> Meta Pixel and GDPR: the _fbp and _fbc cookies, why consent is required, how to block the Pixel with a CMP or GTM, the Conversions API and a checklist.
>
> Canonical: https://www.flowconsent.com/en/blog/meta-pixel-cookies-gdpr-compliance

[Marketing tools](https://www.flowconsent.com/en/blog?category=tools)

# Meta Pixel and GDPR: the complete guide to cookies and consent

Published 7 April 2026 · Updated 9 October 2026 · 9 min read

In short

The Meta Pixel (formerly Facebook Pixel) writes advertising cookies, mainly `_fbp` and `_fbc`, on your visitors' browsers to measure conversions, build retargeting audiences and optimize Meta Ads campaigns. In Europe, the ePrivacy Directive and the GDPR require prior consent for these cookies: if the Pixel loads before the visitor clicks "Accept", your site is in breach. To use it lawfully, block it until consent through a CMP or Google Tag Manager, declare it clearly in your banner and cookie policy, make the Conversions API depend on the same consent, and check regularly that nothing leaks.

The Meta Pixel is one of the most widely installed marketing tools on the web, and one of the most closely watched by European data protection authorities: cross-site tracking, transfers to the United States and an advertising purpose make it a high-risk case. This guide covers the cookies it sets, the legal reasons consent is required, three ways to block it, its relationship with Google Consent Mode and the Conversions API, the impact on your campaigns, and a final checklist.

## What is the Meta Pixel and why does it raise GDPR issues?

The Meta Pixel is a JavaScript snippet supplied by Meta (Facebook, Instagram) that advertisers place on their site to measure the effectiveness of their ads and build audiences. As soon as it loads, it writes cookies in the visitor's browser and sends events (page views, add to cart, purchases) to Meta.

### The cookies set by the Meta Pixel

The Pixel relies on two main cookies:

- `_fbp` identifies the browser with a random identifier. Meta uses it to recognize the same visitor across visits and attribute conversions. According to Meta, it lasts 90 days.
- `_fbc` stores the ad click identifier (`fbclid`) when the visitor arrives from a Facebook or Instagram ad. It only exists when the landing URL contains `fbclid`, and Meta recommends a 90-day expiry.

Both are first-party cookies, written on your domain, but they serve Meta's advertising. They belong in the ["marketing" category](https://www.flowconsent.com/en/blog/gdpr-cookie-categories-guide): they are not needed for your site to work and qualify for no exemption. For a detailed look at their content and lifetime, read our article on [the \_fbp and \_fbc cookies](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained).

### Why consent is mandatory

Article 5(3) of the ePrivacy Directive only allows storing or reading information on a user's device with consent, unless it is strictly necessary for a service the user explicitly requested. Ad measurement and retargeting never are. The data collected also feeds Meta's targeting, including on other sites and platforms: for this cross-site advertising purpose, legitimate interest is not a defensible basis.

European authorities have repeatedly stated that advertising trackers, Meta's included, may only be set after free, specific, informed and unambiguous consent, and [several enforcement actions](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases) have targeted sites that loaded advertising scripts before consent.

### You are joint controller with Meta

In its Fashion ID judgment (C-40/17, 29 July 2019), the Court of Justice of the EU held that a website embedding a Facebook plugin is joint controller with Meta for the collection and transmission of its visitors' data, and that it is up to the website, not Facebook, to obtain consent beforehand. The same reasoning applies to the Pixel: you chose to install it, so you are responsible for asking first. Record this processing and the joint controllership in your register of processing activities.

### Data transfers to the United States

Data collected by the Pixel can be transferred to Meta Platforms Inc. in the United States. After the Privacy Shield was struck down (Schrems II, July 2020), these transfers had to rely on standard contractual clauses with supplementary measures, and in May 2023 the Irish Data Protection Commission fined Meta 1.2 billion euros over its EU-US transfers. The EU-US Data Privacy Framework, adopted in July 2023, now covers transfers to certified companies and was upheld by the EU General Court in September 2025, but it is still being challenged. Mention these transfers in your privacy policy and keep an eye on developments.

## How to block the Meta Pixel before consent

The principle is simple: the Pixel script must not run until the visitor has accepted marketing cookies. Three methods exist depending on your setup.

### Method 1: blocking through your CMP

The most reliable solution is a CMP that blocks scripts by category. With FlowConsent, you declare the Meta Pixel in **Builder > Services**: the service comes from a maintained catalog with its cookies and detection patterns, it is classified as marketing, and the banner only loads it after consent. Until the visitor accepts, the script does not run and no `_fbp` cookie is written. The [services and legal bases documentation](https://www.flowconsent.com/en/doc/services-and-legal-basis) explains how the catalog works.

The same principle applies to [Google Analytics](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) or any other third-party tracker. Watch out for pixels injected outside your code: Shopify's Facebook & Instagram channel, Meta for WooCommerce or Wix Marketing Integrations add the Pixel on their own. Turn off their pixel and declare the service in your CMP instead; the [Shopify installation guide](https://www.flowconsent.com/en/doc/install-shopify) shows how for that platform.

### Method 2: conditional loading through Google Tag Manager

If the Pixel lives in Google Tag Manager, remember that GTM has no built-in consent check for non-Google tags. Open the tag, go to **Advanced Settings > Consent Settings**, select **Require additional consent for tag to fire** and add `ad_storage`. The tag then only fires if that signal is `granted` when its trigger occurs. A Meta tag left on "Not set" fires without any check, which is the most common cause of a Pixel that still fires after a refusal. The [GTM installation guide](https://www.flowconsent.com/en/doc/install-google-tag-manager) and our [GTM and Consent Mode guide](https://www.flowconsent.com/en/blog/google-tag-manager-consent-mode-guide) detail this setup.

### Method 3: native JavaScript blocking

Without a CMP or GTM, you can condition the loading yourself: give the Pixel's `<script>` tag the type `text/plain` and only activate it once consent is confirmed. Meta also offers `fbq('consent', 'revoke')` before initialization, then `fbq('consent', 'grant')` once the visitor accepts. Meta documents this as pausing event sending, not as preventing cookie writes, so loading nothing before consent remains the safer choice. This approach works but is fragile: every site update or new script requires a manual check. That is why a CMP remains the recommended solution.

## Meta Pixel and Google Consent Mode v2

[Google Consent Mode v2](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) introduces the `ad_storage` and `ad_user_data` signals that govern Google's advertising tags. The Meta Pixel is not a Google product, but in GTM you can use the same signals to control it: as long as `ad_storage` is `denied`, the Meta tag does not fire; once the visitor accepts marketing cookies, it loads normally. This is the most common setup for advertisers running both Google Ads and Meta Ads.

One important difference: Google's advanced mode sends cookieless pings to Google even without consent, but only for Google tags. The Meta Pixel has no equivalent mechanism. Without consent, it simply must not load. To choose your Google setup, see our comparison of [basic and advanced Consent Mode](https://www.flowconsent.com/en/blog/consent-mode-basic-vs-advanced-which-to-choose).

## Meta's Conversions API: an alternative to the Pixel?

The Conversions API (CAPI) sends conversion events directly from your server to Meta, without going through the visitor's browser. It writes no cookie in the browser and is not affected by ad blockers, which is why it is often used alongside the Pixel to recover conversions.

It does not exempt you from consent. The data sent (hashed email address, IP address, user identifiers, `fbp` and `fbc` values) remains personal data under the GDPR, and the legal basis for ad retargeting is consent: legitimate interest is rarely defensible here. Never use CAPI to get around a refusal.

The right approach is to combine the Pixel and the Conversions API and make both depend on the same marketing consent. Your server must therefore know the visitor's choice: FlowConsent's [server SDK](https://www.flowconsent.com/en/doc/server-sdk) reads the decision stored by the banner, denied by default, so your backend only sends events for visitors who accepted. Our article on [server-side tagging and consent](https://www.flowconsent.com/en/blog/server-side-tagging-cookies-consent-impact) goes further.

## Transparency: banner, cookie policy and register

Blocking is not enough; the visitor must also know what they are accepting:

- **In the banner,** name Meta or the "advertising and targeting" purpose in the list of purposes subject to consent.
- **In the cookie policy,** list the Meta Pixel, the `_fbp` and `_fbc` cookies, their duration and the cross-site advertising purpose.
- **In your privacy policy and register,** describe the processing, the joint controllership with Meta and the transfers outside the EU.
- **Keep proof of consent.** You must be able to show that the visitor agreed to marketing cookies: your CMP should [store this proof](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) with a timestamp, an identifier and the accepted categories.

## The impact of blocking on your Meta Ads campaigns

Blocking the Pixel before consent reduces the volume of data collected; that is a fact. If 40% of your visitors refuse marketing cookies, roughly that share of conversions will no longer be measured by the Pixel.

### What you lose

Retargeting is hit directly: visitors who did not consent are not added to your custom audiences. Meta's algorithm receives fewer signals to optimize campaigns, which can weigh on automated bidding. Conversion tracking becomes partial.

### What you can do

Improving your [consent rate](https://www.flowconsent.com/en/blog/cookie-consent-rate-measure-improve) is the first lever: a [compliant, clear and non-manipulative banner](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) usually achieves better acceptance than a poorly designed one or one using [dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited), which also exposes you to sanctions. The Conversions API, combined with the Pixel and conditioned on consent, recovers part of the conversions lost to browsers and ad blockers. Finally, [cookieless analytics](https://www.flowconsent.com/en/blog/cookieless-analytics-complete-guide) can supplement your audience data without relying on advertising identifiers.

## Common mistakes with the Meta Pixel and the GDPR

- **Loading the Pixel in the \`\<head>\` without blocking.** The standard code from Meta Events Manager runs as soon as the page loads. Pasted as is, it tracks every visitor before they can refuse. This is the most frequent and most sanctioned violation.
- **Letting a platform inject the Pixel.** E-commerce extensions, sales channels and site-builder integrations add the Pixel outside your code and bypass your banner.
- **Classifying the Pixel as "functional" or "statistics".** The Pixel does not measure your site's performance for you: it sends data to Meta for ad targeting. It is marketing.
- **Blocking the script but not every source of \`\_fbp\`.** Check that no other script, plugin or GTM tag recreates the cookie in the background. A regular [cookie audit](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide) catches these leaks.
- **Forgetting \`\_fbc\` in the audit.** It only appears when the URL contains `fbclid`: test the landing pages of your Meta campaigns with that parameter.
- **Using CAPI to get around a refusal.** Server-side sending does not remove the consent requirement when the data identifies a person.
- **Confusing your CMP's consent with Meta's terms.** The consent collected on your site covers cookies and the related processing; Meta's own terms are separate, and both must coexist.
- **Treating Meta as sole controller.** You are joint controller for the collection on your site, with the obligations that come with it.
- **Not keeping proof of consent.** Without a timestamped record, you cannot demonstrate that the visitor accepted.

## Checklist: a GDPR-compliant Meta Pixel

1. Classify the Meta Pixel as "marketing" in your CMP.
2. Remove any hard-coded Pixel and turn off pixels injected by extensions or sales channels.
3. Block loading until consent through your CMP, a GTM additional consent check on `ad_storage`, or a conditional script.
4. In private browsing, check that the Pixel does not load before any click on the banner.
5. Make the Conversions API depend on the same consent, and never send identifying data for visitors who refused.
6. Name Meta in the banner, list `_fbp` and `_fbc` with their duration in the cookie policy, and update your privacy policy.
7. Document the joint controllership and the transfers in your register.
8. Check that your CMP records proof of consent.
9. Run a [scan of your site](https://www.flowconsent.com/en/scan) to confirm that `_fbp` and `_fbc` do not appear before consent, including on campaign landing pages with `fbclid`.
10. Audit regularly: a Pixel update or a new plugin can reintroduce loading without consent. Continuous monitoring is described in the [compliance verification documentation](https://www.flowconsent.com/en/doc/compliance-verification).

## Conclusion

The Meta Pixel is a powerful tool for your Meta Ads campaigns, but it writes marketing cookies that require prior consent in Europe and makes you jointly responsible for what it collects. Compliance comes down to blocking the script until consent, informing visitors clearly, making the Conversions API follow the same choice and checking regularly that nothing slips through. [Run a free scan of your site](https://www.flowconsent.com/en/scan) to see whether the Meta Pixel sets cookies before consent.

[Back to the blog](https://www.flowconsent.com/en/blog)

Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fmeta-pixel-cookies-gdpr-compliance) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fmeta-pixel-cookies-gdpr-compliance)

Questions

## Common questions on this topic.

Can't find your question? Write to us, we answer fast.

[Write to us](https://www.flowconsent.com/en/demo)

### Does the Meta Pixel set cookies without consent by default?

Yes. The standard Meta Pixel code, as provided by Meta Business Manager, executes on page load and immediately sets the \_fbp and possibly \_fbc cookies. Without a blocking mechanism (CMP or conditional loading), these cookies are written before any consent.

### Can you use the Meta Pixel without a cookie banner?

No, not in Europe. The Meta Pixel sets marketing cookies that require prior consent under the GDPR and ePrivacy Directive. A compliant cookie banner is essential to collect this consent before the script loads.

### Does Meta's Conversions API exempt you from GDPR consent?

No. The Conversions API transmits personal data (hashed email, IP address) to Meta's servers for ad targeting. This processing requires a legal basis, and for retargeting, consent applies. The Conversions API does not set cookies but does not remove the consent obligation.

### How can I check if the Meta Pixel loads before consent on my site?

Open your site in private browsing, refuse all cookies in the banner, then open the browser developer tools (Application tab, then Cookies). If you see an \_fbp or \_fbc cookie, the Pixel loads without consent. You can also use a cookie scanner to automate this check.

### Is the Meta Pixel compatible with Google's Consent Mode v2?

The Meta Pixel is not a Google product and does not natively support Consent Mode. However, through Google Tag Manager, you can make the Meta Pixel tag conditional on the ad\_storage parameter. When ad\_storage is denied, GTM does not fire the tag.

### What is the impact of blocking the Meta Pixel on my Facebook Ads campaigns?

Blocking reduces the volume of conversion data sent to Meta. Retargeting visitors who did not consent becomes impossible, and Meta's optimization algorithm receives fewer signals. The exact impact depends on your consent rate. The Conversions API can offset some of this data loss.

Read next

## Keep reading.

[All articles](https://www.flowconsent.com/en/blog)

[Marketing tools · 5 May 2026](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent)

### [TikTok Pixel and GDPR: cookies, consent and compliance](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent)

[The TikTok Pixel sets marketing cookies on your site as soon as it loads. How to block it before consent, Events API, data transfers: the complete guide.](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent)

[Read the article ](https://www.flowconsent.com/en/blog/tiktok-pixel-cookies-gdpr-consent)·

[Marketing tools · 29 June 2026](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)

### [The \_fbp cookie (and \_fbc) explained: what it is, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)

[What the Meta cookies \_fbp and \_fbc contain, how long they last, how they feed the Conversions API and why they must stay blocked until your visitors consent.](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)

[Read the article ](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained)·

[Marketing tools · 7 May 2026](https://www.flowconsent.com/en/blog/linkedin-pixel-cookies-gdpr-compliance)

### [LinkedIn Pixel and GDPR: cookie compliance guide](https://www.flowconsent.com/en/blog/linkedin-pixel-cookies-gdpr-compliance)

[The LinkedIn Insight Tag sets third-party advertising cookies. This guide explains why prior consent is mandatory and how to configure your site to stay GDPR compliant.](https://www.flowconsent.com/en/blog/linkedin-pixel-cookies-gdpr-compliance)

[Read the article](https://www.flowconsent.com/en/blog/linkedin-pixel-cookies-gdpr-compliance)

## Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

[Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)