Better Together: Integrating GetCAPI with GetCookies CMP

# Better Together: Integrating GetCAPI with GetCookies CMP **Date:** July 05, 2026 **Author:** Sarah Chen, Privacy Engineer **Category:** Technical **Reading Time:** 12 min --- The biggest risk of server-side tracking is "Invisible Processing." When you track a user server-to-server, they can't see the request in their browser's Network tab. This makes it tempting to skip the consent step. **Don't do it.** GDPR and CCPA apply to *all* processing, whether it's visible in the browser or hidden on a server. The most robust way to handle this is by pairing **GetCookies** (your frontend CMP) with **GetCAPI** (your backend tracker). Here is how they work in perfect harmony. ## The Synchronization Workflow ### 1. Capturing the Signal When a user interacts with the GetCookies banner, a unique **Consent Token** is generated. This token contains the user's preferences (e.g., `analytics: true, marketing: false`). ### 2. Passing the Token to the Backend You include this token in your API calls to your own server. ```javascript // Example using fetch fetch('/api/purchase', { method: 'POST', body: JSON.stringify({ productId: '123', // Get the current consent state from the CMP consentToken: window.GetCookies.getConsentToken() }) }); ``` ### 3. Server-Side Routing in GetCAPI When your server notifies GetCAPI of the event, it passes the `consentToken`. GetCAPI decodes the token and applies the logic: * **Marketing = Granted:** Send event to Facebook CAPI and TikTok Events API. * **Marketing = Denied:** Drop the ad platform signals. * **Analytics = Granted:** Send anonymized event to GA4. ## Benefits of the Integration ### 1. Proof of Consent Every event sent via GetCAPI is cryptographically linked to a consent record in GetCookies. If a regulator asks, "Why did you track this user?", you have an immutable audit trail showing exactly when and where they clicked "Accept." ### 2. Unified Logic You don't have to write "If/Else" blocks for every ad platform. You define your privacy rules once in the GetCAPI dashboard, and it handles the heavy lifting of filtering events based on the GetCookies signal. ### 3. Improved Accuracy By using the same `gc_id` across both platforms, you ensure that your conversion data matches your consent analytics perfectly. No more discrepancies between "People who accepted cookies" and "People we tracked." ## Conclusion Server-side tracking without consent is a legal landmine. Browser-side consent without server-side enforcement is a data leak. By integrating GetCAPI and GetCookies, you build a closed-loop system that is both highly accurate and fully compliant.