Contents
Meta Pixel and GDPR: when the Facebook Pixel is illegal in the EU
The Meta Pixel (formerly Facebook Pixel) is one of the most widely used tracking tools on the web — and one of the most frequently challenged under the GDPR. European courts and data protection authorities have repeatedly found that firing the pixel without valid, prior consent is unlawful. If your site loads the pixel on page view and only asks afterwards, you have the exact setup that regulators keep penalising.
Why the pixel is a GDPR problem at all
The pixel sends data to Meta every time it fires: the page URL, an identifier hashed from your email if you use advanced matching, device and browser characteristics, and increasingly event-level detail for conversion optimisation. Two GDPR articles bite:
- Art. 6 (lawful basis). Tracking for advertising is not "legitimate interest" in the EU after the Planet49 CJEU ruling and Meta's own enforcement history. It requires consent.
- ePrivacy Directive Art. 5(3). The pixel sets or reads cookies on the visitor's device. Consent is needed before storage or access — not after.
There is also a cross-border dimension: pixel data goes to US-based Meta platforms. After the Schrems II decision, several EU authorities concluded this transfer lacked a valid legal basis for standard pixel setups — the core of the Danish and Norwegian DPA decisions against websites using the pixel.
What regulators have actually done
| Action | Where / who | Outcome |
|---|---|---|
| Danish DPA order (2021–2022) | Businesses using Meta Pixel without consent | Pixel use declared unlawful without prior consent; referred to police for possible fines |
| Norwegian DPA vs. Tolteq/Grindr-type cases | Ad-tech tracking without consent | Interim bans and multi-million NOK fines, later upheld by EDPB |
| CNIL enforcement line (2022+) | French sites with trackers pre-consent | Banner "reject must be as easy as accept"; fines up to €150M for large platforms |
| German Abmahnung wave | E-commerce shops with non-compliant pixels/banners | Cease-and-desist letters costing €1,500–€10,000 each |
The four setups — which one is yours?
- No consent banner + pixel. Clearly unlawful in the EU. Highest risk profile.
- Banner exists, but pixel loads on page load anyway. The most common failure. The banner is decoration — the tracking already happened.
- Consent Mode v2 default-deny + pixel gated. Compliant baseline since March 2024. Pixels fire only after "granted".
- Gated + Consent Mode v2 + IAB TCF where relevant. Required if you run programmatic ads or Google/Meta integrations at scale.
How to tell in 60 seconds which setup you have
- Open your homepage in an incognito window with dev tools → Network tab.
- Filter for
connect.facebook.netandfacebook.com/tr. - If those requests fire before you click anything on the banner, the pixel runs pre-consent — setup 1 or 2.
How to fix it properly
- Gate the pixel behind consent. Load
fbevents.jsonly from your CMP's consent callback — never as a plain script tag in the header. - Add Google Consent Mode v2 with denied defaults (
ad_storage: 'denied',analytics_storage: 'denied') so tags stay dormant until consent. - Name Meta Platforms Ireland Ltd. as a recipient in your privacy policy, with transfer basis stated.
- Re-test after every theme, plugin or tag-manager change. This is where compliant setups silently break — someone re-adds the raw pixel snippet and nobody notices for months.
Check items 1–3 automatically
Our free scanner checks any URL — WordPress, Shopify, Webflow, Next.js, Squarespace or plain HTML — for the Meta Pixel, consent-platform presence, Consent Mode v2 signals, and whether trackers load without a consent mechanism:
Running a clean scan? The current EUComply Pro ($79/year per website) license provides WordPress document tools and an HTML report from the latest scan. Hosted daily monitoring is not included today.