The Meta Pixel is one line of JavaScript that quietly does a lot. It sets a cookie called _fbp, reads details about the browser, and can pull email addresses and phone numbers out of your forms without you switching anything on.
All of that needs consent in the EU. Most sites we scan get the timing wrong: the banner is there, the pixel just does not wait for it.
Does the Meta Pixel need cookie consent?
Yes. The Meta Pixel writes and reads data on the visitor's device, so Article 5(3) of the ePrivacy Directive applies and consent is required before it runs. Advertising is not a strictly necessary function, so no exemption covers it. The pixel must stay dormant until the visitor accepts marketing cookies.
The part people miss is that this is a timing rule, not a paperwork rule. Mentioning Meta in your cookie policy changes nothing if the pixel already fired on page load. Consent has to come first, then the script.
What does the pixel actually collect?
More than most site owners expect. On a standard install the pixel sends the page URL, the referrer, browser and device details, and an identifier stored in the _fbp cookie. That cookie lasts three months by default and lets Meta connect the same person across every site running a pixel.
Then there are events. Every PageView, AddToCart and Purchase carries context with it: what was bought, how much it cost, sometimes the product category. On a shop, that is a fairly detailed profile of someone who never agreed to anything.
What is Automatic Advanced Matching, and why does it matter?
Automatic Advanced Matching is a Meta Pixel feature that scans your page for form fields such as email, phone number and name, hashes the values, and sends them to Meta so it can match the visitor to a Facebook account. It is a toggle inside Events Manager, and it can be switched on without anyone on your website team noticing.
This is the feature that turns a marketing tag into a data transfer problem. Hashing is not anonymisation. A hashed email address is still a way to identify a specific person, and regulators treat it that way.
Sweden's data protection authority made that concrete in July 2025. It issued fines of 37 million SEK and 8 million SEK to two online pharmacies after a Meta Pixel sub-feature transferred purchase data about medicines and health products to Meta. Nobody set out to do that. A setting was enabled, and it ran for a long time before anyone outside the companies noticed.
That is the realistic risk profile for most sites. Not a deliberate decision, just a tag doing more than the person who pasted it understood.
How common is a pixel firing before consent?
Common enough that it is the second most frequent problem we see. Across 1,775 sites in our own scan data, Meta trackers appeared on 9.2% of them, behind Google at 50.6%. Of the sites where we found a Meta tracker, roughly six in ten fired it before any consent existed.
The pattern is consistent. The site has a banner, the banner looks fine, and the pixel sits in the page head where it loads regardless. You can see the same thing on your own site with a free GDPR scan, which lists what loaded before consent rather than what your policy says should load.
How do you block the pixel until someone consents?
You have two honest options: stop the script from loading at all until consent exists, or let a consent management platform (CMP) do it for you automatically. Manually gating the pixel means moving it out of your page head and into a callback that only runs after the visitor accepts marketing cookies.
Option one: let your CMP hold it back
With Consentify, you paste one script tag in the <head>, ahead of everything else:
<script src="https://consentify.app/api/gateway?token=YOUR_TOKEN"></script>
The pixel stays in your page as normal. Consentify recognises it, holds it until the visitor accepts marketing cookies, and releases it the moment they do. No rewriting of Meta's snippet, and no separate build step. The setup details are in the Consentify documentation.
Option two: gate it yourself
If you prefer to wire it manually, keep fbq('init', ...) out of the initial page load and call it from your consent callback instead. This works, but you own it forever. Every new tag someone adds later has to be gated too, and that is the step that gets forgotten.
Does the Conversions API remove the consent requirement?
No. The Conversions API sends event data from your server instead of the browser, which avoids the cookie, but it still sends personal data about an identifiable person to Meta. That needs a legal basis, and in practice that means consent. Moving the request server side changes the plumbing, not the obligation.
It is worth saying plainly, because server-side tracking is often sold as a way around consent. It is not. It is a way to get more reliable data from the people who did consent.
Is there a Consent Mode for Meta?
Not in the way Google has one. Google's Consent Mode v2 lets its tags load in a restricted state and adjust behaviour based on consent signals. Meta has no equivalent. The pixel either runs or it does not.
That makes the job simpler and less forgiving at the same time. There is no half-loaded state to fall back on, so blocking has to be the actual mechanism.
What about Shopify and WordPress?
Both make the pixel easy to add and easy to forget. Shopify installs it through the Facebook and Instagram channel app, which means it is injected by the platform rather than sitting in a theme file you can edit. WordPress usually has it inside a marketing plugin or Google Tag Manager.
The fix is the same in both cases: the consent script loads first, the pixel waits. We cover the platform specifics in our guides for cookie consent on Shopify and cookie consent on WordPress.
A five-minute check on your own site
Worth doing today if you run ads:
- Open your site in a private window, open developer tools, go to the network tab, and filter on
facebook - Reload without touching the banner. Any request to
connect.facebook.netorfacebook.com/trmeans the pixel fired before consent - Open Events Manager and check whether Automatic Advanced Matching is on. If it is, look at which fields it is matching
- Confirm your cookie declaration lists
_fbpand any other Meta cookies - Accept, then withdraw consent, and check that the pixel stops firing
The withdrawal step is the one most setups fail. Under GDPR rules on consent, withdrawing has to be as easy as agreeing, and the site has to actually respect it rather than just stop asking.
Want to see exactly what your site loads before anyone agrees? Try Consentify free, one domain, no watermark, no time limit.