Facebook SDK

The Facebook SDK writes the first party cookie _fbp containing the Meta Pixel browser identifier with a 90 day lifetime and a _fbc cookie that captures click attribution from the fbclid URL parameter. When the visitor is logged into Facebook, the SDK reads or writes the third party cookies fr (90 days, advertising), datr (2 years, security and identification), c_user (90 days, identity) and xs (session, identity) on the facebook.com domain. All these cookies must be classified as non essential and require prior consent.

Yes, consent is strictly required. The SDK loads scripts that drop cookies and forward personal data to Meta for advertising purposes, which is non essential processing under Art 5(3) of the ePrivacy Directive and Art 6(1)(a) GDPR. The script must remain blocked until the user provides freely given, specific, informed and unambiguous consent through a compliant Consent Management Platform. Refusal must be as easy as acceptance and consent must be renewable and withdrawable at any time.

The only valid legal basis is the explicit consent of the user under Art 6(1)(a) GDPR. Legitimate interest cannot be invoked because the European Data Protection Board confirmed in 2023 that Meta cannot rely on legitimate interest or contract for personalised advertising. Operators must document the consent record, including timestamp, scope and policy version, and be able to demonstrate consent on request from the supervisory authority.

For EEA users the controller is Meta Platforms Ireland Limited in Dublin, however the data is mirrored to Meta Platforms Inc in the United States. Transfers rely on the EU US Data Privacy Framework adopted in July 2023 and Standard Contractual Clauses with supplementary measures. The framework is still challenged in light of the Schrems II ruling, and the Irish DPC fined Meta 1.2 billion euros in 2023 for unlawful transfers tied to Facebook services. A transfer impact assessment is required.

Yes, a Data Protection Impact Assessment is mandatory under Art 35 GDPR because the processing involves systematic monitoring, profiling, large scale processing and transfers to a third country. The DPIA must describe the data flows, identify the risks to data subjects, evaluate the necessity and proportionality of the processing and define mitigation measures such as a compliant CMP, server side integration via the Conversions API, IP truncation and a documented retention policy.

Deploy the SDK only after consent through a compliant Consent Management Platform that supports IAB TCF v2.2. If the Meta Pixel is deployed through Google Tag Manager, configure Consent Mode v2 with the ad_storage and ad_user_data signals. Prefer server side integration via the Conversions API to reduce browser side exposure, apply IP truncation and server side hashing of personal identifiers, and document everything in the record of processing activities under Art 30 GDPR.

Compliant alternatives include server side integration via the Conversions API without the browser SDK, first party tracking through a privacy oriented analytics platform, contextual advertising solutions that do not rely on personal data, native login through OpenID Connect providers based in the EU and embedded social content via static previews rather than iframes loading facebook.com. Each alternative reduces or eliminates the dependency on Meta cookies and cross border transfers.

List every cookie set by the SDK with its name, purpose, duration and category, identify Meta Platforms Ireland Limited and Meta Platforms Inc as joint controller and processor where applicable, mention the transfer mechanism (DPF and SCCs), describe data subject rights including objection and erasure, link to the Meta privacy policy and explain how to withdraw consent. Review the cookie policy at least annually or whenever Meta updates its SDK or data practices.