I’m actually in this industry! So Server Side GTM (SS-GTM) is still relatively new and a bit limited in the number of integrated partners.
GTM in itself doesn’t do any tracking, not even Google tracking, its just a manager. So hypothetically you could use GTM or SS-GTM to listen for clicks on a purchase button and then send a hit to your own URL with your own user identifier (or none at all). Google wouldn’t record this anywhere. If you add Google Analytics or Google Marketing tags into your GTM container, then Google would store that data in their platforms.
The real concern with privacy advocates is that you lose transparency with SS-GTM. When you run client side GTM, you can see hits going off to Google Marketing, Facebook, etc when a site has implemented those tags, and you could use ad block to prevent those network requests.
SS-GTM would only show a request going to client.com/track (or wherever GTM has been set). The privacy benefit is that Facebook and the like cannot set their own 3rd party cookies to track you across the web, however Facebook allows advertisers to pass in hashed PII (like email addresses) to match with users in their database, so if you’re logged in via email, hypothetically Facebook could be linking interactions to you. I have seen very few companies do that yet though, as it’s more complicated to setup that most things and marketing teams aren’t usually made up of engineers.