Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Pinterest Ads uses the Pinterest Tag, a conversion pixel that sets cookies to measure conversions and build audiences for retargeting. It tracks actions such as page views, add to cart, and purchases, then matches them to Pinterest accounts for ad targeting. Data is processed by Pinterest, Inc. in the United States. As a marketing technology it requires prior, opt in consent under the GDPR and the ePrivacy Directive.
Pinterest Ads is the advertising platform of Pinterest, and on your website it is implemented through the Pinterest Tag, a JavaScript conversion pixel. The tag records visitor actions such as page views, searches, sign ups, add to cart events, and purchases. These events are sent to Pinterest so advertisers can measure campaign performance, optimise bidding, and build audiences. The data also powers retargeting, where visitors who interacted with your site are shown related ads on Pinterest.
The Pinterest Tag sets cookies such as _pinterest_ct_ua and _pinterest_ct for user matching, _pin_unauth which groups actions for unauthenticated users, _epik which stores a click identifier, and _routing_id for the session. Alongside these cookies Pinterest processes IP addresses, browser and device information, the pages and events triggered, and, where available, hashed identifiers used to match visitors to Pinterest accounts. The combination supports conversion measurement and the building of targeting audiences.
Because the cookies are written to and read from the visitor terminal for advertising rather than strictly necessary purposes, Article 5(3) of the ePrivacy Directive requires prior consent. The matching of behaviour to Pinterest accounts and the building of audiences make this personal data under the GDPR, and the profiling involved raises the sensitivity of the processing. A lawful basis, transparency, and a record of processing activities are therefore required.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
As an advertising and retargeting technology, the Pinterest Tag must not load before the visitor has actively accepted the marketing or advertising category in your consent banner. Legitimate interest is not available as a basis for this processing because consent is required both to place the cookies and for behavioural advertising. Pre ticked boxes, implied consent, and cookie walls do not meet the standard. Even the server side Conversions API still relies on user data and requires the same consent.
Pinterest processes data in the United States, so you must document the transfer under the EU US Data Privacy Framework and the Standard Contractual Clauses and accept the Pinterest advertising and data processing terms. In practice, gate the Pinterest Tag behind your consent management platform so it fires only after marketing consent, list each cookie and its duration in your cookie policy, and configure consent signals for both the browser tag and the Conversions API. Review the audiences you build and keep retention to what the campaign needs.
Websites using Pinterest Ads must obtain user consent under GDPR regulations.
DPIA considerations
Pinterest Ads builds advertising audiences and matches website behaviour to Pinterest accounts for retargeting, sets persistent matching cookies such as _pinterest_ct and _epik for around one year, and transfers data to the United States. A DPIA is strongly advised because the processing involves systematic behavioural profiling for advertising on a large scale. It should assess the audiences created, the matching to identifiable accounts, the international transfer, and retention, with mitigations such as strict consent gating, limiting events sent, and short audience retention.
Sample consent text
We use Pinterest Ads to measure the performance of our advertising and to show you relevant ads on Pinterest. The Pinterest Tag places cookies on your device to record actions such as purchases and to match them with your Pinterest account for targeting. These cookies load only after you accept the marketing category, and the data may be processed in the United States. You can withdraw your consent at any time through our cookie settings.
Third-party domains contacted
ct.pinterest.coms.pinimg.comlog.pinterest.comads.pinterest.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _pinterest_ct_ua | marketing | 1 year | Used by Pinterest to match website visitors with Pinterest accounts and to attribute conversions for advertising measurement and audience building. |
| _pinterest_ct | marketing | 1 year | Stores user matching information used by the Pinterest Tag to associate actions on the site with a Pinterest user for conversion tracking and retargeting. |
| _pin_unauth | marketing | 1 year | Groups actions performed by users who are not signed in to Pinterest so that their behaviour can be measured and used for advertising. |
| _epik | marketing | 1 year | Stores a click identifier (the Enhanced Match identifier) used to attribute conversions to Pinterest ad clicks and to support enhanced matching. |
| _routing_id | marketing | Session | A short lived routing cookie used by Pinterest infrastructure to direct requests during the visitor session. |
Pinterest Ads places tracking cookies for advertising — comply with GDPR using FlowConsent.
The Pinterest Tag sets cookies such as _pinterest_ct_ua and _pinterest_ct for user matching, _pin_unauth which groups actions for unauthenticated users, and _epik which stores a click identifier, each lasting about one year, plus _routing_id for the session. Together they support conversion measurement and the building of advertising audiences.
Yes. The Pinterest Tag is an advertising technology, so under Article 5(3) of the ePrivacy Directive and the GDPR you must obtain prior, opt in consent before it loads. The tag must stay blocked until the visitor accepts the marketing category in your consent banner.
The lawful basis is consent under Article 6(1)(a) of the GDPR and Article 5(3) of the ePrivacy Directive. Legitimate interest is not available because the processing is for behavioural advertising and retargeting, where consent is required both to place the cookies and to profile visitors.
Yes. Pinterest, Inc. processes the data on infrastructure in the United States. Transfers are covered by the EU US Data Privacy Framework and Standard Contractual Clauses, which you should reference in your privacy notice alongside the categories of data shared.
A DPIA is strongly advised. Pinterest Ads carries out systematic behavioural profiling for advertising, often on a large scale, and transfers data internationally, which are factors that point towards high risk. Document the audiences, the matching to identifiable accounts, the transfer, and retention, with mitigations such as strict consent gating.
Load the Pinterest Tag only after the visitor accepts the marketing category in your consent management platform, and pass consent signals to both the browser tag and the Conversions API. Accept the Pinterest data processing terms, list the cookies in your cookie policy, limit the events you send, and keep audience retention short.
For measurement without advertising profiles you can rely on privacy focused analytics such as Matomo or Plausible, but these do not reach Pinterest audiences. For advertising itself, contextual targeting that does not rely on cross site tracking, or aggregated conversion reporting, reduces the privacy footprint while keeping campaigns measurable.
List each Pinterest cookie, its purpose, and its duration, name Pinterest, Inc. as a recipient, classify the cookies as marketing, and disclose the transfer to the United States. Keep the entries in sync with a regular cookie scan so that new or renamed Pinterest cookies are reflected accurately.