The Meta Pixel is one of the most useful pieces of code on a marketing website. It tells Meta which ads led to sign-ups and sales, builds retargeting audiences, and feeds the algorithm the signals it needs to find more customers like your best ones.
It is also, by default, a GDPR problem. The standard install fires the moment a page loads, sets cookies, and sends data about the visitor to Meta, all before anyone has agreed to anything. If you have visitors in the EU, the UK or the EEA, that is not compliant.
The good news: you don’t have to choose between privacy and performance. With the right setup, the pixel stays silent until a visitor consents, then works normally. This guide walks through how we set it up for clients.
Why the Meta Pixel needs consent
Two sets of rules apply here, and they are often confused.
- The ePrivacy rules (the “cookie law”) require prior consent before you store or read anything on a visitor’s device that isn’t strictly necessary for the service they asked for. Advertising cookies like
_fbpare not strictly necessary. - GDPR governs what happens to personal data. The pixel sends IP addresses, browser identifiers and page activity to Meta, which counts as personal data. For advertising tracking, consent is the lawful basis almost everyone relies on.
Under GDPR, valid consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give. A pre-ticked box, a banner that says “by continuing to browse you accept”, or a hidden “reject” option doesn’t meet that bar.
What a compliant setup looks like
In practice, compliant pixel tracking comes down to five behaviours:
- No Meta cookies are set and no data is sent to Meta before the visitor makes a choice.
- The banner offers “Accept” and “Reject” with equal prominence, plus a way to choose by category.
- Marketing cookies are a separate category from analytics and essential cookies.
- If the visitor accepts marketing, the pixel starts working on that page and every page after.
- The visitor can change their mind at any time, usually through a “Cookie settings” link in the footer, and the pixel stops.
Step 1: Choose a consent management platform
A consent management platform (CMP) shows the banner, records each visitor’s choice, and exposes that choice to your other scripts. Popular options include Cookiebot, OneTrust, Usercentrics, CookieYes and Didomi. For simple sites, a well-built open-source banner can work too.
When comparing them, check that the tool:
- Blocks scripts until consent, rather than just displaying a notice.
- Stores a consent log you can show a regulator if asked.
- Integrates with Google Tag Manager, if you use it.
- Lets you geo-target, so visitors outside regions that require opt-in can have a lighter experience if your legal advice allows it.
Step 2: Use Meta's consent API
Meta’s pixel has a built-in consent mechanism. You load the pixel code but tell it to hold back until you grant permission. This is cleaner than not loading the script at all, because once consent arrives you don’t need to re-initialise anything.
<script>
!function(f,b,e,v,n,t,s){/* standard Meta Pixel base code */}
(window, document,'script','https://connect.facebook.net/en_US/fbevents.js');
// Hold all tracking until the visitor decides
fbq('consent', 'revoke');
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');
</script>With consent set to revoke, events are queued rather than sent. When the visitor accepts marketing cookies, your CMP calls:
fbq('consent', 'grant');The queued PageView is then sent, and tracking carries on normally. If the visitor later withdraws consent, call fbq('consent', 'revoke') again and clear the _fbp cookie.
Most CMPs fire a JavaScript event or callback when consent changes. Here’s the pattern, using a generic event name; check your CMP’s documentation for the exact one:
window.addEventListener('consentChanged', function (e) {
if (e.detail.marketing === true) {
fbq('consent', 'grant');
} else {
fbq('consent', 'revoke');
}
}); Step 3 (alternative): Gate it in Google Tag Manager
If your site uses Google Tag Manager, you can manage the pixel there instead of in your page code:
- Install your CMP’s Tag Manager template, or have the CMP push consent values into the data layer.
- Create a Meta Pixel tag (Meta and the community both provide templates).
- In the tag’s consent settings, require additional consent for the marketing or
ad_storagecategory. - Set the trigger to fire on a consent update event as well as on page view, so the pixel fires on the same page where the visitor clicks “Accept”.
This keeps every marketing tag, including the pixel, LinkedIn’s Insight Tag and TikTok’s pixel, behind a single, consistent rule.
Step 4: Handle the Conversions API carefully
Many teams add Meta’s Conversions API (CAPI) to recover data lost to ad blockers and browser restrictions. CAPI sends events from your server rather than from the browser. It is a good tool, but it is not a way around consent.
If a visitor rejected marketing cookies, your server shouldn’t send their behaviour to Meta either. The simplest way to enforce this is to pass the consent state from the browser to your backend with each request, and only forward events when marketing consent is true. Keep the same event_id on browser and server events so Meta can de-duplicate them.
Step 5: Be careful with Advanced Matching
Step 6: Test before you trust it
- Open DevTools, go to the Network tab and filter for
facebook. Load the page without clicking the banner. You should see no requests sending events to Meta, and no_fbpcookie under Application → Cookies. - Click “Reject”. Browse a few pages. Still no events.
- Clear cookies, reload, click “Accept”. Events should appear, and the Meta Pixel Helper browser extension should show your pixel firing.
- Open “Cookie settings” from the footer, withdraw consent, and confirm events stop.
- Check Events Manager’s Test Events tab to confirm server-side events follow the same rules.
What about lost data?
Some visitors will say no, and your reported conversions will drop. That’s expected. You can soften the impact by:
- Writing a better banner. Plain language about what you track and why tends to earn more acceptance than legal jargon.
- Using the Conversions API for consented users, which recovers events that browsers would otherwise drop.
- Leaning on first-party data, such as sign-ups and CRM records, for audience building where you have consent to use it.
- Judging campaigns on blended results, such as total revenue against total spend, rather than on platform-reported conversions alone.
Quick checklist
- CMP installed and blocking scripts before a choice is made
- Accept and Reject buttons are equally visible
- Marketing cookies are their own category
-
Pixel starts in
revokemode or only loads after consent -
Consent changes call
grantandrevoke - Conversions API respects the same consent state
- Advanced Matching only for consented visitors
- Footer link lets visitors change their choice
- Privacy and cookie policies list Meta as a recipient
- Tested in a clean browser for all three scenarios
Our team designs, builds and secures websites, apps and AI automations for growing businesses.
