How Companies Use Conversions API to Track You Without Browser Cookies
Patrick Bushe
March 4, 2026 · 5 min read
Most people picture online tracking as cookies and pixels in their browser. Increasingly, though, companies send data about what you do straight from their own servers to ad platforms. Browser-based blockers can't see that traffic, because it never passes through your browser.
What a conversions API is
Meta's Conversions API, introduced in 2020, lets a business send events such as page views, sign-ups and purchases from its server directly to Meta. Google's Enhanced Conversions, TikTok's Events API and others work in similar ways. Businesses often use them alongside browser pixels, and Meta encourages both.
How it works
- You visit a store, maybe from an ad. The ad's click ID may be in the address. See link decoration.
- You buy something and enter your email address and phone number.
- The store's server scrambles those details using hashing, then sends them with the purchase details to the ad platform.
- The ad platform hashes the details it holds for its users the same way, finds a match, and links the purchase to your account and the ad you saw.
- If the browser pixel also fired, the two events are matched so the purchase isn't counted twice.
Why companies use it
- Browser restrictions and blockers stop many pixels from working.
- Server data is more reliable for measuring which ads lead to sales.
- Better measurement means ad platforms can target and optimize more precisely.
Is hashing anonymous?
Hashing hides the raw email address in transit, but the same email always produces the same hash, which is exactly what makes matching work. It links your activity to you; it doesn't anonymize it.
What you can still control
- Consent: in the EU and UK, server-side tracking for ads still needs a legal basis such as consent. Reject non-essential cookies and tracking on banners.
- Meta's off-platform activity: in Meta's Accounts Center, "Your activity off Meta technologies" shows businesses that sent your activity, and lets you disconnect future activity.
- Ad personalization: turn it off in Google's My Ad Center and Meta's Ad preferences.
- Separate email addresses: email alias services give each store a different address, so purchases are harder to match.
- Opt-out rights: in California and other US states, use "Do Not Sell or Share" links and Global Privacy Control.
Adding noise
Ghost Browser makes random background visits, so profiles built from your browsing are less accurate. It can't stop server-to-server data sharing, which is why the account settings above matter. See how retargeting works.
