The Tracking Stack That Survives iOS, Ad Blockers, and Cookie Death

// Client-side: sends to YOUR domain, not a third party
fetch("/api/track", {
  method: "POST",
  body: JSON.stringify({
    event: "page_view",
    url: window.location.href,
    referrer: document.referrer,
    timestamp: Date.now(),
    sessionId: getSessionId(), // First-party cookie
  }),
});
 
// Server-side: fans out to all destinations
app.post("/api/track", async (req, res) => {
  const event = validateEvent(req.body);
  const userId = resolveIdentity(req);
 
  // Send to all destinations in parallel
  await Promise.allSettled([
    storeInDatabase(event, userId),
    sendToGoogleMP(event, userId),
    sendToFacebookCAPI(event, userId),
    sendToAmplitude(event, userId),
  ]);
 
  res.status(200).send();
});

function resolveIdentity(req: Request): UserIdentity {
  // Priority order for identity resolution
  const identity: UserIdentity = {
    // Authenticated user (strongest signal)
    userId: req.user?.id || null,
 
    // First-party cookie (persists across sessions)
    deviceId: req.cookies["_device_id"] || generateDeviceId(),
 
    // Session ID (current visit)
    sessionId: req.cookies["_session_id"] || generateSessionId(),
 
    // Hashed email (for ad platform matching)
    hashedEmail: req.user?.email
      ? sha256(req.user.email.toLowerCase().trim())
      : null,
 
    // IP-based fingerprint (fallback, less reliable)
    fingerprint: generateFingerprint(req),
  };
 
  return identity;
}

// Standardized event schema
interface TrackingEvent {
  // Required
  event: string;           // "page_view", "add_to_cart", "purchase"
  timestamp: number;       // Unix ms
  sessionId: string;
 
  // Identity (at least one required)
  userId?: string;
  deviceId?: string;
 
  // Context
  url?: string;
  referrer?: string;
  userAgent?: string;
  ip?: string;             // For geo lookup, then discard
 
  // Event-specific properties
  properties?: Record<string, unknown>;
}
 
// Server-side validation and enrichment
function processEvent(raw: TrackingEvent): EnrichedEvent {
  return {
    ...raw,
    // Enrich with server-side data
    geo: geoLookup(raw.ip),
    device: parseUserAgent(raw.userAgent),
    // Add server timestamp (client clocks can't be trusted)
    serverTimestamp: Date.now(),
    // Deduplicate
    eventId: generateEventId(raw),
  };
}

// Facebook Conversions API
async function sendToFacebookCAPI(event: EnrichedEvent) {
  if (!["purchase", "add_to_cart", "lead"].includes(event.event)) return;
 
  await fetch(
    `https://graph.facebook.com/v19.0/${FB_PIXEL_ID}/events`,
    {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        data: [{
          event_name: mapToFBEvent(event.event),
          event_time: Math.floor(event.timestamp / 1000),
          event_source_url: event.url,
          action_source: "website",
          user_data: {
            em: [event.hashedEmail],
            external_id: [sha256(event.userId || event.deviceId)],
            client_ip_address: event.ip,
            client_user_agent: event.userAgent,
            fbc: event.properties?.fbc,  // Facebook click ID
            fbp: event.properties?.fbp,  // Facebook browser ID
          },
          custom_data: event.properties,
        }],
        access_token: FB_ACCESS_TOKEN,
      }),
    }
  );
}
 
// Google Measurement Protocol (GA4)
async function sendToGoogleMP(event: EnrichedEvent) {
  await fetch(
    `https://www.google-analytics.com/mp/collect?measurement_id=${GA_ID}&api_secret=${GA_SECRET}`,
    {
      method: "POST",
      body: JSON.stringify({
        client_id: event.deviceId,
        user_id: event.userId,
        events: [{
          name: mapToGAEvent(event.event),
          params: {
            ...event.properties,
            session_id: event.sessionId,
            engagement_time_msec: 100,
          },
        }],
      }),
    }
  );
}

CREATE TABLE events (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  event_name VARCHAR(100) NOT NULL,
  user_id VARCHAR(255),
  device_id VARCHAR(255) NOT NULL,
  session_id VARCHAR(255) NOT NULL,
  url TEXT,
  referrer TEXT,
  properties JSONB,
  geo_country VARCHAR(2),
  geo_region VARCHAR(100),
  device_type VARCHAR(50),
  browser VARCHAR(100),
  created_at TIMESTAMP NOT NULL DEFAULT NOW(),
  server_timestamp TIMESTAMP NOT NULL
);
 
CREATE INDEX idx_events_user ON events (user_id, created_at);
CREATE INDEX idx_events_session ON events (session_id, created_at);
CREATE INDEX idx_events_name ON events (event_name, created_at);