Yes, always. The Meta Pixel is a marketing tracker: it sets the _fbp cookie, sends navigation events to Meta, and matches visitors to Facebook accounts for remarketing. All of this is personal data processed for advertising, so it needs prior consent under GDPR and Romanian Law 506/2004 — the pixel must not fire before the click.
Does the Meta Pixel need consent?
Yes, no exceptions. Unlike a shopping-cart cookie, the Meta Pixel does nothing "strictly necessary" for the site to work. Its only purpose is marketing: to help you remarket, measure ad conversions and build audiences. Processing personal data for advertising needs prior consent — not "legitimate interest", not a banner that merely informs.
Law 506/2004 requires consent before storing non-essential cookies, and _fbp is exactly that. A pixel that fires on page load, before the visitor clicks anything, collects and sends data to Meta with no legal basis. It is the most common violation we find in scans — precisely because people drop the Business Manager code straight into the <head> and forget it there.
What does the pixel actually collect?
The pixel is not just a counter. Here is what it leaves and what it sends:
| Element | What it does |
|---|---|
_fbp (cookie) | Uniquely identifies the browser to tie visits to Meta campaigns |
fbclid (URL parameter) | Links an ad click to the on-site session |
| Standard events | PageView, ViewContent, AddToCart, Purchase, etc. |
| Advanced Matching | Can send email, phone or other data (hashed) to match the visitor to a Facebook account |
Advanced Matching is the most sensitive part: it sends direct identifiers to Meta. Want to see whether _fbp fires on your site before consent? A free scan shows you exactly that, no account needed.
How to gate the pixel until consent?
Proper gating means the pixel does not load at all before accept — not that you "hide" it cosmetically. You have two layers to manage:
- Blocking via the CMP. The pixel code stays inactive until the visitor accepts the marketing category. This is the layer that keeps you legally compliant.
- Consent Mode v2 signals. If you also use Google (Ads/Analytics), the four signals —
ad_storage,analytics_storage,ad_user_data,ad_personalization— must be sent correctly. - Meta's own consent handling. The pixel has its own
fbq('consent', 'grant'|'revoke')function, which the CMP can call as an extra layer.
A CMP that genuinely blocks handles step 1 automatically. The Google detail is in our guide on Consent Mode v2 in Romania.
What happens to remarketing if you block?
The real fear is "I'll lose my remarketing audiences if I block the pixel". The reality is more nuanced:
- You build audiences only from visitors who accept. There are fewer of them, but they are the only ones you are legally allowed to track.
- A blocked pixel beats an illegal one. Data collected without consent is not an advantage — it is a complaint waiting to be filed.
- Your accept rate matters. A fair banner, with rejecting as easy as accepting, often gets a good opt-in precisely because it is honest.
In other words, the choice is not "remarketing or compliance" — it is "remarketing on legal data or legal risk". The first option is the sustainable one.
How to fix it in 30 minutes
If your pixel fires before accept, here is the short path:
- Run a free scan to confirm that
_fbpfires before consent. - Put the pixel under a CMP's control that blocks the marketing category until accept.
- Verify again in the Network tab and with the Consent Mode v2 checker.
A CMP like FewCookies blocks marketing scripts until consent and sends all four Consent Mode v2 signals, with a banner and policies in Romanian and English, at €6/month (tax included, 7-day trial without a card). The pixel is the tracker that most clearly separates marketing cookies from essential ones — see also essential vs marketing cookies so you know what else is on your site and what needs blocking.
Frequently asked questions
Can I use the Conversions API instead of the pixel to avoid consent?
No. The Conversions API sends events from the server, but it still processes personal data for marketing and still needs consent. Moving collection to the server does not remove the legal obligation — it just changes where it happens.
Is it enough to put the pixel in Google Tag Manager?
Not automatically. GTM only delivers the pixel; if the tag fires on page load, the pixel still runs before consent. You must condition the trigger on consent state, either through a CMP or through consent rules in GTM.
Why is the pixel the most common problem found in scans?
Because people copy the code from Meta Business Manager straight into the page head, where it fires immediately, and assume the banner covers it. A displayed banner blocks nothing unless it is configured to hold the script until accept, so the pixel runs free under a banner that is "compliant" in looks only.
Want to see which cookies and trackers fire on your site before consent? The scan is free and needs no account. Check your site for free →