctos.net\/wp-content\/themes\/voctos-blog\/assets\/img\/logo.png\"\n        }\n      },\n      \"mainEntityOfPage\": \"https:\/\/voctos.net\/server-side-tagging-arab-markets\/\",\n      \"isBasedOn\": {\"@id\": \"https:\/\/voctos.net\/server-side-tagging-arab-markets\/#dataset\"}\n    },\n    {\n      \"@type\": \"Dataset\",\n      \"@id\": \"https:\/\/voctos.net\/server-side-tagging-arab-markets\/#dataset\",\n      \"name\": \"VOCTOS check of Arab-country cloud regions and 29 Arab brand homepages (October 2026)\",\n      \"description\": \"Public cloud regions in Arab countries from six providers' official region pages, plus a live-page check of 29 Arab brand homepages in Saudi Arabia, the UAE, Egypt, Qatar and Kuwait for Google tags, first-party tag serving, Consent Mode defaults and ad pixels, on 2 October 2026.\",\n      \"creator\": {\"@type\": \"Organization\", \"name\": \"VOCTOS\", \"url\": \"https:\/\/www.voctos.com\/\"},\n      \"datePublished\": \"2026-10-02\",\n      \"temporalCoverage\": \"2026-10-02\",\n      \"spatialCoverage\": [\"Saudi Arabia\", \"United Arab Emirates\", \"Egypt\", \"Qatar\", \"Kuwait\", \"Bahrain\", \"Morocco\"]\n    },\n    {\n      \"@type\": \"FAQPage\",\n      \"@id\": \"https:\/\/voctos.net\/server-side-tagging-arab-markets\/#faq\",\n      \"mainEntity\": [\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Does server-side tagging make our site PDPL compliant?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. A server container can drop IPs, remove emails from URLs and block a vendor, which helps you show data minimisation. It does not create a lawful basis, collect consent or stop a transfer abroad when it forwards events to a foreign vendor. Saudi, UAE and Egyptian law still apply. This is not legal advice.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Can we host our tagging server inside Saudi Arabia?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. Google Cloud Run runs in Dammam (me-central2), and Oracle, Alibaba Cloud and Huawei Cloud also run Saudi regions. Saudi-billed Google customers must buy through CNTXT, and other accounts need invoiced billing for Dammam. Hosting there keeps processing in the Kingdom, but data forwarded to a vendor leaves it.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is Google tag gateway enough, or do we need a server container?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Tag gateway is enough when you only run Google tags and want them loading from your own domain through your CDN. It cannot rewrite data or feed Meta, TikTok or OpenAI conversion APIs. Choose a server container when you need to strip fields, hash identifiers or control several vendors from one place.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"How much does server-side GTM cost to run on Cloud Run?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Google estimates about $45 a month per server with 1 vCPU and 0.5 GB of memory, and recommends at least two servers, so roughly $90 before other charges. Load balancing, request logging and geo headers add to that. Doha and Dammam sit in Cloud Run's Tier 2 pricing, so check the calculator.\"}\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Our site has Arabic and English versions. Do we need two containers?\",\n          \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. Arabic and English paths on one domain share the same cookies and tagging subdomain, so one web container and one server container cover both. Send the language as an event parameter taken from the URL path, because 3 of 27 Arabic homepages in our crawl declared the wrong language or none.\"}\n        }\n      ]\n    }\n  ]\n}\n<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>16 public cloud regions are live in Arab countries, yet only 2 of 29 Arab brand homepages served Google&#8217;s tag first-party in our Oct 2026 check. Where to host server-side GTM, how to set it up, and what data laws ask.<\/p>","protected":false},"author":2,"featured_media":12945,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"post_team_member":1296,"vb_event":"","vb_takeaways":"","vb_sources":"","vb_figure":"","vb_figure_label":"","vb_sector":"","vb_sample":"","vb_period":"","vb_engines":"","vb_method":"","vb_verified":"","footnotes":""},"categories":[54,53],"tags":[],"class_list":["post-12930","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics-measurement","category-research-data"],"acf":[],"_links":{"self":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts\/12930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/comments?post=12930"}],"version-history":[{"count":1,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts\/12930\/revisions"}],"predecessor-version":[{"id":12946,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/posts\/12930\/revisions\/12946"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/media\/12945"}],"wp:attachment":[{"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/media?parent=12930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/categories?post=12930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/voctos.net\/ar\/wp-json\/wp\/v2\/tags?post=12930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}