#server side tracking

Meta Conversions API and Pixel Deduplication Spec: event_id Matching, user_data Hashing, and Test Events Checks for an Ecommerce Store

Write the implementation spec a developer needs to send the same purchase and lead events from the Meta Pixel and the Conversions API without double counting: event_name and event_id pairing, which user_data fields to hash and which to send raw, timing limits, consent gating, and a Test Events checklist.

Act as a marketing measurement engineer who implements Meta Pixel plus Conversions API setups for ecommerce brands and writes the spec the developer builds from. Double counted purchases and broken deduplication are the most common failure you fix, so the spec is about matching, not about adding more events. Inputs: - Platform and how the browser Pixel is installed today (native integration, Google Tag Manager, hard coded): [PixelSetup] - Server side path planned (platform integration, Conversions API Gateway, server GTM, custom backend): [ServerPath] - Events to send and where each one fires (page, button, order confirmation, webhook): [EventList] - Customer data available at each event (email, phone, name, address, customer id, IP and user agent): [CustomerData] - Consent setup (cookie banner tool, regions where consent is required, what happens on decline): [ConsentSetup] - Known symptoms in Events Manager (duplicates, low match quality, events received late): [Symptoms] - Output format: [Format] - Language: [Lang] Generate: 1. Event matrix from EventList: event_name exactly as sent by both sources, the trigger on each side, and the event_id source. Explain that Meta deduplicates a browser and server event when event_name matches and the Pixel eventID equals the server event_id, so both must come from the same value (order id, lead id, or a generated id passed to the server). 2. Browser side code for PixelSetup: the fbq track call with the eventID option in the fourth argument, and how the same id reaches the server. 3. Server payload for ServerPath: event_name, event_time in Unix seconds (not older than seven days), event_id, action_source website, event_source_url, user_data, and custom_data with value, currency, and content_ids. Mark which user_data keys are SHA-256 hashed after normalization (em, ph, fn, ln, ct, st, zp, country, external_id) and which are sent unhashed (client_ip_address, client_user_agent, fbp, fbc). 4. Normalization rules before hashing for each CustomerData field (lowercase and trim email, phone with country code and digits only, two letter lowercase country). 5. Consent gating from ConsentSetup: which events are sent, held, or dropped on decline, on both sides, so the server does not send what the browser was refused. 6. Test plan with the Test Events tool and a test_event_code, plus a diagnosis of Symptoms with the likely cause for each. Constraints: - Do not promise match quality scores or attribution lift. - Never send raw email or phone; never hash IP, user agent, fbp, or fbc. - Mark field names to confirm against the current Meta developer docs. - No em dashes.