Cookieless Readiness Score

Server-side GTM (or equivalent server container) is live

Tagging server runs on your domain — not just browser-side GTM.

Server endpoint is a first-party subdomain (CNAME, not Google's domain)

Cookies set by the server become 1P only when the endpoint shares your apex.

Google Consent Mode v2 (with `ad_user_data` + `ad_personalization`) is live

Required since March 2024 for any EEA traffic; lets Google model denied conversions.

GA4 receiving valid consent signals from your CMP

Without `consent_default`/`consent_update` calls, modeled conversions don't unlock.

Meta Conversions API live with high Event Match Quality (≥ 7)

Server-side dedup via event_id; PII hashed (email/phone/name).

Google Ads Enhanced Conversions for Web (or Leads) is enabled

First-party data sent at conversion time, hashed in-browser before transmission.

TikTok Events API enabled (server-side)

Required for accurate TikTok Smart Performance Campaigns post-cookies.

Customer Match / Custom Audiences uploaded with hashed first-party CRM lists

Backbone of cookieless retargeting and lookalikes after 3P cookies die.

You're checking 'Modeled' vs 'Observed' columns weekly in GA4 / Ads

If you don't see modeled rows, your consent + EC setup isn't unlocking them.

Stable first-party user ID (logged-in or hashed-email) flows through events

Lets cross-device + cross-session attribution work without 3P cookies.

Privacy Sandbox APIs (Topics + Attribution Reporting) at least allowed, not blocked

Even if not actively used, blocking them via `Permissions-Policy` hurts ad eligibility.

You audit pixel + CAPI dedup at least quarterly (event_id mismatch is the top sGTM bug)

Without periodic event_id audits, dedup silently drifts and CAPI inflates conversions.