Facebook Pixel Advanced Matching

What Facebook Pixel Advanced Matching is

The Meta Pixel, still widely known as the Facebook Pixel, is a JavaScript snippet that records visitor actions such as page views, add to cart events and purchases. Advanced Matching is an optional layer that attaches customer information you already hold, for example an email address or phone number, to each event. Meta hashes these values and matches them against its own user base so that conversions are attributed more accurately and custom audiences become larger and more precise.

What data and cookies it collects

The pixel writes a first party cookie named _fbp and reads the third party fr cookie set on facebook.com, and it captures the _fbc click identifier when a visitor arrives from a Meta ad. Advanced Matching adds hashed parameters derived from fields such as email, phone, first name, last name, city, postal code and country. Although the values are hashed with SHA 256 before leaving the browser, they remain personal data because Meta can match them back to identified accounts.

GDPR and ePrivacy implications

Storing and reading the pixel cookies requires consent under Article 5(3) of the ePrivacy Directive, and the subsequent processing and sharing of hashed identifiers requires a legal basis under the GDPR. Because Advanced Matching shares direct identifiers with a large advertising platform, supervisory authorities treat it as high risk profiling. Meta acts as a controller for much of this data, so a controller to controller relationship and clear transparency are essential.

Consent requirements

You must obtain prior, informed and freely given consent before the pixel loads and before any hashed data is collected. The pixel script should be blocked until the visitor accepts marketing cookies, and Advanced Matching should never be enabled by default. Consent Mode signals can be passed to Meta so that no identifiers are transmitted when a visitor declines, and every consent decision should be logged with a timestamp.

Data transfers to the United States

Event and matching data flow to Meta infrastructure in the United States. These transfers rely on the EU US Data Privacy Framework, under which Meta is certified, supported by standard contractual clauses for any processing that falls outside the framework. Document the transfer mechanism in your records of processing, and inform visitors that their data, including hashed identifiers, may be processed outside the European Economic Area.

Practical compliance steps

Load the pixel through a consent management platform that blocks it until marketing consent is granted, and gate Advanced Matching behind the same signal. Limit the fields you share to what is necessary, sign the Meta controller addendum, complete a DPIA, and describe the pixel, the hashed data and the US transfer in your cookie policy and privacy notice. Review configurations regularly so that no new automatic matching is silently enabled.