How a CSV Tracking Plan Exposed a Meta Pixel Firing Before User Consent

A technical investigation revealed that the Meta Pixel can fire tracking events before a user accepts a consent banner, even when Google's Consent Mode is correctly configured as denied. This happens because Google's consent commands do not automatically control the Meta Pixel, leaving it to fire independently on page load. Using a plain CSV tracking plan and an automated test tool called Tracklint, developers were able to detect that Meta's PageView and ViewContent events were sent while ad_storage consent was still denied. The fix involves explicitly calling fbq('consent', 'revoke') before initialising the Pixel when consent is denied, and fbq('consent', 'grant') only after the visitor accepts. Alternatively, Google Tag Manager users can configure the Meta tag to require ad_storage and set a trigger that fires only after consent is granted.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.
Discussion (0)
Log in to join the discussion and vote.
Log in