GDPR and Tracking: Setting Up the Meta Pixel With Consent

The Meta Pixel can’t fire until a visitor in the EU says yes. Here’s how to wire it to your consent banner properly, without losing the data your ads depend on.

The Meta Pixel is one of the most useful pieces of code on a marketing website. It tells Meta which ads led to sign-ups and sales, builds retargeting audiences, and feeds the algorithm the signals it needs to find more customers like your best ones.

It is also, by default, a GDPR problem. The standard install fires the moment a page loads, sets cookies, and sends data about the visitor to Meta, all before anyone has agreed to anything. If you have visitors in the EU, the UK or the EEA, that is not compliant.

The good news: you don’t have to choose between privacy and performance. With the right setup, the pixel stays silent until a visitor consents, then works normally. This guide walks through how we set it up for clients.

A quick note: this article explains common technical practice, not legal advice. Your privacy policy and consent wording should be reviewed by someone qualified in data protection law for your markets.

Why the Meta Pixel needs consent

Two sets of rules apply here, and they are often confused.

  • The ePrivacy rules (the “cookie law”) require prior consent before you store or read anything on a visitor’s device that isn’t strictly necessary for the service they asked for. Advertising cookies like _fbp are not strictly necessary.
  • GDPR governs what happens to personal data. The pixel sends IP addresses, browser identifiers and page activity to Meta, which counts as personal data. For advertising tracking, consent is the lawful basis almost everyone relies on.

Under GDPR, valid consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give. A pre-ticked box, a banner that says “by continuing to browse you accept”, or a hidden “reject” option doesn’t meet that bar.

What a compliant setup looks like

In practice, compliant pixel tracking comes down to five behaviours:

  1. No Meta cookies are set and no data is sent to Meta before the visitor makes a choice.
  2. The banner offers “Accept” and “Reject” with equal prominence, plus a way to choose by category.
  3. Marketing cookies are a separate category from analytics and essential cookies.
  4. If the visitor accepts marketing, the pixel starts working on that page and every page after.
  5. The visitor can change their mind at any time, usually through a “Cookie settings” link in the footer, and the pixel stops.

Step 1: Choose a consent management platform

A consent management platform (CMP) shows the banner, records each visitor’s choice, and exposes that choice to your other scripts. Popular options include Cookiebot, OneTrust, Usercentrics, CookieYes and Didomi. For simple sites, a well-built open-source banner can work too.

When comparing them, check that the tool:

  • Blocks scripts until consent, rather than just displaying a notice.
  • Stores a consent log you can show a regulator if asked.
  • Integrates with Google Tag Manager, if you use it.
  • Lets you geo-target, so visitors outside regions that require opt-in can have a lighter experience if your legal advice allows it.

Step 2: Use Meta's consent API

Meta’s pixel has a built-in consent mechanism. You load the pixel code but tell it to hold back until you grant permission. This is cleaner than not loading the script at all, because once consent arrives you don’t need to re-initialise anything.

<script>
  !function(f,b,e,v,n,t,s){/* standard Meta Pixel base code */}
  (window, document,'script','https://connect.facebook.net/en_US/fbevents.js');

  // Hold all tracking until the visitor decides
  fbq('consent', 'revoke');
  fbq('init', 'YOUR_PIXEL_ID');
  fbq('track', 'PageView');
</script>

With consent set to revoke, events are queued rather than sent. When the visitor accepts marketing cookies, your CMP calls:

fbq('consent', 'grant');

The queued PageView is then sent, and tracking carries on normally. If the visitor later withdraws consent, call fbq('consent', 'revoke') again and clear the _fbp cookie.

Most CMPs fire a JavaScript event or callback when consent changes. Here’s the pattern, using a generic event name; check your CMP’s documentation for the exact one:

window.addEventListener('consentChanged', function (e) {
  if (e.detail.marketing === true) {
    fbq('consent', 'grant');
  } else {
    fbq('consent', 'revoke');
  }
});
Check one detail: some legal teams take the stricter view that the pixel script shouldn’t load at all before consent, because loading it contacts Meta’s servers. If that’s your position, use the Tag Manager approach below so the script only loads once marketing consent exists.

Step 3 (alternative): Gate it in Google Tag Manager

If your site uses Google Tag Manager, you can manage the pixel there instead of in your page code:

  1. Install your CMP’s Tag Manager template, or have the CMP push consent values into the data layer.
  2. Create a Meta Pixel tag (Meta and the community both provide templates).
  3. In the tag’s consent settings, require additional consent for the marketing or ad_storage category.
  4. Set the trigger to fire on a consent update event as well as on page view, so the pixel fires on the same page where the visitor clicks “Accept”.

This keeps every marketing tag, including the pixel, LinkedIn’s Insight Tag and TikTok’s pixel, behind a single, consistent rule.

Step 4: Handle the Conversions API carefully

Many teams add Meta’s Conversions API (CAPI) to recover data lost to ad blockers and browser restrictions. CAPI sends events from your server rather than from the browser. It is a good tool, but it is not a way around consent.

If a visitor rejected marketing cookies, your server shouldn’t send their behaviour to Meta either. The simplest way to enforce this is to pass the consent state from the browser to your backend with each request, and only forward events when marketing consent is true. Keep the same event_id on browser and server events so Meta can de-duplicate them.

Step 5: Be careful with Advanced Matching

Advanced Matching sends hashed customer details, such as email and phone, to improve attribution. Hashing doesn’t make the data anonymous; it is still personal data. Only enable it for visitors who have consented, say so clearly in your privacy policy, and send only the fields you actually need.

Step 6: Test before you trust it

Don’t assume the setup works. Test it in a private browser window:
  • Open DevTools, go to the Network tab and filter for facebook. Load the page without clicking the banner. You should see no requests sending events to Meta, and no _fbp cookie under Application → Cookies.
  • Click “Reject”. Browse a few pages. Still no events.
  • Clear cookies, reload, click “Accept”. Events should appear, and the Meta Pixel Helper browser extension should show your pixel firing.
  • Open “Cookie settings” from the footer, withdraw consent, and confirm events stop.
  • Check Events Manager’s Test Events tab to confirm server-side events follow the same rules.

What about lost data?

Some visitors will say no, and your reported conversions will drop. That’s expected. You can soften the impact by:

  • Writing a better banner. Plain language about what you track and why tends to earn more acceptance than legal jargon.
  • Using the Conversions API for consented users, which recovers events that browsers would otherwise drop.
  • Leaning on first-party data, such as sign-ups and CRM records, for audience building where you have consent to use it.
  • Judging campaigns on blended results, such as total revenue against total spend, rather than on platform-reported conversions alone.

Quick checklist

Getting consent right is a one-time setup that protects your business and keeps your ad data trustworthy. If you’d like us to audit your current tracking or set it up from scratch, get in touch.
Need a hand with this?

Our team designs, builds and secures websites, apps and AI automations for growing businesses.

Scroll to top