FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Advertising

Meta Business Suite

Marketing

Meta Business Suite is the free management platform for Facebook, Instagram and WhatsApp Business accounts. It bundles Page management, Messenger and Instagram inbox, content scheduling, ads management and insights. When merchants embed Meta widgets (Customer Chat, Page plugins, Messenger button, Instagram chat) on their websites, those widgets set Meta cookies and share data with Meta Platforms Ireland and Meta Platforms Inc. in the United States, which requires consent and triggers cross border transfers.

Block Meta Business Suite until consentScan my site
Overview

What does Meta Business Suite do?

What is Meta Business Suite

Meta Business Suite is Meta's free management platform for businesses operating Facebook Pages, Instagram accounts and WhatsApp Business profiles. It unifies content scheduling, inbox for Messenger and Instagram, ads management, insights and the configuration of integrations such as Customer Chat, Page plugins, the Meta Pixel and the Conversions API. While the dashboard itself is used by business operators, several Meta Business Suite features place tracking and processing onto merchant websites.

Data and cookies collected

When merchants embed Meta widgets, Meta sets third party cookies on facebook.com (datr, fr, sb, c_user, xs) and instagram.com. Conversations through Customer Chat are stored on Meta infrastructure and linked to the visitor's Facebook account when they are logged in. Meta also receives the URL, referrer, IP and browser of the visitor. WhatsApp Business API messages flow through Meta servers. Meta Pixel and the Conversions API stream events from the merchant site to Meta.

GDPR and ePrivacy implications

The Court of Justice ruled in Wirtschaftsakademie (C-210/16) and Fashion ID (C-40/17) that operators of Facebook Pages and embedded Like buttons are joint controllers with Meta for the data sent to Facebook. The same logic applies to Meta Business Suite widgets embedded on a merchant site. Cookies set by these widgets are non essential and require consent under Art. 5(3) ePrivacy. The Irish DPC has issued multiple GDPR decisions against Meta on legal basis and transfers; merchants must keep up with these developments.

Consent requirements

Explicit consent is required before loading any Meta widget. Consent should distinguish Customer Chat (joint controller messaging), Page plugins (joint controller social engagement) and Pixel/Conversions API (consent for ads measurement and retargeting). Use IAB TCF v2.2 if you are in publishing, or Google Consent Mode v2 plus Meta Conversions API consent signalling for direct merchants.

Data transfers outside the EEA

Meta Platforms Ireland is the EU controller. EU personal data is transferred to Meta Platforms Inc. in the United States and other affiliates. Meta is certified under the EU US Data Privacy Framework and uses Standard Contractual Clauses. Meta has invested in EU data centres (Ireland, Sweden, Denmark) but the company structure continues to involve onward transfers. Merchants should follow ongoing DPC and EDPB decisions.

Practical compliance steps

Sign Meta's Page Insights Controller Addendum and the Custom Audiences Addendum where applicable, load Meta widgets only after consent for ads or social features, document joint controllership for Page plugins and Customer Chat in your privacy notice, use Conversions API with proper consent signalling, complete a Transfer Impact Assessment that accounts for the EU US Data Privacy Framework, and offer users a clear way to withdraw consent for Meta tracking.

Compliance

Meta Business Suite and the GDPR

Meta Business Suite is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR) for embedded Meta widgets (Customer Chat, Page plugins, Messenger, Instagram), Conversions API event sharing and ads measurement; Contract or legitimate interest may apply to internal use of the dashboard by business users themselves
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law), Digital Services Act, Digital Markets Act, EU US Data Privacy Framework, IAB TCF v2.2

Impact assessment (DPIA)

Meta Business Suite itself is a dashboard for business users, but the widgets it lets merchants deploy raise major GDPR considerations. Key DPIA considerations: (1) Customer Chat and Messenger widgets set third party cookies on facebook.com and require consent; (2) Meta acts as a joint controller with merchants for some processings (Wirtschaftsakademie ruling, Fashion ID), particularly Page Insights and embedded plugins; (3) data is transferred to the United States, subject to the EU US Data Privacy Framework and the still ongoing Schrems litigation; (4) the Irish DPC has fined Meta heavily over transfers; (5) Conversions API and Pixel events shared from the site to Meta require explicit consent and Consent Mode v2 like signaling; (6) WhatsApp Business API messages are processed by Meta and stored on Meta infrastructure with their own retention and transparency rules.

Sample text for your banner

With your consent, we use Meta Business Suite tools (Messenger chat, Instagram messaging, Customer Chat) to talk with you and to share certain conversion events with Meta. Meta Platforms Ireland Limited acts as our joint controller for these features. Data is transferred to Meta Platforms Inc. in the United States under Standard Contractual Clauses and the EU US Data Privacy Framework.
Cookies and trackers

What Meta Business Suite sets and contacts

Tracking method
Meta business platform for managing Facebook, Instagram and WhatsApp; embeds Customer Chat, Page plugins, Messenger and Instagram chat widgets on customer sites; integrates with Meta Pixel and Conversions API; third-party cookies on facebook.com when widgets are loaded
Server location
United States (Meta Platforms Inc., Menlo Park) with EU controller Meta Platforms Ireland Limited in Dublin; global data centres including Clonee (Ireland), Lulea (Sweden) and Odense (Denmark) for European data
Data transferred outside the EU
Meta Platforms Ireland Limited acts as the EU controller for European users. Personal data is shared with Meta Platforms Inc. in the United States and other Meta affiliates. Transfers rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and the EU US Data Privacy Framework, for which Meta is certified. The Irish DPC has issued multiple decisions on Meta transfers (notably the 1.2 billion EUR fine in 2023), and merchants should monitor ongoing regulatory developments.

Cookies set (6)

NameTypeDurationPurpose
datrMarketing2 yearsMeta cookie set on facebook.com when Customer Chat or any Meta plugin loads. Identifies the browser used to access Facebook, regardless of logged in status.
frMarketing90 daysMeta cookie containing the Facebook browser ID and used for advertising and frequency capping across Meta properties.
sbMarketing2 yearsMeta cookie used to improve login suggestions and account recovery; set when Meta widgets are loaded.
c_userFunctionalSession/persistentIdentifies the logged in Facebook user when the visitor is authenticated and interacts with embedded Meta widgets such as Customer Chat.
xsFunctionalSession/persistentStores the Facebook session for logged in users when Meta widgets are present on the page.
wdMarketing7 daysStores window dimensions used by Meta to optimise rendering of widgets and ads.

Third-party domains contacted (5)

  • facebook.com
  • business.facebook.com
  • connect.facebook.net
  • instagram.com
  • graph.facebook.com
Questions

Frequently asked questions about Meta Business Suite

Can't find your question? Write to us, we answer fast.

What cookies do Meta Business Suite widgets set?

When Customer Chat, Page plugins or social embeds are loaded, Meta sets third party cookies on facebook.com (datr 2 years, fr 90 days, sb 2 years, c_user, xs for logged in users) and equivalent cookies on instagram.com. These are non essential and consent based.

Do I need consent to use Meta Business Suite features on my site?

Yes. The widgets that Meta Business Suite lets you deploy on your site (Customer Chat, Messenger button, Page plugins, Instagram chat) load Meta scripts and place cookies, so consent under Art. 5(3) ePrivacy and Art. 6(1)(a) GDPR is required before loading.

What is the legal basis for processing data via Meta Business Suite?

Consent (Art. 6(1)(a) GDPR) for all visitor facing widgets that involve Meta cookies or Conversions API. Joint controllership under Art. 26 GDPR applies for Page Insights and embedded plugins, with an addendum from Meta. Legitimate interest is not a safe basis for the visitor side processing.

Where does Meta process data, and what about US transfers?

Meta Platforms Ireland is the EU controller. Data is transferred to Meta Platforms Inc. in the US under SCCs and the EU US Data Privacy Framework. Meta runs EU data centres in Ireland, Sweden and Denmark, but onward transfers within the group remain part of the model.

Is a DPIA required for Meta Business Suite widgets?

Yes. Anything Meta deploys on your site (cookies, plugins, Conversions API) triggers Art. 35 GDPR criteria due to large scale processing, profiling and cross border transfers. The DPIA should cover the joint controllership, transfers, retention and the recent DPC enforcement context.

How do I deploy Meta Business Suite widgets compliantly?

Sign Meta's Page Insights Controller Addendum and Custom Audiences Addendum, load widgets only after explicit consent, use the Conversions API with consent signalling, document Meta as a joint controller for the relevant features, run a TIA referencing the EU US Data Privacy Framework, and provide an easy way to opt out.

What are GDPR friendly alternatives to Meta widgets?

Alternatives include EU operated messaging widgets such as Userlike (Germany), LiveChat (Poland), Crisp (France), self hosted Chatwoot or Rocket.Chat, and contextual social sharing buttons that do not load Meta scripts (e.g. Shariff library). For ads measurement, prefer server side tagging tied to first party data and aggregated reporting.

How should I update my cookie and privacy policy for Meta Business Suite?

Declare Meta Platforms Ireland as a joint controller for the relevant widgets, name the cookies set on facebook.com and instagram.com with their duration, describe the data shared via Customer Chat, Pixel and Conversions API, mention US transfers under SCCs and the EU US Data Privacy Framework, link Meta's privacy notice and the Page Insights and Custom Audiences addenda.

Same category

More services: Advertising

See the whole category

Vizury

Vizury is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Vizury provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Vizury helps deliver the right message to the right audience at the right time.

Marketing

Socioh

Socioh is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Socioh supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Socioh enables informed decisions that improve experience and drive results.

Marketing

Teads

Teads is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Teads provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Teads helps deliver the right message to the right audience at the right time.

Marketing

Tagtoo

Tagtoo is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Tagtoo enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Tagtoo empowers marketing teams to achieve measurable growth.

Marketing

Squadded

Squadded is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Squadded integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Squadded helps organizations maintain robust websites that meet user expectations and technical requirements.

Marketing

Clinch

Clinch is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Clinch provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Clinch helps deliver the right message to the right audience at the right time.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site