What is a tracking pixel? How pixel tracking works and how it differs from cookies

What is a tracking pixel?

A tracking pixel (also called a web beacon, spy pixel or pixel tag) is a piece of code that loads a resource from another server for the sole purpose of telling that server something happened. The classic form is a 1x1 transparent GIF. Nobody sees it, but loading it is enough: the request carries your IP address, your browser or mail client, the time, the page or email it came from, and any identifier added to the image URL.

Today, most "pixels" on websites are no longer just images. The Meta Pixel, the TikTok Pixel or the LinkedIn Insight Tag are JavaScript snippets that collect events (page view, add to cart, purchase) and send them to the platform. They keep an image fallback for browsers without JavaScript. The name stayed, the technology grew.

Pixels belong to the wider family of trackers that our guide to what cookies are and how they work describes: cookies, local storage, pixels and fingerprinting. The law treats them alike, as you will see below.

How does pixel tracking work?

On a website

1. You open a page. The page contains a pixel tag, for example the Meta Pixel snippet.
2. Your browser loads the script or the image from the platform's server (facebook.com, tiktok.com, linkedin.com).
3. The request sends the page URL, a timestamp, technical data about your device and an event name.
4. The script reads or writes a cookie so the platform can link this visit to earlier ones and to an ad click. The Meta Pixel, for example, writes the first-party cookies _fbp and _fbc, explained in our article on the _fbp and _fbc cookies.
5. The platform matches the event to a user or an ad campaign, then uses it for conversion measurement, retargeting and audience building.

In an email

Email pixels are simpler. The sender puts an invisible image in the message, with a unique ID in its URL. When your mail app displays images, it fetches that image, and the sender learns that you opened the email, when, on what kind of device, and roughly where (from your IP address). There is no cookie involved: the unique URL does the identifying.

Two changes made email pixels less reliable. Gmail has loaded images through its own proxy since 2013, which hides your IP address. Apple Mail Privacy Protection, introduced with iOS 15 in 2021, preloads remote images for users who turn it on, so many "opens" are recorded even when nobody read the email.

Tracking pixel vs cookie: what is the difference?

The two are often confused because they work together. The short version: a pixel is a messenger, a cookie is a memory.

• What it is: a pixel is a request to a remote server (an image or a script). A cookie is a small text file stored in the browser.
• What it does: the pixel sends information out when something happens. The cookie keeps an identifier or a setting so it can be read later.
• Where it lives: the pixel lives in the page or the email code. The cookie lives in your browser, tied to a domain.
• Where it works: pixels work in web pages and in emails. Cookies work in browsers, and most mail apps do not keep them.
• Who sees it: you can find cookies in your browser storage. A pixel only shows up in the page source or in the network requests.
• Blocking: blocking third-party cookies does not stop a pixel from firing. It only stops the pixel from recognising you across sites through those cookies.

In practice, most web pixels use cookies. The platform's script sets a first-party or third-party cookie, then every pixel event carries that cookie's value. So the question is rarely "pixel or cookie": a modern ad pixel is usually both. Our guide to tracking cookies covers the cookie side in more detail.

Examples of tracking pixels

• Meta Pixel: conversions, retargeting and lookalike audiences for Facebook and Instagram ads. Our Meta Pixel and GDPR guide covers its setup with consent.
• TikTok Pixel, LinkedIn Insight Tag, Pinterest Tag, X Pixel: the same model for each ad network.
• Google Ads and Microsoft Ads conversion tags: they record a conversion after an ad click.
• Email open pixels: used by newsletter tools and marketing platforms to measure opens.
• Affiliate pixels: they credit a sale to the partner who sent the visitor.

Many advertisers now add a server-side channel, such as the Meta Conversions API, which sends events from your server instead of the browser. That changes the route, not the rules: if the event comes from a visitor who refused tracking, sending it from the server is not a way around consent. Our article on server-side tagging and consent explains why.

Are tracking pixels legal? Consent under GDPR and ePrivacy

Tracking pixels are not illegal, but in Europe most of them need prior consent. Two texts apply.

The ePrivacy Directive (article 5(3)) requires consent for any storing of information on the user's device or access to information already stored there, unless it is strictly necessary for a service the user asked for. In its Guidelines 2/2023 on the technical scope of article 5(3), final version adopted in October 2024, the European Data Protection Board states that tracking pixels and tracking links fall within that scope, because they make the device send information it would not otherwise send. Whether a cookie is set or not does not change the answer. You can read the rule on our page about the ePrivacy Directive.

The GDPR applies to what happens next, because a pixel hit usually contains personal data (IP address, identifiers). You need a legal basis, transparency in your privacy notice, and, for ad platforms, a clear split of roles with the platform. See our page on the GDPR.

Website pixels

Advertising and retargeting pixels need consent before they load. That means the pixel script must be blocked until the visitor clicks accept on the marketing category, and must stay blocked if they refuse. Loading the Meta Pixel on page load and "disabling" it later is not compliant, because the first request has already left the browser. A consent banner such as FlowConsent, for example, keeps the Meta Pixel script from loading until the visitor accepts the marketing category.

Not sure which pixels your site fires before consent? Check it in 30 seconds with the free cookie scanner: it lists the cookies and the third-party requests your pages make on the first load.

Email pixels

Email tracking got its own rules in France. On 14 April 2026, the CNIL published a recommendation on tracking pixels in emails (deliberation 2026-042 of 12 March 2026). The main points, from the CNIL recommendation and its FAQ:

• Pixels used to measure opens for marketing, personalise content or adjust send frequency need consent, separate from the consent to receive the email.
• Two narrow uses can be exempt: measuring deliverability (only the date of the last open, to clean the mailing list) for emails the recipient asked for, and some security uses such as password reset emails.
• An exempt pixel may keep only the date of the last open. Recording the time of opening, the IP address or the device takes it out of the exemption, so consent is then needed.
• For addresses collected before 14 April 2026, senders had about three months, until mid-July 2026, to inform recipients and let them object.

That is why many French newsletters asked their subscribers in 2026 to choose whether they accept the "pixel de suivi". The recommendation applies in France. Elsewhere, the EDPB reading of article 5(3) applies across the EU, and the UK's ICO guidance on storage and access technologies also covers tracking pixels.

How to detect tracking pixels on a website

• Developer tools: open the Network tab (F12), reload the page and filter by "facebook", "tiktok", "collect" or "pixel". Every request is a pixel hit.
• Page source: search for fbq(, ttq., _linkedin_partner_id or <img tags with a width and height of 1.
• Before and after consent: run the test once without touching the banner, then after refusing. Nothing marketing-related should fire in either case.
• A scanner: it loads the page as a new visitor and lists what fires before any choice.

How to block tracking pixels

As a visitor or email reader, you have a few options:

• Refuse marketing cookies in the cookie banner. A compliant site then does not load its ad pixels at all.
• Use a browser with tracking protection (Firefox, Safari, Brave) or a content blocker, which block known pixel domains.
• In your mail app, turn off automatic loading of remote images, or turn on Mail Privacy Protection on Apple devices.
• Use the "manage tracking" or preference link that newsletters must now offer in France.

How FlowConsent handles tracking pixels

FlowConsent is a consent banner for websites, so it handles the pixels on your pages, not the ones in your emails. Each pixel is a service in the catalog (Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, Google Ads and others) attached to the marketing category. The banner blocks those scripts until the visitor accepts that category, and keeps them blocked after a refusal. The automatic scan detects pixels you forgot, and Google Consent Mode v2 is built in for Google tags. Every choice is stored as exportable proof of consent. The setup of services, categories and legal bases is described in the services and legal basis documentation. FlowConsent is free up to 25,000 sessions per month and is hosted in Europe.