Using the Meta Pixel (Facebook) in a GDPR-compliant way

The Meta Pixel (connect.facebook.net) tracks visitor behaviour for ad targeting and conversion measurement and transmits data to Meta in the USA.

Is this a risk?

For marketing tracking, § 25 (1) TDDDG applies: access to the device only with prior consent. The CJEU stresses the joint controllership of site operator and Meta for the collection. Without consent and without a joint-controllership agreement (Art. 26 GDPR) there is no basis.

What you can do

• Load the pixel exclusively after active consent.
• Conclude the joint-controllership agreement with Meta and disclose its essential content.
• In the privacy policy, describe the purpose, Meta as recipient, the US transfer and how to withdraw.
• Run the Conversions API only server-side with the same consent signals.

How consentglass helps

The free scan checks the delivered HTML and shows which services are embedded, whether a cookie banner is detected and whether privacy-policy and legal-notice links are present — with context for each finding. It is not a substitute for legal advice.