Privacyboard
Start free
PricingSign in

Meta Pixel and advertising cookies: consent, server-side and limits

By the Privacyboard teamPublished 13 November 20268 min read
Short answer

In the EU and the UK, the Meta Pixel needs the visitor's consent before it loads, because it stores and reads information on the device for advertising. Sending events server-side through the Conversions API moves the transfer off the page, but the website is still a joint controller for that collection, so the same consent and notice apply to it.

Short answer: in the EU and the UK, the Meta Pixel should not load until the visitor has said yes to advertising cookies. It stores and reads identifiers on the device for advertising, which is exactly what the consent rule in Article 5(3) of the ePrivacy Directive covers. Moving events to the server with Meta's Conversions API does not remove that need: the website still collects the data and passes it to Meta, and it remains responsible for that step.

This guide covers what the pixel does, why consent is needed, what server-side tracking changes, what regulators have fined, and a checklist for your own site. It is general information, not legal advice.

#What does the Meta Pixel actually do?

The Meta Pixel is a piece of JavaScript from Meta that you add to your pages. When a visitor views a page, adds to cart or buys, it sends that event to Meta. Meta uses the events to measure ads, build audiences (for example "people who visited the pricing page") and optimise who sees your ads on Facebook and Instagram.

To link events to a person, the pixel sets first-party cookies (such as _fbp) and can read Meta's own identifiers. With advanced matching, it can also send details the visitor typed, such as email, phone, name, city or date of birth. Meta's documentation says the pixel hashes these values with SHA-256 before sending them.

Hashing does not make the data anonymous. Meta hashes the email precisely so it can match it to an account, and the GDPR treats pseudonymised data as personal data (Recital 26).

Yes, in the EU, the EEA and the UK. Article 5(3) of the ePrivacy Directive requires consent before information is stored on, or read from, a user's device, unless it is strictly necessary for a service the user asked for. Advertising is not strictly necessary.

The European Data Protection Board confirmed in its Guidelines 2/2023, adopted in final form on 7 October 2024, that tracking pixels fall under this rule. Delivering the pixel to the browser counts as storage, and instructing the browser to send identifiers back counts as gaining access (paragraphs 50 and 51).

In the UK, the ICO's guidance on storage and access technologies says plainly that their use "for online advertising purposes requires consent", including any associated tracking and profiling.

Meta itself leaves this to you. Its GDPR page for the pixel says "Each company is responsible for ensuring their own compliance with the GDPR" and offers two commands: fbq('consent', 'revoke') before the pixel starts, and fbq('consent', 'grant') once the visitor agrees.

#Who is responsible: you or Meta?

Both, for different steps. In Fashion ID (C-40/17, 29 July 2019), the Court of Justice of the EU held that a website embedding a Facebook plugin is a joint controller with Facebook for the collection of visitors' data and its transmission to Facebook. The site is not responsible for what Meta does afterwards, but it must obtain consent, and inform visitors, for the part it controls.

That reasoning applies to any Meta Business Tool that collects data on your site and sends it to Meta, including the pixel and the Conversions API.

StepWho is responsibleWhat it means for you
Loading the pixel and setting its cookiesYou (ePrivacy)Consent first, a way to refuse as easily as accept
Collecting events and sending them to MetaYou and Meta, jointlyNotice in your privacy policy, consent where required
Meta's ad targeting and its own use of the dataMetaNot yours, but name Meta as a recipient
What you choose to send (URLs, form fields, purchases)YouData minimisation; no health or other sensitive data

#What does the Conversions API change?

The Conversions API sends events from your server to Meta instead of from the visitor's browser. Many sites run both and let Meta remove duplicates: an event is dropped when the pixel's eventID and the server's event_id match, with the same event name, within 48 hours.

What it changes:

  • Ad blockers and browser limits on third-party scripts no longer stop the events.
  • You control the payload. You can drop fields, trim URLs and decide exactly what leaves your server.
  • Fewer scripts run in the page.

What it does not change:

  • The legal question. The data still comes from your visitor and still goes to Meta for advertising. You are still collecting and transmitting it, so you still need a legal basis, and for advertising that is consent in practice.
  • The device rule, in most setups. Server events usually carry the _fbp and _fbc cookie values, the IP address and the user agent, which Meta's documentation says must be sent unhashed. Reading those cookies from the browser is access to the device. The EDPB adds that even IP-based tracking can fall under Article 5(3) (paragraphs 54 to 55).
  • The data you send. Hashed emails and phone numbers are still personal data.

The practical rule: send a server event only for visitors who accepted advertising, and pass the consent state from the page to the server with the event.

#What have regulators fined so far?

Sweden, 3 July 2025. The Swedish authority IMY fined the pharmacy chains Apoteket SEK 37 million and Apohem SEK 8 million. After they turned on a new sub-feature of the Meta Pixel, data about customers' purchases, including self-tests and products for sexually transmitted infections, went to Meta. IMY found they lacked the technical and organisational measures to detect it, and the transfers stopped only after outsiders alerted them.

United States, 1 February 2023. The Federal Trade Commission took action against GoodRx under the Health Breach Notification Rule, with a $1.5 million civil penalty, for sharing users' health information with Facebook and others for advertising without telling them.

The lesson in both cases is less about the cookie banner than about what the pixel sends. A pixel on a pharmacy, clinic, bank or dating site can reveal sensitive facts from page URLs, product names and event names alone.

#Are email tracking pixels the same thing?

They follow the same rule. On 12 March 2026, the French CNIL adopted a recommendation on tracking pixels in emails. It considers consent necessary for pixels used to measure open rates for campaign optimisation or to build profiles, and allows a few narrow exemptions, such as security and keeping a mailing list clean. Display advertising and direct marketing need separate consent.

Not yet. In May 2026 the ICO sent the UK government advice on possible new exceptions for online advertising. It proposes allowing aggregated measurement of impressions and clicks without consent, and attribution only where it is anonymised and prevents cross-site tracking. The ICO notes it is for government to decide if and how the law should change, and it keeps enforcing the current rules. As of 13 November 2026, the Meta Pixel in its standard setup still needs consent in the UK.

#Checklist: running Meta ads on a site with EU or UK visitors

  • The pixel does not load, and no _fbp cookie appears, before the visitor accepts advertising or marketing cookies.
  • Refusing is as easy as accepting, and the visitor can withdraw consent later from every page.
  • If you use the Conversions API, server events are sent only for visitors who consented.
  • Advanced matching sends only the fields you need, and you know which ones are switched on.
  • No health, financial, children's or other sensitive data in URLs, event names, product names or custom parameters.
  • Your privacy policy names Meta, the purpose (advertising and measurement) and the joint responsibility for collection.
  • Your cookie policy lists Meta's cookies and their duration under the right category.
  • Someone reviews the pixel settings after each change in Meta Events Manager, since new features can change what is sent.
  • Meta is in your vendor list, with its role and where it processes data.

If you use Privacyboard, its cookie banner holds back known trackers, including the Meta Pixel, until the visitor accepts their category, and removes Meta's cookies when consent is refused or withdrawn. Server-side tools run outside the page, so their consent must be handled on your server.

#FAQ

Not with EU or UK visitors in a standard setup. The pixel stores and reads identifiers on the device for advertising, which needs prior consent. Outside Europe the rules differ: several US state laws give people a right to opt out of targeted advertising instead.

No. It changes where the data leaves from, not whose data it is or what it is used for. You still collect personal data for advertising and pass it to Meta, and server events usually rely on identifiers read from the browser.

No tool is legal or illegal on its own. What regulators look at is how you run it: consent before it loads, clear information, and no sensitive data in what it sends. The Swedish fines of 2025 came from what the pixel sent, not from the pixel being present.

#Does hashing emails with SHA-256 make advanced matching anonymous?

No. The hash is designed to be matched to a Meta account, so the person stays identifiable. Under the GDPR that is pseudonymised data, which is still personal data.

#Can I rely on legitimate interests for Meta ads?

Not for the cookies and device access, which need consent under the ePrivacy rules. For the collection and transfer to Meta, the Court of Justice said each joint controller needs its own legal basis, and regulators generally expect consent for tracking-based advertising.

#What should a health or finance site do?

Check every event and URL the pixel or the Conversions API sends, and stop anything that reveals a condition, product or financial situation. Many such sites keep the pixel off sensitive pages entirely or limit it to non-identifying events.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to hello@privacyboard.io.

Keep reading

Cookies and consentIs Google Analytics allowed in the EU? What regulators have saidWhy European regulators ruled against Google Analytics in 2022 and 2023, what the EU-US Data Privacy Framework changed, and what you still need: consent, settings and a backup plan.12 November 2026 · 9 min readCookies and consentGDPR cookie consent: what the rules actually requireWhen you need consent for cookies, what valid consent looks like under the ePrivacy Directive and the GDPR, and what a cookie banner has to do, step by step.7 October 2026 · 5 min readCookies and consentGoogle Consent Mode v2 explained for small businessesWhat Google Consent Mode v2 is, the four consent signals it uses, the difference between basic and advanced mode and how it relates to your cookie banner and the GDPR.21 October 2026 · 5 min read