How to Run Facebook Ads in the EU Without Breaking GDPR

How to Run Facebook Ads in the EU Without Breaking GDPR

Quick Answer: The Meta Pixel sets advertising cookies, so under the ePrivacy Directive it can't run for an EU visitor until they opt in, and the Conversions API isn't a way around that refusal. Running Facebook Ads in the EU without breaking GDPR comes down to a consent banner (CMP) that blocks the Pixel by default, server events only for visitors who consented, and a lawful basis for any customer list you upload.

The General Data Protection Regulation (GDPR) has applied since May 25, 2018, and its top tier of fines reaches €20 million or 4% of worldwide annual turnover, whichever is higher. The fines get the headlines; the daily work is smaller: get consent before tracking, send Meta only what you need, and know who's responsible for what.

For advertisers, GDPR comes down to a lawful basis for processing, transparency, data minimization and accountability. For Facebook advertising the lawful basis is usually consent: a clear opt-in before any pixel, cookie or other identifier is used for targeting or measurement. A privacy policy on its own isn't consent; people have to actively agree to specific uses.

Understanding the Legal Framework: GDPR and ePrivacy Directive

Two laws apply: the GDPR and the ePrivacy Directive (often called the "Cookie Law"). GDPR covers the processing of personal data in general; the ePrivacy Directive covers the confidentiality of electronic communications, including cookies and similar tracking technologies.

The ePrivacy Directive requires informed consent before any non-essential cookie or tracking technology is placed on a visitor's device, and that covers the Facebook Pixel. Cookies strictly necessary for a service the visitor asked for (a shopping cart, say) are exempt. Advertising cookies aren't, and in most cases neither are analytics or personalization cookies, so they need consent.

GDPR then governs what happens to the personal data those cookies collect: data subject rights (access, rectification, erasure, portability), data protection by design and by default, and a Data Protection Officer (DPO) for some organizations. Meta provides tools and terms to help, but as its GDPR page for the Pixel puts it, each company is responsible for its own compliance.

Implementing a GDPR-Compliant Consent Management Platform (CMP)

Compliant Facebook advertising in the EU starts with a Consent Management Platform (CMP): the tool that asks for, records and applies each visitor's cookie choices. It has to run on your site before any Pixel event fires or any data is sent.

A compliant CMP has to do six things:

Granular Consent: Users must be able to consent to different categories of cookies (e.g., analytics, advertising, functional) separately. A single "accept all" button without options for refusal or granular choice is non-compliant.

Clear Information: The CMP banner or pop-up must provide clear, concise information about the types of cookies used, their purpose, and who is processing the data.

Opt-in by Default: All non-essential cookies must be disabled by default. The user must actively opt-in. Pre-checked boxes are not considered valid consent.

Easy Withdrawal: Users must be able to easily withdraw their consent at any time, with the mechanism for withdrawal being as straightforward as giving consent.

Consent Record Keeping: The CMP must record and store proof of consent for auditing purposes. This includes timestamps, user IDs, and the specific choices made.

Integration with Facebook Pixel/CAPI: The CMP must be able to control the firing of the Facebook Pixel and the transmission of data via the Conversions API based on the user's consent choices. That usually means the Pixel's own consent calls, fbq('consent', 'revoke') before the Pixel starts and fbq('consent', 'grant') once the visitor accepts, or tag triggers that wait for consent.

CMPs include OneTrust, Cookiebot, Usercentrics and Complianz. When you choose one, check that it covers both GDPR and ePrivacy, works with your store platform (Shopify, for instance) and documents how to set it up with Meta's tools.

Configuring Facebook Pixel and Conversions API for Consent

Then configure the Facebook Pixel and the Conversions API (CAPI) to respect those choices. Installing a CMP doesn't make your Facebook advertising compliant on its own; the CMP has to control what the Pixel and your server send.

For the Facebook Pixel, this means:

Blocking by Default: Ensure the Facebook Pixel base code and all event fires (PageView, AddToCart, Purchase, etc.) are blocked by default until the visitor consents to "advertising" or "marketing" cookies. Your CMP should provide mechanisms for this, often by delaying script execution or using specific data layer events.

Conditional Firing: Only fire the Pixel and its associated events if the user has provided valid consent.

Limited Data Processing (LDP): Not a GDPR tool. With Meta's Limited Data Use option, Meta processes the data as a service provider and limits retargeting and measurement, but Meta built it for US state privacy laws and offers it only for people in listed US states. For EU visitors who haven't consented, the Pixel stays off.

The Conversions API (CAPI) sends conversion events from your server instead of the browser, so ad blockers and browser tracking prevention don't stop it. That's why it needs the same consent rules:

Consent First: Don't send personal data through CAPI for visitors who haven't consented to advertising tracking.

Hashing Data: Always hash customer information (email, phone number) before sending it through CAPI. Hashing is pseudonymization, so the data still counts as personal data.

Match Consent Parameters: The CAPI payload has no field for EU cookie consent (its data processing options are the US-only Limited Data Use), so the match happens on your side: send a server event only when your CMP holds a consent record for that visitor.

Data Minimization: Send only the data points you need through CAPI, and no extra personal information.

It's easy to assume CAPI sidesteps consent because it runs on your server. It doesn't: if you send personal data that identifies someone for advertising, you need their consent, whether it goes from the browser (Pixel) or from your server (CAPI).

Ad Campaign Structure and Targeting Considerations

GDPR also shapes how you build audiences. Meta's targeting options are broad, and using them compliantly is on you.

Custom Audiences: For audiences built from customer lists (email lists, say), make sure those people consented to this use of their data when you collected it; a line in your privacy policy isn't consent on its own. Meta matches the list as your processor, under its Data Processing Terms. For website-visitor audiences, the advertising consent your CMP recorded is what counts.

Lookalike Audiences: Meta builds them from a seed audience and never hands you the people in them, so they raise fewer direct consent questions. The seed audience still has to be collected compliantly.

Special Ad Categories: Ads in Meta's "Special Ad Categories", such as housing and employment, run with restricted targeting to prevent discrimination. That's Meta's rule rather than GDPR's, but it limits your targeting the same way.

Data Minimization in Ad Copy: Don't ask for personal information in your ads' lead forms or on landing pages unless you need it and can say why.

Data Processing Agreements (DPAs) and International Data Transfers

Meta's terms give it two roles. For the Pixel and the Conversions API, its Controller Addendum makes Meta Platforms Ireland and you joint controllers under Article 26 GDPR for collecting the data and sending it to Meta. Where Meta processes data on your behalf, such as matching a customer list for Custom Audiences, its Data Processing Terms apply. Read both before you switch the Pixel on.

International transfers were the hard part for years. After the EU's Court of Justice struck down Privacy Shield in its Schrems II ruling of July 2020, transfers to the US leaned on Standard Contractual Clauses (SCCs) with supplementary measures. On 10 July 2023 the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework, so personal data can now flow to US companies that participate in it.

Meta's Data Processing Terms carry their own transfer addendum for data leaving the EU. For transfers that still rely on SCCs, the European Data Protection Board (EDPB) and national supervisory authorities have published guidance on supplementary measures such as encryption and pseudonymization, so check which route each of your vendors uses, not just Meta.

Beyond Compliance: Ethical Data Use and Trust Building

The law sets the floor; past it, how you treat people's data is up to you.

Consider these principles:

Transparency: Be upfront and clear about your data practices in your privacy policy and cookie banner. Avoid jargon.

User Control: Give people easy tools to change their consent and data preferences.

Data Minimization: Collect only the data your advertising needs.

Security: Protect the personal data you collect with proper security measures.

Purpose Limitation: Use data only for the purposes for which it was collected and consented to.

The Real Challenge: Attribution in a Privacy-First World

Once the banner works, part of your audience declines tracking, and every tool that depends on cookies sees less. The compliance work is done, and a measurement problem starts: what did your ad spend cause in revenue when you can only see some of the buyers?

Last-click and multi-touch models only work with the journeys they can track. When visitors decline cookies, the data reaching Ads Manager, Google Analytics and any pixel-based marketing attribution platform covers the people who consented and misses the rest, and the two groups don't have to behave alike.

Take a buyer who sees your Facebook ad, declines cookies on your site and buys a week later after typing in your URL. The Pixel never links that sale to the ad, so Ads Manager doesn't count it, and the campaign looks weaker than it is. Correlation-based reports can only describe the buyers they could track; they can't tell you what the ads did across everyone.

Beyond Correlation: Measuring What Your Facebook Ads Caused

Multi-touch attribution looks at which touches came before which sales, so a consent gap becomes a blind spot. Causal inference asks a different question: what would revenue have been without the ads? You can answer a rough version of it for free, because the numbers that matter most don't depend on cookie consent. Your Shopify orders count every buyer, whatever they clicked on the banner, and media mix modeling works from the same kind of totals.

Three checks built on numbers consent can't shrink:

1. Put the gap in proportion. Compare Ads Manager's purchases with your Shopify orders for the same weeks, before and after your consent banner went live. For illustration: if 6 in 10 visitors accept cookies, Ads Manager can see roughly 6 in 10 of the purchases its ads touched, so a drop after launch is the count shrinking, not the ads failing.

2. Track MER from your own books. Divide total revenue in Shopify by total ad spend, every week. It needs no cookies and no consent, so it covers every buyer.

3. Hold out one region. Pause Meta in one region for two weeks and compare that region's Shopify revenue with the rest. The difference is what Meta caused across all your buyers, consenting or not; divide it by the spend you paused and you have an incremental ROAS no dashboard had to estimate.

Every platform grades its own homework, and behind a consent banner Ads Manager only sees part of the class. Your order book counts everyone.