Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Advanced Matching extends the Meta (Facebook) Pixel by attaching hashed customer details such as email and phone number to each tracked event, raising match rates for attribution and audiences but also raising the privacy stakes under the GDPR.
The Meta Pixel, still widely known as the Facebook Pixel, is a JavaScript snippet that records visitor actions such as page views, add to cart events and purchases. Advanced Matching is an optional layer that attaches customer information you already hold, for example an email address or phone number, to each event. Meta hashes these values and matches them against its own user base so that conversions are attributed more accurately and custom audiences become larger and more precise.
The pixel writes a first party cookie named _fbp and reads the third party fr cookie set on facebook.com, and it captures the _fbc click identifier when a visitor arrives from a Meta ad. Advanced Matching adds hashed parameters derived from fields such as email, phone, first name, last name, city, postal code and country. Although the values are hashed with SHA 256 before leaving the browser, they remain personal data because Meta can match them back to identified accounts.
Storing and reading the pixel cookies requires consent under Article 5(3) of the ePrivacy Directive, and the subsequent processing and sharing of hashed identifiers requires a legal basis under the GDPR. Because Advanced Matching shares direct identifiers with a large advertising platform, supervisory authorities treat it as high risk profiling. Meta acts as a controller for much of this data, so a controller to controller relationship and clear transparency are essential.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain prior, informed and freely given consent before the pixel loads and before any hashed data is collected. The pixel script should be blocked until the visitor accepts marketing cookies, and Advanced Matching should never be enabled by default. Consent Mode signals can be passed to Meta so that no identifiers are transmitted when a visitor declines, and every consent decision should be logged with a timestamp.
Event and matching data flow to Meta infrastructure in the United States. These transfers rely on the EU US Data Privacy Framework, under which Meta is certified, supported by standard contractual clauses for any processing that falls outside the framework. Document the transfer mechanism in your records of processing, and inform visitors that their data, including hashed identifiers, may be processed outside the European Economic Area.
Load the pixel through a consent management platform that blocks it until marketing consent is granted, and gate Advanced Matching behind the same signal. Limit the fields you share to what is necessary, sign the Meta controller addendum, complete a DPIA, and describe the pixel, the hashed data and the US transfer in your cookie policy and privacy notice. Review configurations regularly so that no new automatic matching is silently enabled.
Websites using Facebook Pixel Advanced Matching must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is strongly recommended. Advanced Matching combines behavioural tracking with hashed direct identifiers, enabling cross site profiling and matching against Meta accounts at scale. Assess the risk of re identification, the lawfulness of US transfers, the proportionality of sharing customer contact details, and whether any field could expose special category data.
Sample consent text
We use the Meta Pixel with Advanced Matching to measure advertising performance and reach relevant audiences. This sends hashed details such as your email address to Meta, including in the United States. These cookies and transfers only happen with your consent.
Third-party domains contacted
connect.facebook.netwww.facebook.comgraph.facebook.comfacebook.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _fbp | Marketing | 90 days | First party cookie that stores a unique browser identifier so Meta can attribute conversions and build custom audiences from pixel events. |
| fr | Marketing | 90 days | Third party cookie set on facebook.com that delivers and measures advertising and links pixel activity to a Meta account. |
| _fbc | Marketing | 90 days | First party cookie that stores the click identifier from a Meta ad so the resulting conversion can be matched to the campaign. |
Facebook Pixel Advanced Matching collects user analytics data — you legally need a consent banner. Try FlowConsent free.
The pixel sets the first party _fbp cookie, reads the third party fr cookie on facebook.com and stores the _fbc click identifier when a visitor arrives from a Meta ad. These typically last up to 90 days. Advanced Matching itself adds hashed parameters to events rather than new cookies.
Yes. Storing or reading the pixel cookies requires prior consent under the ePrivacy Directive, and sharing hashed identifiers needs a GDPR legal basis. The pixel and Advanced Matching must stay disabled until the visitor accepts marketing cookies.
The only realistic basis is consent under Article 6(1)(a) GDPR. Legitimate interest does not apply because the processing involves cross site advertising profiling. Where a field could reveal special category data, explicit consent under Article 9 is required.
Yes. Event and hashed matching data are sent to Meta in the United States. The transfer relies on the EU US Data Privacy Framework plus standard contractual clauses, and it must be disclosed in your privacy notice and records of processing.
A DPIA is strongly recommended and often mandatory. Advanced Matching combines behavioural tracking with hashed direct identifiers at scale, which meets several criteria for high risk processing under the GDPR.
Load the pixel through a consent management platform that blocks it until marketing consent is granted, pass Consent Mode signals to Meta, limit shared fields to what is necessary and sign the Meta controller addendum. Log every consent decision with a timestamp.
Server side tagging through the Conversions API gives you more control over which fields leave your systems, and privacy first analytics tools avoid advertising identifiers entirely. Neither removes the need for consent when used for marketing.
List the _fbp, fr and _fbc cookies with their purpose and duration, state that Advanced Matching shares hashed contact details with Meta, and disclose the US transfer. Keep the entry in sync with your consent banner categories.