Blueprint Before Build: Planning a Server-Side GTM Migration
Objective: Given Nubank's current client-side-only GTM setup and a list of ad platforms in use, produce a one-page migration blueprint (subdomain, tag priority order, deduplication scheme) before any engineering work starts.
Nubank's growth team wants to move to server-side tracking after Google Ads reported 25% more sign-ups than GA4 last quarter. Engineering has one sprint allocated and needs a spec, not a vague request to 'set up server-side tracking.'
Sequence the plan the way the lesson does: subdomain first, then server tags in priority order, then the deduplication scheme, since building tags before the subdomain exists wastes the sprint.
Before you start
What you'll need
Free path (everything below is enough to finish)
Free, fast, and every engineer can comment directly on the spec
The process
2 steps
Step 01 of 02
The lesson is explicit: a tagging server must live on a first-party subdomain like metrics.yourbrand.com. A vendor domain like gtm.stape.io is still third-party to the browser and still gets blocked.
Nubank's DevOps team proposes hosting the server at nubank-tags.stape.io to save setup time. Does this achieve the goal?
Procedure
- Open a new sheet titled 'sGTM Migration Blueprint'
- Row 1: propose the subdomain (e.g. metrics.nubank.com.br) and the CNAME target
- Row 2: note explicitly why a vendor-hosted domain (e.g. stape.io) fails the first-party requirement
Decision: Subdomain Proposed: metrics.nubank.com.br -> CNAME -> [sGTM host] Rejected option: nubank-tags.stape.io Reason for rejection: still resolves as third-party to the browser, ad blockers and ITP treat it identically to the current setup
Healthy
The blueprint names a first-party subdomain on Nubank's own domain and explicitly rules out the vendor-domain shortcut with a reason.
Unhealthy
The blueprint accepts the vendor-hosted subdomain to save a week of DNS work, which ships a migration that doesn't actually bypass ad blockers.
What this means
The subdomain choice is not a convenience decision, it is the one step that determines whether the whole migration achieves anything.
So what do I do about it?
| Symptom | Action | Effort |
|---|---|---|
| A vendor-hosted domain is proposed to save setup time | Reject it in the spec and require a CNAME onto the company's own domain before engineering starts | 5 min |
Step 02 of 02
The lesson's Step 4 says to add server tags for every destination, but a one-sprint migration can't build all of them simultaneously; the setup work is real engineering time per platform.
Nubank runs Google Ads (54% of paid budget), Meta (31%), and LinkedIn (15%). Engineering has time to build and validate 2 of the 3 server tags this sprint. Which 2 go first?
Procedure
- List each ad platform with its share of paid budget
- Sort descending by budget share
- Mark the top 2 as 'Sprint 1' and the remainder as 'Sprint 2'
Platform Budget Share Sprint Google Ads 54% 1 Meta CAPI 31% 1 LinkedIn CAPI 15% 2
Healthy
The two highest-budget platforms ship first, so the sprint's ROI is front-loaded onto the campaigns where the data gap costs the most money.
Unhealthy
Tags are built in whatever order engineering finds easiest, which might ship LinkedIn CAPI first while 85% of the budget still runs on unfixed tracking.
What this means
When you can't build everything in one sprint, sequence by where the money is, not by implementation difficulty.
So what do I do about it?
| Symptom | Action | Effort |
|---|---|---|
| Engineering has capacity for 2 of 3 platform integrations this sprint | Build server tags for the top 2 platforms by budget share first | half day |
Final deliverable
A one-page sGTM migration blueprint: proposed subdomain and CNAME target, sprint-1 vs sprint-2 tag priority by budget share, and the event_id field to use for deduplication.
See a reference example
Coinbase, sGTM Migration Blueprint (excerpt) Subdomain: metrics.coinbase.com -> CNAME -> sGTM host Sprint 1 tags: Google Ads (62% of budget), Meta CAPI (28% of budget) Sprint 2 tags: TikTok CAPI (10% of budget) Deduplication field: transaction_id, shared between browser pixel and server tag
Success criteria
You're done when you can:
- Rejects any vendor-hosted subdomain shortcut with a stated reason
- Sequences tag-building priority by ad-spend share, not by build convenience
- Names a concrete deduplication field for the chosen conversion event