Server-Side Tracking Case Study in Pakistan

The Client

The client is a Faisalabad-based online retailer of school and office supplies — notebooks, geometry sets, art materials, exam-stationery packs, and pre-assembled school bundles — that grew out of a family wholesale stationery business and has sold nationwide since 2019. Their own Shopify storefront carries the brand, with a Daraz flagship store alongside it, and the fulfilment operation runs on cash-on-delivery across all major cities and districts.

The business is brutally seasonal. Roughly 40% of annual revenue lands in the June-to-September back-to-school window, when monthly orders climb from a baseline of about 1,900 to 3,100–3,400 at peak, at an average order value near PKR 3,600. Marketing spend peaks in step: about PKR 3.4 million a month across Meta (roughly 65%, a mix of Advantage+ shopping and manual campaigns) and Google Ads (the balance, mostly Shopping with a search safety net). The team is founder-led with two in-house media buyers and a three-agent confirmation desk that phones every COD order before dispatch.

The marketing stack was standard for a mid-size Pakistani D2C operation: GA4 through Google Tag Manager, a Meta pixel installed years earlier by the original theme developer, and Merchant Center feeding Shopping — assembled piecemeal over four years by whoever happened to be closest to the problem at the time. Nothing about it had ever been audited end to end, which is typical and, as this engagement shows, expensive.

They engaged WeProms in July 2026, two weeks into the peak, after a frightening board meeting. Meta Ads Manager was reporting blended ROAS of 2.4x — below their 3.0x sustainability line — while Shopify revenue was actually up 11% year over year. Someone suspected the ads had stopped working; someone else suspected the tracking. Leadership had already cut budgets by 20% as a precaution, mid-peak, which is the most expensive possible moment to guess wrong. The brief was narrow: find out whether performance was broken or measurement was, before more budget decisions were made on bad numbers.

The Problem

Six weeks of reconciliation between Ads Manager, Google Ads, GA4, and the Shopify order export made the picture unambiguous: the ads had not stopped working, the measurement had. Paid-attributable orders in the store exceeded what the platforms could see by a wide margin, and the shortfall traced to five distinct, fixable causes.

• Ad platforms saw only 61% of paid-attributable orders. Across six weeks, Shopify’s order log attributed materially more purchases to paid clicks than either platform reported — a 39% hole in the signal that automated bidding optimizes against.
• A misconfigured consent banner gated everything. A developer had installed a strict EU-style consent modal that withheld all non-essential tags until explicit interaction. Only about 54% of sessions ever interacted with it, which meant nearly half of all traffic fired no ad tag at all.
• Browser tracking limits erased iOS and Safari. Apple devices and Safari made up roughly 19% of sessions — higher among the urban parent audience — with near-zero attributed purchases, because third-party cookie limits broke the click-to-conversion join.
• Purchase values were wrong, not just undercounted. Events fired at checkout, but around 21% of COD orders were later refused or cancelled at the door, a rate consistent with common Pakistani COD refusal ranges. Value-based bidding was optimizing toward revenue that never banked.
• Retargeting pools were starved. The 180-day purchaser audience held 11,400 users against roughly 19,300 actual purchasers in the same window — a 41% undersized pool built only from browser pixels.

The compounding effect is what made this dangerous. Meta’s delivery system, fed a fraction of true conversions, skewed toward the users it could still see — cheap Android traffic on old devices — and quietly deprioritized the higher-intent buyers it could not. The media buyers responded the way any rational team does when ROAS falls: they broadened targeting, cut retargeting spend, and leaned on discounts. Every one of those moves was calibrated against numbers that were wrong by more than a third.

Phase 1 — Measurement Audit and Data-Layer Cleanup (Weeks 1-2)

The first fortnight was forensic work, deliberately untouched budgets. We captured a 14-day baseline across four sources: GA4, the Shopify order export with UTM and referrer data, Meta Events Manager, and Google Ads conversion reports, reconciled in a single weekly sheet that would remain the engagement’s source of truth.

The audit surfaced one problem nobody had on the list: purchases were firing twice. A hardcoded theme pixel and a GTM tag were both sending Purchase, without matching event IDs, so Meta’s deduplication failed intermittently and reported numbers wobbled day to day — one reason the team had stopped trusting the dashboard entirely. Both were frozen pending the rebuild.

We then decomposed the missing 39% of signal by cause, using DebugView traces, Meta Test Events sessions, and server logs on the checkout path:

Loss source	Estimated share of missing signal
Consent banner gating tags before interaction	36%
ITP and third-party cookie limits (iOS, Safari)	24%
Ad blockers and tracking-protection browsers	15%
Payment-redirect drop-offs mid-checkout	12%
Duplicate and mismatched events netted out	13%

Two deliverables closed the phase. The first was a data-layer specification the dev team could implement without further input: order ID, final value, currency, item list, a COD flag, and — critically for this market — hashed email and phone captured at checkout, because a COD order form collects a phone number by necessity and Pakistan’s most reliable match key is therefore available on nearly every order. The second was the reporting contract: one reconciliation sheet, updated weekly, with an agreed tolerance band that would define “fixed” when platform-reported orders landed within 10% of store-attributed orders.

Scope discipline mattered as much as the findings. Two tempting additions were deliberately excluded: a new attribution platform (“we’ll just buy software”) and a restructuring of the ad accounts. Both would have layered assumptions on top of a broken signal. The order of operations is the lesson — repair the measurement foundation, confirm the variance closes, and only then spend energy on modeling or account architecture built on numbers you can trust.

Phase 2 — Server-Side Build and Consent Mode (Weeks 3-5)

The rebuild centered on a server-side tracking setup running in a server-side GTM container deployed on Cloudflare Workers — a natural fit, since the storefront already sat behind Cloudflare. The tagging endpoint moved to a first-party subdomain, which changed the durability of every identifier that followed: cookies set on the brand’s own domain survive the seven-day ITP windows that were erasing Safari attribution, persisting 12 months and longer.

Four pipelines went live in sequence, each validated against the reconciliation sheet before the next was enabled:

1. GA4 via the server container, with first-party cookie persistence, so analytics coverage stopped bleeding on Apple devices.
2. Meta Conversions API from the server container, with the browser pixel retained and both sides sharing an event_id for strict deduplication. Hashed email and phone from the checkout form lifted event match quality from 4.1 to 8.0 within the first week — the single clearest leading indicator that recovered volume was coming.
3. Google Ads Enhanced Conversions with Consent Mode v2, so Google’s bidding received both observed conversions and modeled recoveries for non-consented users, plus hashed first-party match keys.
4. COD outcome postbacks, the piece specific to this market. The confirmation desk’s order-status updates now trigger a webhook into the server container: a cod_confirmed event carries the final banked value, and refusals or cancellations flow back as refund-type events. Value-based campaigns stopped optimizing toward revenue that would never be collected.

In parallel, the consent experience was rebuilt under our consent management and privacy compliance framework: a plain two-choice banner — accept or reject, with granular preferences one click away — in language matched to the audience, replacing the EU-import modal that most users simply closed. Acceptance rose from 38% to 76% of sessions, because the choice finally took ten seconds instead of a questionnaire.

By the end of week 5, the same reconciliation sheet that opened the engagement read like this:

Signal	Before	Week 5
Meta event match quality (purchases)	4.1	8.0
GA4 purchases vs Shopify orders	63%	92%
Google Ads visible conversions vs store-tracked	55%	89%
Sessions with any ad tag fired	54%	91%

Phase 3 — Audiences and Bidding on Clean Signal (Weeks 4-8)

With trustworthy events flowing, weeks four through eight moved from measurement to activation — the point where recovered signal turns into recovered performance.

The retargeting foundation was rebuilt server-side. The 180-day purchaser audience grew from 11,400 to 29,600, a 2.6x expansion, and was split into confirmed-COD purchasers versus refused-or-cancelled orders. That second segment matters more than it looks: an audience of people who rejected parcels at the door is a refund-risk list, not a lookalike seed. The value-based lookalike was rebuilt exclusively from confirmed purchasers, so Meta’s expansion model learned from customers who actually paid.

On Google, Shopping partitions were restructured by margin — exam-stationery packs versus art supplies versus bulk school bundles — and target-ROAS bidding was re-enabled with roughly 41% more conversion volume feeding the bid calculations. That number is worth pausing on: it is the difference between an algorithm bidding with confidence and one bidding defensively, and it came entirely from Consent Mode modeling and Enhanced Conversions, not from a rupee of extra spend.

Budget followed signal. About 15% of spend shifted from cold broad prospecting into retargeting and bundle campaigns built for the back-to-school window, with dynamic ads running on the corrected product feed. The bundle pairings themselves came from confirmed-order data — which SKUs actually travelled together to the same address — rather than the merchandiser’s guesses.

Creative testing continued in parallel, but under new rules. With accurate value data flowing, the media buyers could finally judge bundle creative on confirmed revenue rather than platform-reported ROAS, and two assumptions fell immediately: the flagship “complete school bundle” hero creative was actually the weakest performer per confirmed order, while a humble exam-stationery combo the merchandiser had deprioritized carried the strongest margins. The corrected data reordered the creative backlog within a week, something four weeks of debating screenshots in Ads Manager had never managed.

Finally, a 5% audience holdout was set aside on retargeting so incrementality could be tested rather than asserted. When you recover this much signal at once, the honest question is whether the platforms are finding new revenue or just re-labeling it, and the holdout was designed to answer exactly that by week 12.

Phase 4 — Reconcile, Report, and Compound (Weeks 8-12)

The last month of the engagement was about proving the numbers held and building the habits that keep them honest.

The weekly reconciliation variance between Ads Manager, Google Ads, GA4, and the Shopify order log tightened from ±38% at the start to ±6% at week 12. Media buyers who had spent a year explaining discrepancies to the founder now opened one shared Looker Studio dashboard — live from day one of the build — and argued about creative instead of arithmetic.

The holdout test returned its answer: retargeting cohorts beat their 5% holdout by 19% on revenue over the test window. Recovered measurement alone would have shown no such gap; this was genuine incremental revenue, which is the difference between a tracking project and a growth project.

The peak-season readout stabilized at a reported blended ROAS of 3.3x and a Meta cost per purchase of PKR 675. And the same first-party event stream that feeds the ad platforms now also feeds the brand’s email platform segmentation, so the confirmation-status data shapes lifecycle flows too — one pipeline, many destinations.

Planning then turned to the winter exam season and the January restock window, and for the first time those plans were built on numbers the whole team trusted. The founder’s one-line summary of the engagement has outlived it: “We didn’t buy better ads, we stopped buying bad information.” The budgets restored in September went into a system that now tells the truth about what it does with them.

Final Results

Metric	Before (Week 0)	Week 12	Change
Platform-visible ad-attributed purchases (weekly, Meta + Google)	1,050	1,335	+27%
Meta event match quality	4.1	8.0	+95%
Cost per purchase (Meta)	PKR 890	PKR 675	-24%
Reported blended ROAS	2.4x	3.3x	+38%
180-day purchaser audience (server-side)	11,400	29,600	2.6x
Weekly platform-vs-store order variance	±38%	±6%	-32 pts

An honest reading of this table matters. The +27% recovered conversions is a measurement figure — orders the platforms could finally see, most of which were happening all along. The ROAS lift is therefore part optics and part real: part of it is recovered attribution, and the 19% holdout-verified incremental lift on retargeting is the portion we would defend as genuine new revenue. Spend did not increase materially across the window. What changed is that roughly PKR 3.4 million a month stopped being steered by a number that was wrong by more than a third.

What Made This Work

1. Measurement was fixed before budgets were touched. The instinct in a ROAS dip is to cut spend or change creative. Here, two weeks of forensic reconciliation established that the ads were fine and the numbers were lying — which reversed every subsequent decision.
2. The COD confirmation desk became the source of truth. In a market where one in five parcels can be refused, checkout is not conversion — confirmation is. Wiring order-status postbacks into the server pipeline made value-based bidding optimize banked revenue, not hoped-for revenue.
3. First-party infrastructure beat browser restrictions instead of fighting them. A tagging endpoint on the brand’s own subdomain outlasts the cookie windows that erased iOS and Safari attribution, without depending on any single platform’s roadmap.
4. Deduplication discipline kept the recovery clean. Shared event IDs between browser and server events meant the +27% was real recovered signal, not double-counting that would have inflated confidence and corrupted bidding in the opposite direction.
5. The consent experience was treated as conversion infrastructure. A ten-second accept-or-reject choice lifted acceptance from 38% to 76% — recovering more signal than any technical workaround could have, by respecting the user’s time.

What Teams Can Apply

1. Reconcile weekly, and suspect measurement first. If platform-reported conversions sit more than 15% away from store-attributed orders for two consecutive weeks, stop optimizing and audit. A technical foundation for ecommerce marketing in Pakistan starts with numbers you can defend in a board meeting.
2. Start from the data layer, not the tags. Every tag you will ever need depends on the same fields: order ID, value, items, match keys, and — in COD markets — the confirmation outcome. Specify them once, and every platform integration becomes a configuration exercise.
3. Use server-side events for audiences, not just conversions. The 2.6x larger purchaser pool moved retargeting performance more than any creative change; the platforms can only build audiences from the customers they can see.
4. Exclude failed COD orders from value signals. Bidding on refused parcels teaches the algorithm to find people who will not pay. Confirmation-status postbacks are cheap to build and change what value-based optimization means.
5. Budget for measurement maintenance annually. Consent requirements, browser limits, and platform policies erode tracking silently. A yearly audit of the kind described here costs a fraction of one quarter spent optimizing against a broken number.