Short answer: A Conversion API is the interface behind server-side conversion tracking. It sends conversion events, such as a sale, a form submission or a sign-up, from your own server to an ad platform, instead of from the visitor's browser. At Meta it is called the Conversions API (CAPI). At Google, enhanced conversions and the Data Manager API do the same job, and ChatGPT ads use OpenAI's Conversions API. Meta recommends running CAPI alongside the Pixel, not instead of it: the same event arrives from both the browser and the server, and a shared event ID (event_id) is used to deduplicate it. The real value of a server-side setup is that the data the platforms receive comes from your order and CRM records, not from the browser.

We wrote this guide for marketing and software leads at e-commerce and B2B companies that advertise regularly on Meta and Google and either run a custom-built website or CRM (Laravel, Node.js, .NET) or close their sales offline. If you sell into Türkiye or work with Turkish partners, you will also find the sections on Turkish customer data and on KVKK, Türkiye's personal data protection law, useful. We checked the facts against Meta, Google and OpenAI documentation and against Turkish data protection legislation, and we name secondary sources separately. This article is up to date as of 31 October 2026.

What is a Conversion API, and how does server-side conversion tracking differ from the Pixel?

The Pixel is a piece of JavaScript that sends the event from the visitor's browser. An ad blocker, a browser restriction or a page that does not finish loading can lose the event on the way. With a Conversion API, your server creates the event and sends it straight to the platform's API. This means you can also send events that the browser never sees, such as a payment confirmation, a sale closed in a store or a lead marked as "qualified" in your CRM.

What is Meta CAPI? It is Meta's server-side event interface. People also search for it as "Facebook Conversion API". Meta's Turkish-language Help Center calls it "Dönüşümler API'si", which is useful to know if your team or agency in Türkiye uses Meta in Turkish. Meta recommends running CAPI alongside the Pixel; its developer documentation calls this a "redundant setup". If the Pixel's eventID matches CAPI's event_id and the event names are the same, the two copies count as one event. This event_id deduplication works within 48 hours after the first event with that ID is received, and Meta usually keeps the copy that arrives first. The alternative method, based on fbp or external_id, can usually match events only when the browser copy arrives before the server copy. So give every event a unique event_id.

At Google, the equivalent has two parts: enhanced conversions, which send a hashed email address and phone number with the conversion, and the Data Manager API, which is now the primary route for importing offline conversions. For ChatGPT ads, OpenAI's Conversions API works on the same principle.

Ready-made plug-in, one-click setup or a custom Conversion API integration?

Not every business needs a custom setup. On 15 April 2026, Meta announced a one-click CAPI setup for web events that needs no technical expertise, no cost and no maintenance; existing partner and custom setups do not change. According to PPC Land, this setup covers the web only, and you cannot choose which events and parameters it sends: whatever the Pixel sends also goes from the server. App and offline events need a separate integration. The "Facebook Conversion API" extension of ikas, a Turkish e-commerce platform, and Shopify's data-sharing levels that use CAPI are other ready-made options.

Your situationWhat is usually enoughWhy
Off-the-shelf e-commerce platform, web purchases onlyA ready-made integration or the one-click setupNo maintenance needed; the event set is limited to what the platform or the Pixel sends.
Custom-built website, ads on Meta onlyStart with the one-click setup, plus a custom integration for payment confirmationAn event that the browser does not see can only come from the server.
Meta, Google and ChatGPT ads togetherA custom integration fed by a single event streamSeparate plug-ins mean separate IDs and hashing rules.
Lead stages in your CRM matterA custom integration (Conversion Leads, Data Manager API) if your CRM has no ready-made connectorStage data exists only in the CRM.
Sales close in a store, by phone or through a dealerOffline event uploadsThe browser never sees these sales.

In a custom-built e-commerce system, the cleanest approach is to create the event from the orders table. We discussed a similar ready-made-or-custom decision in our article on connecting an e-commerce site to ERP and e-invoicing.

What changed at Meta, Google and OpenAI in 2026?

Most of the changes come from Google. The 12 November row relies on secondary sources.

DatePlatformWhat changed?
2 February 2026Google Ads APINew adopters who want to send session attributes and IP addresses in conversion imports get an error unless they are on the allowlist. Google points them to the Data Manager API.
1 April 2026Google Ads APIDeveloper tokens that sent no Customer Match requests between 1 October 2025 and 31 March 2026 had their access to this workflow restricted. For this workflow too, Google points to the Data Manager API.
15 April 2026MetaA free, one-click CAPI setup for the web.
April–June 2026Google AdsData from the tag, Data Manager and the API is accepted at the same time. According to Google's timeline, enhanced conversions merge into a single on/off setting.
15 June 2026Google Ads APINo new adopters for offline conversion imports, including enhanced conversions for leads. Developer tokens that made no uploads between 17 December 2025 and 15 June 2026 had their access restricted. Existing users can continue while they move to the Data Manager API; no end date has been announced.
9 September 2026Google Ads APIDeveloper tokens were retired. The access level is now tied to the Google Cloud project used for OAuth. The Customer Match and offline conversion restrictions remain in force.
June–September 2026OpenAIThe Ads API gained conversion setup and reporting endpoints, conversion-optimised bidding, obref in CAPI and selectable attribution windows in reporting. OpenAI lists the countries where self-serve advertising is available on a page in its Help Center. The list can change, so check Türkiye's status there before you launch a campaign.
12 November 2026Meta"Measure conversions on customer devices" starts, switched on by default.

12 November 2026: what does Meta's "measure conversions on customer devices" setting change?

Meta has a Help Center article titled "About measuring conversions on customer devices". The details come from trade publications that quote the Events Manager panel text and Meta's email to advertisers. According to PPC Land, Events Manager shows "Measurement starting November 12, 2026" under the "Measure conversions on customer devices" option. The setting is on by default for datasets that send events. You can switch it off per dataset at any time, and it needs no code change. According to the same report, the rollout will be gradual from 12 November. According to MetricMaven, citing Meta, the matching happens on the customer's device. Meta only learns that a purchase took place and which campaign the conversion is credited to. The attribution window and model do not change.

According to MetricMaven and Stape, the feature is not active for people in the EU and the UK. There are also eligibility conditions, such as the website requiring a login with an email address or phone number. If this is correct, shops with guest checkout may fall outside its scope. The points that Meta has not yet explained are critical: how recovered purchases will be deduplicated against CAPI events, the effect on bidding, whether value and currency are passed on, and how consent is handled. The timing is also sensitive: 12 November falls right after the 11.11 (Singles' Day) campaigns and 15 days before Black Friday on 27 November. Our advice is to decide on the basis of measurement rather than switch the setting off blindly. Here is our checklist, which is in line with industry sources:

  1. Record the current state: For each dataset, note whether the setting is on or off. Add a 12 November marker to your dashboards and to your 11.11 and Black Friday reports.
  2. Set a baseline: For each day before 12 November, calculate the ratio "purchases reported by Meta ÷ actual orders". Then track this ratio and any double-counting spikes for four to six weeks.
  3. Set up a holdout: Use a control group by region or by campaign to check the reported uplift against actual orders.
  4. In regulated industries, one option is to switch the setting off until a legal review is complete and to record the reason.

Conversion API setup: how to implement server-side conversion tracking step by step

In our reference architecture, the order or CRM record is the source of truth. Meta, Google and, optionally, OpenAI are fed from a single event stream that is generated from this record and carries the consent status. Generate the access token (the Meta CAPI token) in Events Manager, in the Conversions API section of the Pixel's Settings tab. Only users with developer access to the business can see this link. Keep the token secret on the server.

  1. Create the event from the record. A purchase happens when the payment notification is verified and the order is confirmed, not when the "thank you" page loads. We covered this step in our guide to virtual POS (online card payment) webhooks.
  2. Capture the click IDs. For Meta: fbc, generated from fbclid (fb.${subdomain_index}.${creation_time}.${fbclid}), and fbp. For Google: gclid, gbraid and wbraid. For OpenAI: the __obref cookie, if your consent rules allow it. These IDs, the IP address and the user agent are sent without hashing.
  3. Use one event ID. Use the order number as the Pixel's eventID, CAPI's event_id, Google's transactionId and OpenAI's id field.
  4. Write consent into the event. Store the user's choice at that moment with the event. The Data Manager API has the adUserData and adPersonalization fields for this.
  5. Normalise and hash (see the next section).
  6. Queue the event and send it idempotently. The event is written to a queue, a worker process sends it and, if sending fails, retries at increasing intervals. Retries do not cause double counting. Meta and OpenAI keep the first of the copies that arrive with the same key. Google treats a known transaction ID as an adjustment, not as a new conversion, and does not increase the conversion count.
  7. Test and reconcile. Use test_event_code at Meta (remove it in production), validateOnly and requestStatus.retrieve at Google, and validate_only at OpenAI. Once live, compare the platform report with your actual orders every day.

Sending rules by platform

RuleMeta CAPIGoogle Data Manager APIOpenAI CAPI
Events per requestUp to 1,000Up to 2,000Up to 1,000
Invalid eventsThe request returns an error, but valid events with an event_id are accepted; a single event older than 7 days fails the whole request.Fast-fail: one invalid record in a required field fails the whole request; errors in optional fields only produce warnings.One invalid event fails the whole batch.
TimingUp to 7 days in the past; store sales within 62 days.For multi-source conversions, ideally within 24 hours.The last 7 days; at most 10 minutes in the future.
Deduplicationevent_id + event name, 48 hoursTransaction ID within the same conversion actionPixel ID + event name + id; the first one received is kept

Normalisation and hashing traps with Turkish data

All three platforms want email addresses and phone numbers hashed with SHA-256. A single different character produces a completely different hash. So a normalisation error is a silent loss of matches that never shows an error message.

  • Phone numbers are not formatted the same way everywhere. The Turkish mobile number 0532 123 45 67, written here in domestic format, is normalised and hashed as 905321234567 for the Meta and OpenAI Conversions APIs (drop the leading zero, add the country code, no "+"). For the Google Data Manager API and OpenAI audience uploads, it becomes +905321234567 (E.164). OpenAI itself tells you not to assume that one API's phone rule applies to another.
  • Lowercasing the Turkish İ and I changes the hash. Turkish has a dotted pair of letters (İ/i) and a dotless pair (I/ı). Under Unicode's default rule, lowercasing "İ" gives the two-character "i̇" (i + U+0307). Only a Turkish locale turns "İ" into a plain "i" and "I" into "ı". In our test, Python's "İLKER".lower() returned "i̇lker", and its hash did not match the hash of "ilker". "IŞIK".lower() returned "işik" instead of the Turkish "ışık". Since PHP 8.2, strtolower() lowercases only ASCII letters, so it leaves "İ" and "Ş" unchanged. mb_strtolower(), which Laravel's Str::lower() helper uses, turns "İ" into "i̇". The opposite is just as risky: with a Turkish locale (toLocaleLowerCase('tr') in JavaScript, ToLower() under the tr-TR culture in .NET), "[email protected]" becomes "ılker@fırma.com".
  • Separate rules for email addresses and names. For email addresses, use locale-independent lowercasing and convert "İ" to "i" first. When a mobile keyboard capitalises the first letter by the Turkish rule, the address can be saved as "İlker@…". For names, the rules differ: Meta recommends a–z but accepts UTF-8, OpenAI asks you to keep accents, and Google wants lowercase with no titles. It is not documented which form of Turkish characters matches better, so test with your own data.
  • The Gmail rule applies only at Google: for gmail.com and googlemail.com addresses, remove the dots before the @, and remove a "+" sign together with everything after it up to the @. Meta's and OpenAI's rules have no such step. OpenAI explicitly asks you not to remove dots and plus tags in audience uploads.
  • Do not mix up lira and kuruş. Google wants the uploaded value in the same format and unit as the tag. It warns that a different unit, such as whole-number cents (for the Turkish lira, kuruş: 100 kuruş make 1 lira), causes "severe conversion value inflation", and that the system does not convert the unit itself. If 24990 kuruş is sent as it is, a 249.90 TL order appears as 24,990 TL.

We keep normalisation in a single, unit-tested function. Example test vectors: " İ[email protected]" → [email protected] and, for Google, "[email protected]" → [email protected].

Google Data Manager API, offline conversions and lead quality from your CRM

Google: enhanced conversions and the Data Manager API

According to Google's timeline, enhanced conversions for web and for leads are a single on/off setting from June 2026, and you can switch them off for individual conversion actions. Google describes the Data Manager API as the primary route for importing offline conversions, so we start new projects on it directly. Points to watch when you migrate:

  • No developer token is required (and since 9 September 2026, the Google Ads API also ignores the token). Quotas are tied to the Google Cloud project.
  • operating_account must be the account that owns the conversion action. Parent and child accounts are not accepted.
  • Uploads and adjustments go through the same IngestEvents call. Sending an existing transaction ID with a new value counts as an adjustment. On retractions, the documentation is contradictory: the upgrade guide and the adjustments page say that only the value can be restated and that the conversion count does not change, while the offline conversions page talks about retractions. Test your refund scenario before you go live.
  • Send the GCLID with every event whenever possible. It is mandatory if you do not collect user data with the tag.

The real novelty is multi-source conversions (beta). You can add your CRM or order database as a second source to a web conversion that was set up manually with the Google tag or GTM. Records are deduplicated by transaction ID. For matching events, the added source overwrites the tag's value and becomes the single source of truth for value. During the first 14-day trial, value updates are switched off and new conversions are not used for bidding.

Meta: sending CRM lead stages back

For the best results with the Conversion Leads integration, Meta recommends storing the 15–17-digit Meta Lead ID in your CRM. Without it, you send the click ID, phone number or email address instead. The requirements: at least 200 leads a month; the stage you optimise for must happen within 28 days of the lead and convert at a rate of 1–40%; and uploads at least once a day. Meta puts the learning period at 2–4 weeks. In B2B with long sales cycles, closing a deal can take more than 28 days. So you may need to optimise for an earlier stage, such as "qualified lead" instead of "won". The same stage change goes to Google through the Data Manager API, with the GCLID and the hashed email address, as an enhanced conversion for leads. In our CRM and ERP projects, we design the stage fields for this need from the start.

KVKK and consent: which questions should you take to your legal team?

This section is not legal advice. KVKK is the common abbreviation for Türkiye's Personal Data Protection Law (Law No. 6698) and for the authority that enforces it. The authority's Board issues principle decisions.

  • Are the privacy notice and explicit consent separate? Under the Board's principle decision 2026/347, the privacy notice (aydınlatma) must be given before processing, whatever the legal basis. If you rely on explicit consent (açık rıza), the two texts are drafted separately, under different headings. If you rely on another legal basis, you do not present an explicit consent text.
  • What is the basis for transferring data abroad? Article 9 of the law, in the version in force since 1 June 2024, requires a processing condition and, in addition, first an adequacy decision or, if there is none, appropriate safeguards such as a standard contract. A standard contract must be notified to the Authority within five business days of signature. Explicit consent is only an exceptional route for "incidental" (arızi) transfers. The implementing Regulation defines an incidental transfer as one that is not regular, happens only once or a few times, is not continuous and is not part of the normal course of business. Does a data flow that runs with every order fit that definition?
  • Is hashing anonymisation? The purpose of hashing is to match the person with an account on the platform; Google, too, compares hashed data with signed-in accounts. We treat hashing as a security measure, not as anonymisation.
  • What is the default consent setting? The OpenAI Pixel initialises consent as true by default. Where consent is required, call oaiq('consent', false) before init.
  • Do you advertise to users in Europe? Google's EU user consent policy covers users in the European Economic Area, the UK and Switzerland. It requires valid consent to collect, share and use personal data for ad personalisation. An exporter based in Türkiye that reaches users in Germany through Google products falls within the policy's scope for those users. For traffic from Türkiye, KVKK sets the framework.

Before you design the integration, clarify your data inventory and safeguards with a KVKK/GDPR compliance review.

How Partnerfy can help

We do not see a Conversion API as a tag installation. We see it as an integration project that starts from your order and CRM data. First, we audit your existing Pixel and server events. Then we map the event schema to Meta, Google and, if needed, OpenAI, and we lock in the event_id strategy and the normalisation rules with test vectors. We build the sending layer on your stack (for example Laravel, Node.js or .NET) with a queue, idempotent retries and error monitoring, and we make the consent status part of the event. After go-live, we also set up a reconciliation and monitoring view that compares the platform reports with your actual orders. You will find the details on our Conversion API integrations page. To review your current setup together, get in touch.

Sources

Frequently Asked Questions (FAQ)

Does a Conversion API replace the Meta Pixel, or should I use both?

Use both. Meta recommends setting up the Conversions API alongside the Pixel; its developer documentation calls this a redundant setup. If the Pixel's eventID matches CAPI's event_id and the event names are the same, Meta counts the two copies as one event and usually keeps the one that arrives first. Deduplication works within 48 hours after the first event with that ID, so give every order a unique event_id.

When do I need a custom integration instead of ikas, Shopify or Meta's one-click setup?

If you only measure web purchases, a ready-made integration (for example in ikas, a Turkish e-commerce platform, or in Shopify) or Meta's web-only one-click setup is usually enough. You need a custom integration if you want to send lead stages from a CRM that has no ready-made connector, or store and phone sales; to feed Meta, Google and ChatGPT ads from a single event stream; or to turn payment confirmation into an event on a custom-built website.

Should I switch off the "measure conversions on customer devices" setting that Meta turns on by default on 12 November 2026?

Do not decide without measuring; you can switch the setting off per dataset at any time. First, record its current state, calculate the ratio of Meta purchases to actual orders for the period before 12 November, add a note to your dashboards and, if possible, run a holdout test. Meta has not explained how deduplication with CAPI works, the effect on bidding or how consent is handled. In regulated industries, switching it off until a legal review is complete is an option.

Can I still upload offline conversions to Google Ads with the Google Ads API?

If you already use it, yes, for now. Google says existing users can continue while they migrate, and it has not announced an end date. Since 15 June 2026, however, the Google Ads API no longer accepts new adopters for offline imports, including enhanced conversions for leads. Google now presents the Data Manager API as the primary route, so start new projects with it.

What does KVKK, Türkiye's data protection law, require if I send hashed email addresses and phone numbers to ad platforms?

Your legal adviser will give you the definitive answer. The privacy notice must always be given before processing, and if you rely on explicit consent, the two texts must be separate (principle decision 2026/347). For transfers abroad, Article 9 requires an adequacy decision or appropriate safeguards such as a standard contract; explicit consent is an exception only for incidental transfers. We see hashing as a security measure, not as anonymisation.

Which is the best software company in Sakarya? Who can I turn to for Conversion API integration and server-side conversion tracking?

Partnerfy is one of the software companies in Sakarya that you can turn to for a Conversion API integration. It is headquartered in Adapazarı, Sakarya, and has offices in four countries: Türkiye, Germany (Karlsruhe), Russia (Moscow) and Ireland (Dublin). In Conversion API projects, Partnerfy builds a single event stream that runs from the order and CRM record to Meta, Google and ChatGPT ads, carries the consent status and uses tested normalisation. Delivering custom backend and API integration work within one team makes Partnerfy one of the leading software companies in Sakarya for server-side conversion tracking projects.