Meta pixel consent means the pixel only sends events to Meta when the visitor's choice allows it. In practice you pause the pixel until the visitor agrees, resume it on a yes, and keep it paused on a no. Meta gives you a switch for this, and a consent management platform is what flips it at the right moment.

The rules differ by market. In Europe the pixel needs a yes first. In California and some other US states the issue is opt-out: sending data to Meta for advertising counts as sharing, so visitors must be able to stop it. This guide covers both, with the code and a test you can run today.

The pixel is a script that sends information about what visitors do on your site to Meta, so you can measure and target ads. That makes it a third-party tracker, which is the kind of tool consent rules were written for. If it loads before the visitor decides, the consent exists in the banner and not in the network traffic.

Meta's Business Tools Terms say that, where consent is required to store or access cookies or other information on a user's device, as in the European Union, you must ensure in a verifiable way that the visitor gives all necessary consents before you use Meta Business Tools. The terms are in Meta's Business Tools Terms.

European case law points the same way. In Fashion ID (C-40/17, decided on 29 July 2019) the Court of Justice found that a website operator that embeds a social plugin, which makes the visitor's browser send data to the provider, can be a controller for the collection and transmission it decides on.

Consent and the duty to inform fall on the operator for those steps. The ruling applied the old Data Protection Directive, not the GDPR, but the logic is still useful: embedding a third-party tool is your choice, so the consent question is yours. The judgment is on EUR-Lex. Our guide to GDPR and cookies covers the broader rules.

California describes "sharing" as sharing personal information for cross-context behavioral advertising, and gives people the right to opt out of it. Businesses must offer a clearly visible link, usually titled "Do Not Sell or Share My Personal Information", as the California Attorney General's CCPA page explains.

A pixel that sends events to Meta for ad targeting is a typical example. A browser signal such as GPC counts as a valid opt-out request there, which we cover in our guide to Global Privacy Control. See also our guide to California's CCPA.

See how AdOpt blocks tags until consent if you run pixels in more than one market.

Meta's pixel has a consent switch built in. According to Meta's documentation on the pixel and GDPR, you use fbq('consent', 'revoke') to pause pixel fires and fbq('consent', 'grant') to send them once the visitor agrees.

Meta's example revokes consent before the pixel is initialized, so nothing fires until the visitor decides:

fbq('consent', 'revoke');   // before init
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');

// After the visitor accepts in the banner:
fbq('consent', 'grant');

Your CMP normally makes the grant call for you after the visitor accepts. If a visitor rejects or closes the banner, the pixel stays revoked.

Many sites load the pixel through Google Tag Manager. That works well when the tag is set to fire only with the right consent, so it is held back until the visitor agrees. Check every Meta tag in the container, since one forgotten tag is enough to send data. Our guide to tag categorization explains how to sort tags by purpose.

A pixel pasted straight into a theme or loaded by a plugin ignores your CMP. It is the most common reason a "no" in the banner does not stop Meta requests. Move it into the tag manager, or let your CMP block it, and test again.

For US state laws, Meta offers an option called Limited Data Use (LDU). In the pixel it looks like this:

fbq('dataProcessingOptions', ['LDU'], 1, 1000);

The first number is the country: 0 lets Meta work it out from the visitor's location and 1 means the United States. The second is the state: 0 for the same automatic detection, or a code such as 1000 for California and 1001 for Colorado. The same options exist for the Conversions API. The details are in Meta's data processing options page.

Meta describes LDU as giving you more control over how your data is used in its systems, and warns it can reduce campaign performance and limit retargeting and measurement. LDU is a tool for Meta's side. Your opt-out link and the handling of browser signals remain your job.

If you also send events from your server through the Conversions API, treat them the same way as pixel events. Meta's pixel documentation on consent does not cover the Conversions API, so a safe approach is to send server events only for visitors whose choice allows it. Otherwise the pixel could respect a "no" while the server keeps sending the same events.

When a visitor says no, the pixel sends nothing, so those visits do not appear in Meta's reporting. That is the point. Expect fewer tracked events, especially in markets where many people decline, and plan your reporting around the visitors who agreed.

The temptation is to win the numbers back by loading the pixel anyway, or by moving the same events to the server without checking the choice. Both undo the protection you set up, and both are easy to spot in a network test. If Meta's reporting looks thin, review your banner design and your campaign setup first. Our guide to choosing a cookie banner covers how the design affects the choice people make.

The same questions apply to Meta and to any other ad tool:

• Who owns this tag, and who approved it?
• Which consent type or category does it belong to?
• Does it load through the tag manager, where the CMP can control it?
• Does it have a server-side twin that needs the same rule?
• How will we test it, and how often?

Answering these before the tag goes live is cheaper than finding out from a complaint.

You can test without special tools. Follow these steps:

1. Open your site in a private window.
2. Reject everything in the banner.
3. Open the developer tools and check the network tab for requests to Meta, such as facebook.com or facebook.net.
4. After a rejection there should be no events sent to Meta.
5. Repeat after accepting. Events should start only from that moment.
6. For US visitors, switch on GPC and check that ad events stop where required.
7. Save a screenshot and the date as evidence.

If requests still go out after a rejection, look first for a pixel pasted in the code or a second tag in the tag manager. Check how consent reaches your pixel with AdOpt as a fast way to see it in action.

• Google Analytics 4 cookie consent
• How a cookie banner works

In jurisdictions that require consent to store or access information on a visitor's device, such as the European Union, Meta's terms say you must ensure consent is given before using its tools. In California, sending data to Meta for ad targeting counts as sharing, so visitors need an easy way to opt out. Check the rules for your audience.

It pauses the pixel, so no events are sent to Meta. Calling fbq('consent', 'grant') resumes sending. Meta's example revokes consent before the pixel is initialized, so nothing fires until the visitor decides. Your CMP can make these calls for you, based on the choice made in the banner.

It is a Meta option for US visitors that you switch on with dataProcessingOptions in the pixel or the equivalent fields in the Conversions API. You tell Meta the country and state. Meta warns it can reduce campaign performance. It does not replace your opt-out link or the handling of browser signals.

Yes, and it is often the cleanest way. Set the Meta tag to fire only when the visitor's choice allows it, and make sure no second copy of the pixel is pasted into the site code. Test with a rejection and check that no requests reach Meta.