The Meta pixel and UK GDPR: consent before you track

Key takeaways

The Meta pixel places or reads identifiers on a visitor's device for advertising, so under PECR it needs the visitor's consent before it fires. Set your cookie banner to block the pixel until someone accepts marketing cookies, make rejecting as easy as accepting, and explain it in your privacy notice. The ICO has made cookie compliance an active priority.

• Advertising pixels need opt-in consent under PECR.
• The pixel must not fire before the visitor accepts.
• Reject must be as easy as accept on the banner.
• The 2025 changes eased some analytics cookies, not advertising ones.

What is the Meta pixel?

The Meta pixel is a piece of code on a website that records visitors' actions, such as page views, leads and purchases, and sends them to Meta so the business can measure adverts, build retargeting audiences and optimise campaigns. It uses cookies and similar technologies to identify browsers.

• How UK businesses can turn social media followers into customers
• Social media retargeting: win back followers who nearly bought

Why does the pixel need consent?

Under the Privacy and Electronic Communications Regulations (PECR), storing or accessing information on a user's device needs consent unless it is strictly necessary for a service they asked for. Advertising and retargeting are not strictly necessary. The data the pixel sends is also personal data under UK GDPR. This is general information, not legal advice.

• Cookie banners and UK law
• Meta Conversions API: keep ad tracking accurate

What changed with the Data (Use and Access) Act 2025?

The Data (Use and Access) Act 2025 created exemptions from cookie consent for some low-risk purposes, such as certain analytics to improve a website, provided users are told and can object. Advertising and retargeting cookies, including the Meta pixel, are not covered and still need consent. Check the ICO's current guidance as provisions come into force.

How should your cookie banner handle the pixel?

Your banner should block the pixel until the visitor actively accepts marketing or advertising cookies, offer reject as clearly as accept on the first layer, and remember the choice. Test it: load the site in a private window, do nothing, and check with browser tools or Meta's Pixel Helper that no Meta request fires.

What should your privacy notice say?

Your privacy notice should say that you use the Meta pixel, what it collects, why (advertising measurement and audiences), that Meta receives the data, and how people can withdraw consent. The ICO's guidance on the right to be informed sets out what to include.

• GDPR and social media marketing in the UK

How do you retarget without the pixel?

You can retarget without the pixel using audiences built inside Meta: people who engaged with your Instagram or Facebook account, watched your videos or opened a lead form. For many small businesses these warm audiences are enough, and they do not depend on visitors to your website accepting cookies.

• Cold, warm and hot audiences on social media explained

What are the risks of getting it wrong?

The risks are regulatory and practical. The ICO has written to many websites about non-compliant cookie banners and can fine for PECR breaches. Practically, data collected without valid consent should not be used, so audiences built from it are a liability rather than an asset.

What does this look like in practice?

A pattern we see: a pixel added by a former agency directly in the site header, firing before the cookie banner appears. Moving it behind the consent tool and switching retargeting to engagement audiences keeps most of the value without the risk.

• See client work
• Social Media Marketing for UK businesses
• The follower conversion scorecard: find where buyers drop out

Pixel compliance checklist

• Find where the pixel is installed.
• Load it only after marketing consent.
• Give reject equal weight on the banner.
• Test in a private window that it does not fire.
• Describe it in your privacy notice.
• Use engagement audiences where you can.

Next step

Open your site in a private window, do not touch the banner, and check whether Meta requests appear. If they do, fix that first.