I’ve built and advised small teams on tight budgets enough times to know the pressure: you need measurable growth, modern capabilities like retargeting, and you must respect privacy and compliance — all without ballooning costs or hiring an engineering team. Here’s a pragmatic way to pick a martech stack for a two-person team that supports privacy-first retargeting for under £5k/year.
Define the problem, not the tech
Before you buy anything, get clear on what you actually need. For two people this usually collapses to three priorities:
Capture and store consented audience signals with minimal engineering overhead.Run effective retargeting campaigns across key channels (Google, Meta, and one or two programmatic partners) without leaking PII.Measure performance and attribute conversions in a privacy-compliant way.If you can summarise your needs into these outcomes, you avoid feature bloat and keep costs predictable.
Privacy-first principles to apply
For retargeting that’s privacy-first, I lean on these rules:
Prefer hashed or aggregated identifiers over raw PII.Collect consent explicitly and store it with timestamps.Minimise data retention and segment at the edge (in the browser or client) where possible.Use server-side APIs only for hashed audiences or event aggregates.These rules narrow the tools you should consider: look for consent management, first-party data capture, and audience syncs that accept hashed lists or rely on privacy-preserving APIs like Google’s Enhanced Conversions or server-side conversions for Meta.
Core components your two-person team needs
In practice you’ll want a small set of tools that each do one job well:
Consent & preference management: Capture consent and record it against events.First-party data capture & CDP-lite: Collect, unify, and persist visitor signals (email hashed, event stream).Audience activation: Push audiences to ad platforms via privacy-preserving APIs or hashed lists.Analytics & attribution: Measure conversions and build simple attribution models without relying on cross-site identifiers.Creative/ad ops lite: Simple ad creation and scheduling—no complex DSP unless needed.My recommended stack under £5k/year
Below is a practical stack that I’ve tested in lean teams. I pick tools that are easy to maintain, have clear privacy features, and integrate well.
| Layer | Tool | Estimated annual cost (GBP) | Why |
|---|
| Consent & CMP | Cookiebot or CookieYes | £0–£300 | Simple compliance, straightforward APIs to signal consent to other tools |
| First-party data capture / CDP-lite | Segment (Twilio Segment) or Fathom/ Plausible with server-side storage; or PostHog Cloud (low tier) | £0–£1,500 | Central event hub, identity resolution, can forward events server-side to ad platforms |
| Server-side tagging / audience sync | Google Tag Manager Server or a modest AWS Lambda + API Gateway endpoint | £0–£300 | Prevents leaking client identifiers; enables hashed conversions, Enhanced Conversions |
| Ad platforms / activation | Meta Conversions API, Google Enhanced Conversions, and Google Ads Customer Match | £0 | No software cost — activation via APIs but advertising spend is separate |
| Analytics & attribution | Looker Studio (free) + GA4 or PostHog | £0–£300 | Free/low-cost reporting with privacy-conscious data models |
| Ad creative / management | Canva Pro + Meta Ads Manager | £100–£200 | Low-cost creative and direct campaign management |
Estimated total: ~£400–£2,600/year excluding ad spend. This leaves room for a small DSP trial or a paid Segment plan if you scale up usage.
How to wire these up — step-by-step
Quick setup sequence for two people, focused on minimal engineering:
Install a lightweight CMP (Cookiebot/CookieYes). Configure categories and make sure the CMP exposes consent state to the page (dataLayer or JS window).Set up a server-side event collector. I prefer Google Tag Manager (server) hosted on a cheap Cloud Run or similar; alternatively, a small Node/AWS Lambda with an endpoint to receive browser events that have consent attached.Use your CDP-lite (Segment/PostHog). Send first-party events from the server endpoint. Ensure you only send hashed emails (SHA256) or anonymised identifiers.Activate conversion APIs: connect your server-side events to Meta Conversions API and Google Enhanced Conversions. Both accept hashed emails or event-level data and respect consent because your server checks the CMP state before forwarding.Set up audience exports: create hashed customer lists or audience segments in your CDP and push to Google Customer Match or Meta as hashed lists. Keep retention short (30–90 days) for retargeting segments.Measure with GA4 / Looker Studio or PostHog. Use event-driven tracking and link conversions to ads via the platform’s server-side features so you’re not dependent on third-party cookies.Trade-offs and things I’ve learned
In small teams every decision has trade-offs. These are the ones I expect you’ll face:
Simplicity vs. control: Using server-side GTM and Segment reduces client-side complexity but adds a small infra and maintenance overhead. For a two-person team this is manageable if you automate deployments.Hashing vs. deterministic IDs: Hashing emails for audience uploads is safer, but you lose some match rates versus raw PII. Expect slightly lower match rates but much better privacy posture.DIY vs. managed CDP: You can stitch together PostHog + server endpoint to save money, but paid CDPs give cleaner activation channels. My preference: start cheap, then upgrade when you hit scaling pain.Attribution accuracy: Privacy-first approaches make last-click and cross-device attribution harder. Rely on incrementality tests (holdouts) and aggregated conversion modelling more than deterministic user paths.Operational tips for a two-person team
Operational discipline keeps this stack manageable:
Document every event you send (schema, required fields, consent check) in a simple events registry (Google Sheet or markdown).Automate deployments and tests for the server endpoint. A single bad change can break all conversions.Keep retention policies short by default and review monthly.Make audience naming and lifecycle rules explicit so campaigns aren’t targeting stale segments.Quick checklist before you launch
Consent CMP in place and returning a reliable consent state.Server-side collector receiving events and verifying consent.Events hashed/anonymised where required.Conversions wired to Meta/Google via their server APIs.Audience retention and deletion policies defined.Reporting dashboards connected and sanity-checked with ad platform conversions.Privacy-first retargeting on a shoestring budget is very achievable. The trick is to pick tools that let you centralise events, forward only what’s necessary in a hashed or aggregate form, and rely on platform APIs for activation rather than client-side cookie hacks. Do that and you can run compliant, effective retargeting from a lean two-person setup for well under £5k/year — leaving budget for actual ad spend where it matters.
