Meta Pixel cookie consent

No yes,
no PageView.

To make the Meta Pixel wait for cookie consent, keep its code from running until the visitor allows marketing cookies. Either block the whole snippet until your banner gets a yes, or, as Meta’s own GDPR page shows, call fbq(‘consent’, ‘revoke’) before fbq(‘init’) on every page and fbq(‘consent’, ‘grant’) once they agree. In the EU and the UK, a pixel that reports a PageView or sets its cookie before that yes is exactly what the cookie rules are about. The same goes for the TikTok, LinkedIn, Pinterest, Snap, X and Reddit pixels, and for Microsoft’s UET tag, which has had to send Microsoft a consent signal for visitors in the EEA, the UK and Switzerland since 5 May 2025. Below: who asks for consent and how, Meta’s two methods side by side, a checker that finds pixels firing too early in your page source and writes the gated version, and the same for TikTok and Microsoft.

Check my pixels Revoke vs block
Meta: revoke before init UET consent: required since 5 May 2025 Checked 17 Oct 2026

By the Builderify team

Illustration · One visit: the pixels wait for the yes, then load.
01 / Who says so

Does the Meta Pixel need cookie consent?
In the EU and the UK, yes.

Article 5(3) of the EU’s ePrivacy Directive asks for consent before anything is stored on, or read from, a visitor’s device, unless it is strictly necessary for what they asked for. An ad pixel never is. Meta, TikTok and Microsoft each put the job of asking on you, the site owner.

Businesses may want to implement code that creates a banner and requires affirmative consent
Meta Meta Pixel GDPR page
We require advertisers to provide notices and obtain consents, as required by applicable laws.
TikTok Ads Help, April 2025
In the European Economic Area and United Kingdom … you must obtain consent … before activating the UET tag on your properties
Microsoft Advertising consent FAQ
Online advertising purposes are not exempt from PECR's consent requirements and never have been.
ICO UK storage and access guidance
The ePrivacy consent rule is not only about cookies: the guidelines apply it to URL and pixel tracking by name.
EDPB Guidelines 2/2023, adopted 7 October 2024, in our words
The UK, after the 2025 Act

The Data (Use and Access) Act 2025 added an exception for some analytics, but the ICO says plainly that it “does not apply to purposes related to online advertising”, ad measurement included. Social media tracking needs consent too, the ICO adds, “whether or not your users are members of the social network in question”.

The US works the other way

Most US state privacy laws let tracking run until the visitor opts out of the “sale” or “sharing” of their data, and California is among those that expect you to honour a browser’s opt-out signal. The Global Privacy Control guide covers that side; this one is about asking first.

This is how the rules read to us, with links to the sources below. It isn’t legal advice; for your own site, ask whoever advises you. Google’s tags have their own system, covered in the Consent Mode v2 guide.

02 / Meta’s consent API

Facebook Pixel GDPR setup:
block it, or revoke before init.

Meta’s page offers one API with two calls: fbq('consent', 'revoke') to “pause sending Pixel fires to Facebook” and fbq('consent', 'grant') to send them once consent is given. The other way is older and simpler: the snippet doesn’t run at all until the visitor agrees.

A. Block the whole snippet

Nothing reaches Meta

The browser skips a script whose type isn’t JavaScript. Your consent tool swaps it for a real one after a yes. Until then fbevents.js isn’t downloaded, so not even the request for it, with the visitor’s IP address, reaches Meta.

<script type="text/plain" data-bdf-consent="marketing">
  !function(f,b,e,v,n,t,s){…}(window, document, 'script',
    'https://connect.facebook.net/en_US/fbevents.js');
  fbq('init', 'YOUR_PIXEL_ID');
  fbq('track', 'PageView');
</script>
  • Works for every pixel, not just Meta’s
  • A returning visitor who agreed is released on every page by the tool
  • Event code elsewhere has to wait too, or it throws “fbq is not defined”

B. Revoke before init, grant after

Meta’s method

The snippet runs on every page with consent revoked, and your banner calls grant after a yes. The library still loads from connect.facebook.net; Meta’s page says sending is paused, and doesn’t say what happens to the events in the meantime.

// Revoke consent before 'init' is called
fbq('consent', 'revoke');
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');

// Once affirmative consent has been granted
fbq('consent', 'grant');
  • Event code can stay where it is
  • Revoke on every page, and grant on every page for a visitor who already said yes
  • Meta only: TikTok, LinkedIn and the rest need their own handling

Code in B is Meta’s own example, comments included. When it does run, the pixel saves a first-party _fbp cookie on your domain if there isn’t one yet, Meta’s Conversions API page explains.

Five ways a “consented” pixel still fires too early

The checker below catches the first four in your page source. The fifth happens on a server, out of its sight.

On WordPress

Meta’s own plugin and PixelYourSite each have 400,000+ active installations. A plugin prints the pixel itself, so you can’t add an attribute to its output: use the plugin’s own consent settings, or switch it off and connect the pixel ID to your consent tool instead. PixelYourSite’s listing says it “works with the most popular consent management plugins out of the box”; Meta’s listing doesn’t mention consent.

  1. 01

    Revoke after init

    Meta’s example puts fbq('consent', 'revoke') before fbq('init'). Called after it, the PageView has already gone.

  2. 02

    Revoke on the first page only

    Meta says: “You need to call revoke on every page.” The other half is your job too: a visitor who said yes last week needs grant on every page they open today.

  3. 03

    Events left outside the gate

    A fbq('track', 'Purchase') on your thank-you page runs on its own. If the base code is blocked and this isn’t, the browser stops with “fbq is not defined”. Gate event code the same way.

  4. 04

    The noscript image

    The <noscript><img> in Meta’s snippet reports a PageView for browsers without JavaScript, where no banner can run to ask. Remove it.

  5. 05

    Server-side events

    The Conversions API sends events from your server or shop platform to Meta. A cookie banner in the browser never sees them, so check how that integration handles consent.

03 / Pixel-before-consent checker

Which of your pixels
fire before the yes?

Paste a page’s source (in Chrome, View page source, then select all). The checker finds Meta, TikTok, LinkedIn, Microsoft UET, Pinterest, Snap, X and Reddit code, says which of it runs before consent, and writes a copy where all of it waits. It reads the text in your browser; nothing is sent anywhere.

Pixel code runs before the visitor answers, in 3 places.
3
Run before consent
4
Vendor switch
2
No-JS fallbacks
1
Already wait
Top to bottom Line
  1. M Meta Pixel Vendor switch 6

    Held by Meta's own switch: fbq('consent', 'revoke') runs before init. Events wait, but fbevents.js still loads from Meta, and your banner must call fbq('consent', 'grant') on every page after a yes.

  2. M Meta Pixel No-JS fallback 19

    A fallback image for browsers without JavaScript, where no banner can ask. The gated copy removes it.

  3. Tk TikTok Pixel Runs before consent 25

    Runs as the page loads, before the banner has asked anything.

  4. UET Microsoft UET Vendor switch 34

    Held by UET consent mode: the default is denied, Microsoft's advanced mode. Your banner must send the update on every page.

  5. UET Microsoft UET Vendor switch 35

    Held by UET consent mode: the default is denied, Microsoft's advanced mode. Your banner must send the update on every page.

  6. in LinkedIn Insight Tag Runs before consent 41

    Runs as the page loads, before the banner has asked anything.

  7. in LinkedIn Insight Tag Runs before consent 46

    Runs as the page loads, before the banner has asked anything.

  8. in LinkedIn Insight Tag No-JS fallback 47

    A fallback image for browsers without JavaScript, where no banner can ask. The gated copy removes it.

  9. P Pinterest Tag Waits 50

    Waits for Builderify's Marketing switch.

  10. M Meta Pixel Vendor switch 58

    Held by Meta's own switch: fbq('consent', 'revoke') runs before init. Events wait, but fbevents.js still loads from Meta, and your banner must call fbq('consent', 'grant') on every page after a yes.

The gated version 
<head>
  <meta charset="utf-8">
  <title>Hartley &amp; Rowe Coffee</title>

  <!-- Meta Pixel Code -->
  <script type="text/plain" data-bdf-consent="marketing">
  !function(f,b,e,v,n,t,s)
  {if(f.fbq)return;n=f.fbq=function(){n.callMethod?
  n.callMethod.apply(n,arguments):n.queue.push(arguments)};
  if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';
  n.queue=[];t=b.createElement(e);t.async=!0;
  t.src=v;s=b.getElementsByTagName(e)[0];
  s.parentNode.insertBefore(t,s)}(window, document,'script',
  'https://connect.facebook.net/en_US/fbevents.js');
  fbq('consent', 'grant');
  fbq('init', '1234567890123456');
  fbq('track', 'PageView');
  </script>
  <!-- Meta Pixel fallback removed: it fires without JavaScript, where no banner can ask -->
  <!-- End Meta Pixel Code -->

  <!-- TikTok Pixel Code -->
  <script type="text/plain" data-bdf-consent="marketing">
  !function (w, d, t) {
    w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=["page","track","identify","instances","debug","on","off","once","ready","alias","group","enableCookie","disableCookie","holdConsent","revokeConsent","grantConsent"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<ttq.methods.length;n++)ttq.setAndDefer(e,ttq.methods[n]);return e},ttq.load=function(e,n){var r="https://analytics.tiktok.com/i18n/pixel/events.js",o=n&&n.partner;ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=r,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};n=document.createElement("script");n.type="text/javascript",n.async=!0,n.src=r+"?sdkid="+e+"&lib="+t;e=document.getElementsByTagName("script")[0];e.parentNode.insertBefore(n,e)};
    ttq.load('C4ABCDEFGHIJ1234KLMN');
    ttq.page();
  }(window, document, 'ttq');
  </script>

  <!-- Microsoft Advertising UET -->
  <script type="text/plain" data-bdf-consent="marketing">(function(w,d,t,r,u){var f,n,i;w[u]=w[u]||[],f=function(){var o={ti:"187654321", enableAutoSpaTracking: true};o.q=w[u],w[u]=new UET(o),w[u].push("pageLoad")},n=d.createElement(t),n.src=r,n.async=1,n.onload=n.onreadystatechange=function(){var s=this.readyState;s&&s!=="loaded"&&s!=="complete"||(f(),n.onload=n.onreadystatechange=null)},i=d.getElementsByTagName(t)[0],i.parentNode.insertBefore(n,i)})(window,document,"script","//bat.bing.com/bat.js","uetq");</script>
  <script type="text/plain" data-bdf-consent="marketing">
    window.uetq = window.uetq || [];
    window.uetq.push('consent', 'default', { 'ad_storage': 'granted' });
  </script>

  <!-- LinkedIn Insight Tag -->
  <script type="text/plain" data-bdf-consent="marketing">
  _linkedin_partner_id = "1234567";
  window._linkedin_data_partner_ids = window._linkedin_data_partner_ids || [];
  window._linkedin_data_partner_ids.push(_linkedin_partner_id);
  </script>
  <script type="text/plain" data-bdf-consent="marketing" async src="https://snap.licdn.com/li.lms-analytics/insight.min.js"></script>
  <!-- LinkedIn Insight Tag fallback removed: it fires without JavaScript, where no banner can ask -->

  <!-- Pinterest Tag, already waiting for consent -->
  <script type="text/plain" data-bdf-consent="marketing">
  !function(e){if(!window.pintrk){window.pintrk=function(){window.pintrk.queue.push(Array.prototype.slice.call(arguments))};var n=window.pintrk;n.queue=[],n.version="3.0";var t=document.createElement("script");t.async=!0,t.src=e;var r=document.getElementsByTagName("script")[0];r.parentNode.insertBefore(t,r)}}("https://s.pinimg.com/ct/core.js");
  pintrk('load', '2612345678901');
  pintrk('page');
  </script>
</head>
<body>
  …
  <script type="text/plain" data-bdf-consent="marketing">
    fbq('track', 'Purchase', { value: 24.00, currency: 'GBP' });
  </script>
</body>
What changed
  • Pixel scripts get type="text/plain" data-bdf-consent="marketing"; their own type attribute goes.
  • Pixel <noscript> images are replaced by a comment.
  • Line 6: fbq('consent', 'revoke') became fbq('consent', 'grant'). Gated code only runs after a yes, and a revoke there would keep the pixel paused.
  • Line 35: The UET consent default became 'granted': this code now only runs after a yes.
  • Put your Builderify consent tag first in <head>, so the marked code is released the moment the visitor allows Marketing.
Or connect them by ID

Remove the base code and paste these in Builderify’s Cookie Consent, under Tracking tags. They send page views; events like Purchase stay as gated code.

  • MMeta Pixel1234567890123456
  • TkTikTok PixelC4ABCDEFGHIJ1234KLMN
  • UETMicrosoft UET187654321
  • inLinkedIn Insight Tag1234567
  • PPinterest Tag2612345678901

What it can’t see: code a plugin or Tag Manager adds after the page loads, Shopify app pixels (they run in Shopify’s own sandbox), and anything sent from a server. The data-bdf-consent attribute is Builderify’s; another consent tool will want its own markup, though the idea, a script the browser won’t run until it’s released, is the same.

04 / TikTok and others

TikTok pixel GDPR,
and six more pixels.

TikTok’s help centre tells advertisers to “ensure your website disables the setting and usage of cookies when a person declines consent”, and to “use a tag manager or consent management platform to control the firing of your pixel base code”. It lists the pixel’s cookies as _ttp, ttcsid_, ttclid and _pangle.

You can switch first-party cookies off in the pixel’s settings, but TikTok says the pixel still uses third-party cookies, so that alone isn’t consent. The base code carries grantConsent and revokeConsent methods, and TikTok names a “pixel consent mode”; we couldn’t find TikTok’s own page explaining them, so the cautious route is the same as for Meta: hold the base code until a yes.

LinkedIn, Pinterest, Snap, X and Reddit are simpler still from the site’s side: hold the code until a yes. On Shopify, pixels added by apps or as custom pixels run in Shopify’s sandbox, and Shopify says that in consent-required markets they “run only when visitors have provided the permissions required in the pixel configuration”.

Pixel Global Loads from Switch Builderify sends Connected by ID, sends
Meta Pixel fbq connect.facebook.net fbq('consent', 'grant' | 'revoke') consent grant, init, PageView
TikTok Pixel ttq analytics.tiktok.com ttq.grantConsent() | revokeConsent() ttq.page()
Microsoft UET uetq bat.bing.com UET consent mode, ad_storage pageLoad
LinkedIn Insight Tag lintrk snap.licdn.com None: hold the code The Insight Tag itself
Pinterest Tag pintrk s.pinimg.com None: hold the code pintrk('page')
Snap Pixel snaptr sc-static.net None: hold the code PAGE_VIEW
X Pixel twq static.ads-twitter.com None: hold the code twq('config')
Reddit Pixel rdt redditstatic.com None: hold the code PageVisit

The last two columns are Builderify’s, from its code: the consent call it passes to a pixel already on the page, and what it fires when it loads a pixel from its ID after a yes. “None” means Builderify sends that vendor no signal, not that the vendor has no setting of its own.

05 / Microsoft UET

Microsoft UET consent mode:
required since 5 May 2025.

Microsoft Advertising asks every advertiser using its Universal Event Tracking tag to send consent signals, through UET consent mode or the IAB’s TCF, and says “you should never use both simultaneously”. From 5 May 2025 it began “enforcing all clients with end-users in the EEA, UK, and Switzerland to send Consent Mode”.

If you don’t

Microsoft’s FAQ: “we will stop tracking your UET-based conversions and populating your remarketing lists.”

One signal counts

UET reads ad_storage, granted or denied. Microsoft says it only plans to enforce that one; ad_user_data and ad_personalization are optional.

What denied does

UET doesn’t read or write its first-party cookies, writes no third-party ones, and reads third-party cookies only for fraud and spam.

What it watches

MUID, _uetvid, _uetsid and the other UET cookies, set before anyone answered the banner, or after a Refuse.

Microsoft’s example, advanced mode
<!-- UET tag is added here -->
<script>
  window.uetq = window.uetq || [];
  window.uetq.push('consent', 'default', {
    'ad_storage': 'denied'
  });
</script>

<!-- Once the visitor chooses, on every page -->
<script>
  window.uetq = window.uetq || [];
  window.uetq.push('consent', 'update', {
    'ad_storage': 'granted'
  });
</script>
Basic or advanced

Basic blocks the tag until consent and sends nothing before it. Advanced loads the tag with denied, collecting only anonymised data until a yes. Microsoft recommends advanced; for basic it says to skip the default and fire the tag only after consent.

Check it

The UET Tag Helper shows an asc parameter on each event: denied before a yes, granted after. In the console, window.uetq.uetConfig.consent.adStorageAllowed answers true or false.

Leave the default out and UET treats most countries as granted; in the EEA, the UK and Switzerland, where Microsoft enforces consent mode, the default is denied. Clarity, if you’ve linked it to UET, needs its consent set separately.

06 / Check it works

How to check your pixel
waits for consent.

The page source tells you what’s on the page. The network tab tells you what actually left the browser, and when. Ten minutes, any browser with developer tools.

  1. 01

    Open a private window, then DevTools

    No stored choice, no leftover cookies. Open the Network tab before you load the page, and filter on /facebook|tiktok|bing|licdn|pinimg|sc-static|ads-twitter|redditstatic/ (Chrome reads a filter between slashes as a regular expression).

  2. 02

    Load the page and leave the banner alone

    Nothing should appear from those hosts. Under Application › Cookies there should be no _fbp (Meta’s first-party cookie), _ttp (TikTok’s) or _uetsid / _uetvid (Microsoft’s).

  3. 03

    Reject, then browse two more pages

    Still nothing. A pixel that appears on the second page is in a template your gate doesn’t cover, often the blog, the checkout or a thank-you page.

  4. 04

    Start again and accept

    Now facebook.com/tr requests with ev=PageView should appear, and the cookies with them. Meta’s and TikTok’s Pixel Helper extensions show the same from their side.

  5. 05

    Take it back

    Open the cookie settings and switch Marketing off. The pixel code that already ran can’t be unloaded, so the page has to reload before it stops; after that, nothing new should reach those hosts.

07 / With Builderify

A cookie banner
that holds the pixels.

Builderify’s cookie consent banner comes with a consent tag you put first in your <head>. The simplest route: delete a pixel’s code from your site and paste its ID into the banner’s Tracking tags instead. It then loads only for visitors who allow its category. Code you’d rather keep, like a Purchase event, waits behind the attribute the checker writes.

The consent tag, the decisions and the consent log cost no credits, and the banner keeps running when your credits run out; the rest of the widget pauses until you top up. Widget page loads are 10 credits per 1,000, from the 250 free credits every account gets each month, and packs start at $9, one-time.

Where the consent tag goes
WordPress
The Builderify plugin, Settings › Builderify, “Load the cookie consent tag first in <head>”
Shopify
Top of theme.liquid’s <head>; choices go to Shopify’s Customer Privacy API
Wix
Settings › Custom Code, in Head, all pages, dragged to the top
Squarespace
Code Injection › Header, first line; switch off Squarespace’s own banner
Webflow
Site settings › Custom code › Head code, above everything else

Measuring sales without a pixel? Tracking conversions by URL shows another way. Comparing banners: CookieYes’s free plan and Cookiebot’s free plan.

What it does

  • Paste an ID instead of the code: Meta, TikTok, LinkedIn, Microsoft UET, Pinterest, Snap, X and Reddit, plus GA4, Google Ads, Tag Manager, Clarity and Hotjar. Each loads only after its category is allowed, and you choose the category per tag
  • Code you keep waits with type="text/plain" data-bdf-consent="marketing", released in page order after a yes; iframes, images and videos wait with data-src
  • “Tell other vendors too”, on by default, passes each choice to Meta’s and TikTok’s consent switches, Microsoft Clarity, UET consent mode and Shopify’s Customer Privacy API
  • With Google Consent Mode on (the default), the consent tag also puts a UET consent default in the queue before bat.js reads it
  • A visitor who takes Marketing back after a pixel ran gets a page reload, so the code stops; cookies the banner knows belong to a refused category are cleared
  • Global Privacy Control turns Marketing off by default in opt-out regions, and every answer goes in a consent log you can export as CSV

Know this first

  • No Conversions API or Events API. Builderify only controls what runs in the browser; server-side events from your shop or a plugin never pass through the banner
  • A tag connected by ID sends the page view only. Purchases, leads and other events are still your code: gate it with the same attribute, or call it from bdfConsent.onConsent('marketing', …)
  • The vendor switches run first thing on each page, before your own Meta code exists. Alone, they can’t stop the first PageView of a pixel you pasted yourself: gate it or connect it by ID
  • UET connected by ID loads only after a yes, which is basic mode. For Microsoft’s recommended advanced mode, keep your own UET tag under the consent tag
  • Nothing is blocked automatically: code you neither mark nor connect runs as before. It isn’t an IAB TCF platform either
  • It helps you ask properly; it isn’t legal advice or a compliance guarantee
Questions

Pixels and consent, before you ask.

For visitors in the EU and the UK, yes. Article 5(3) of the ePrivacy Directive asks for consent before anything is stored on or read from a visitor's device unless it is strictly necessary, and the UK ICO says online advertising purposes have never been exempt. Meta's own GDPR page shows how to hold the pixel until a visitor agrees. This is how the rules read to us, not legal advice.

Before fbq('init'), on every page, as in Meta's own example. Then call fbq('consent', 'grant') when the visitor agrees, and again on every later page for a visitor who already said yes. With revoke, fbevents.js still loads from Meta; blocking the whole snippet until a yes sends Meta nothing at all.

Where the law requires it, yes. TikTok's help centre says it requires advertisers to provide notices and obtain consents, and to use a tag manager or consent platform to control the firing of the pixel base code. Turning off first-party cookies in the pixel settings is not enough, because the pixel still uses third-party cookies.

For visitors in the EEA, the UK and Switzerland, yes, since 5 May 2025. Microsoft asks for UET consent mode or the IAB TCF, never both, and says that without either it will stop tracking UET-based conversions and populating remarketing lists. It enforces the ad_storage signal: denied by default, granted after a yes.

No. The Conversions API sends events from your server or shop platform straight to Meta, so a banner in the browser never sees them. Check how that integration handles consent. Builderify only controls what runs in the browser and has no Conversions API or Events API of its own.

Sources

Read on 17 October 2026.

← All guides · Google Consent Mode v2: setup, basic vs advanced

Stop losing the visitors
you already paid for.

More leads from the traffic you already have, and follow-up that sends itself. Free to start. No card, no monthly fee.

Start free See what it does