Using the Meta Pixel (Facebook) in a GDPR-compliant way

The Meta Pixel (connect.facebook.net) tracks visitor behaviour for ad targeting and conversion measurement and transmits data to Meta in the USA.

The Meta Pixel is a pure marketing tool — there is no variant that would be permitted without consent. Unlike with analytics tools, anonymisation does not help here: the purpose is recognising individual people across websites, and that is exactly what requires prior, active agreement under § 25 (1) TDDDG.

In the Fashion ID decision (C-40/17) the CJEU made clear that site operators and Meta are jointly responsible for the collection and transmission of the data. In practice that means: you need not only the consent but also the joint-controllership agreement (controller addendum) provided by Meta, and you must disclose its core content in the privacy policy.

The Conversions API (server-side tracking) does not change the legal position. Events transmitted server-side need the same consent as the client-side pixel — running the API without a consent check merely moves the problem to the server.

Is this a risk?

For marketing tracking, § 25 (1) TDDDG applies: access to the device only with prior consent. The CJEU stresses the joint controllership of site operator and Meta for the collection. Without consent and without a joint-controllership agreement (Art. 26 GDPR) there is no basis.

What you can do

• Load the pixel exclusively after active consent.
• Conclude the joint-controllership agreement with Meta and disclose its essential content.
• In the privacy policy, describe the purpose, Meta as recipient, the US transfer and how to withdraw.
• Run the Conversions API only server-side with the same consent signals.

Häufige Fragen

May the Meta Pixel load without consent in “limited data use” mode?

No. Limited Data Use reduces what Meta may do with the data but does nothing about the fact that loading the pixel accesses the device. That still requires consent under § 25 (1) TDDDG.

Is a note in the privacy policy enough instead of consent?

No. An information text meets the transparency obligation but does not replace the active consent needed for accessing the device and the subsequent processing.

What is the joint-controllership agreement?

Meta provides a “controller addendum” that governs the roles of you and Meta in data collection. It applies automatically when the pixel is used; you must make the essential content available to affected persons, usually in the privacy policy.

How do I test whether the pixel fires too early?

Open the developer tools in a private window, filter the “Network” tab for “facebook” and load the page without confirming the banner. Requests to connect.facebook.net or facebook.com/tr show that the pixel loads before consent.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.