How do I make Meta Pixel CIPA compliant?

Gate Meta Pixel behind a consent management platform so it does not load or transmit data until the visitor opts in. Do not call fbq('init') / fbq('track') until consent. Gate the pixel behind your CMP.

CIPA § 631 Risk

Is Meta Pixel legal in California?

Q: Is Meta Pixel legal in California?

Meta Pixel is legal to use, but running it without obtaining prior visitor consent can expose a business to claims under California's wiretapping statute (CIPA § 631), which plaintiffs have applied to session-replay and tracking tools. Gating Meta Pixel behind a consent management platform addresses the risk.

Ad Pixel / Behavioral Profiling · Updated 2026

The Meta (Facebook) Pixel transmits page views and events tied to a visitor back to Meta for ad targeting and conversion tracking. Using it is perfectly legal — but running Meta Pixel before a visitor consents is what creates exposure under California's wiretapping law.

Is this tracker on your site? Find out free in 30 seconds.

Real browser scan with evidence capture. No signup required to see results.

Why Meta Pixel can trigger CIPA claims

California's Invasion of Privacy Act (CIPA), Penal Code § 631, prohibits intercepting communications without all-party consent. Since 2022, a wave of plaintiff-firm litigation has applied this decades-old wiretapping statute to website session-replay, chat, and pixel tools — arguing that capturing a visitor's clicks, keystrokes, and form input without consent is an unlawful interception. The Meta (Facebook) Pixel transmits page and event data tied to the visitor for ad profiling; firing it before consent fuels CIPA and CCPA claims.

Statutory damages run up to $5,000 per violation, and plaintiffs argue each affected visitor session is a separate count — which is why even small sites receive demand letters.

Real-world enforcement

In a landmark action, the California Attorney General reached a $1.2M settlement with Sephora over its use of tracking technologies without honoring consumer privacy choices. Private CIPA suits over session-replay and chat tools have named retailers, healthcare providers, and SaaS companies alike. The common thread: trackers firing before the visitor had any chance to opt out.

How to make Meta Pixel compliant

Do not call fbq('init') / fbq('track') until consent. Gate the pixel behind your CMP.
Use Meta's consent API: fbq('consent', 'revoke') by default, then fbq('consent', 'grant') after opt-in.
If installed via GTM, set the pixel tag to require ad_storage consent.
Re-scan with 'Verify fix' to confirm no requests reach facebook.com/tr before consent.

Consent-gating snippet

// Immediately after the base pixel code loads:
fbq('consent', 'revoke');                 // hold all pixel activity
// After the visitor accepts marketing cookies:
cmp.onConsent('marketing', () => fbq('consent', 'grant'));

Meta Pixel's official privacy/consent documentation →

Check your own site

RegSentry runs a real browser against your site, watches exactly when Meta Pixel (and every other tracker) first contacts a third-party server, and captures the evidence — including whether it intercepts keystrokes typed into your forms.

Is this tracker on your site? Find out free in 30 seconds.

Real browser scan with evidence capture. No signup required to see results.

← See all tracker compliance guides