Server-side tracking checklist: twenty points

Twenty items in four blocks — collection, identity, sending and reading. Each is verifiable in minutes, and each has been the root cause of a wrong number somebody defended in a meeting.

This is the operational summary of the series. Nothing here is theory: every item came from a defect found in production, and every one is verifiable without waiting for the next campaign cycle.

Use it as a check, not as reading. The value is in marking what you cannot answer.

Collection

• The pixel writes cookies on the root domain, not the specific subdomain.
• _fbc is built from the fbclid in the URL, and does not depend on Meta's script loading.
• _fbp is generated first-party, persisted for ninety days, and never regenerated when it already exists.
• The form captures email and phone, and identity survives navigation between pages.
• The session identifier is injected into the checkout link, at the START of the tracking field.

Identity

• Email is normalised — lowercase, trimmed — before sha256.
• Phone carries digits only, with the country code.
• user_data is assembled from the person's history, not only from the payload that just arrived.
• Inferred fields, such as gender, are left empty when the inference is ambiguous.
• The same person on two devices is recognised as one when the email repeats.

Sending

• event_id comes from business identity — order or transaction number — never generated at send time.
• Browser and server send the SAME event_id for the same event.
• The status filter was written against a sample of the REAL payload, not the documentation.
• Subscription renewals do not go up as new sales.
• History sync does not emit conversions; only the webhook emits.
• action_source reflects where the conversion actually happened.
• The event name is one of the names the destination platform recognises.

Reading

• You can open a real delivery's payload and check it field by field.
• You know the percentage of sends that carried email, phone and fbc over the last seven days.
• You have compared, over the same period, what the platform credited with what your records say.

If you cannot answer the last three, the first seventeen are opinion: there is no way to know whether they hold.

The order of attack

If many items came out blank, do not try to fix them all. This order returns the most per unit of effort:

1. 01Start with the reading block. Without measurement you fix in the dark and cannot tell whether it improved.
2. 02Then the filter on what goes up. It is the cheapest item and the one that most prevents campaigns learning wrong.
3. 03Then identity. That is where the matching ceiling lives, and it does not rise through configuration.
4. 04Collection last. It is the longest work, and it pays little while the other three are broken.

This order goes against instinct — the temptation is to start by installing something new. But measuring costs an afternoon and installing costs weeks; starting with the expensive part is how the effort gets lost.

The pieces in this series cover each block in detail: match quality for identity, the truncated identifier for collection, deduplication and destinations for sending, and the tracking audit for reading.