Yes, the Facebook Pixel uses cookies. The Meta Pixel sets two first-party cookies on your own domain, _fbp to recognise a browser and _fbc to record which ad a visitor clicked, and its requests to facebook.com can carry Meta's own fr cookie, a third-party cookie. All of them serve advertising, so visitors in the EU and the UK must agree before the Pixel loads.
When you install the Meta Pixel on your website, the data it collects goes to Meta's servers. Advertisers use it to measure campaigns, build lookalike audiences and retarget people who left a shopping cart. Because these trackers collect personal data and follow behaviour for advertising, they belong in the marketing cookies category.
Using them requires explicit permission.
You cannot turn on the Pixel and hope for the best. Running it without a consent banner that holds it back exposes you to complaints and regulatory action, and the Pixel is one of the most widely installed trackers on the web, so it is often among the first things a reviewer finds.
The mechanics of Facebook cookies
The Meta Pixel works mainly through two cookies: _fbp and _fbc. They work together to recognise visitors and attribute their actions to specific ad campaigns.
The _fbp cookie is a browser identifier. When a visitor lands on a site with the Meta Pixel installed, the script checks for an existing _fbp cookie and, if there is none, saves a new unique identifier for the website's domain. Meta's documentation describes its value as fb.1. followed by the creation time in milliseconds and a random number. It lets Meta follow the visitor's journey across your pages and match that activity with what it already knows about the browser.
The _fbc cookie handles click attribution.
When someone clicks an ad on Facebook or Instagram, Meta adds a click identifier called fbclid to the destination URL. When the visitor arrives, the Pixel reads that parameter and stores it in the _fbc cookie, which tells Meta which ad brought the visit. Meta's guide to the fbp and fbc parameters recommends a 90-day expiry for _fbc.
How an ad click becomes the _fbc and _fbp values
| Cookie | What it does | Typical expiry |
|---|---|---|
_fbp, your domain | Recognises the browser across visits | About 3 months |
_fbc, your domain | Records the ad click from the fbclid | 90 days, as Meta recommends |
fr, facebook.com | Advertising by Meta (third-party) | About 3 months |
You can look up each of these in the cookie database, which lists their typical durations.
First-party cookies, third-party data
Facebook advertising used to lean on cookies set from the facebook.com domain, such as fr. Those are third-party cookies on your site, and Safari and Firefox block them by default through Intelligent Tracking Prevention (ITP) and Enhanced Tracking Protection (ETP). The fr cookie still exists and is still sent where the browser allows it.
The Pixel sets _fbp and _fbc as first-party cookies on your domain.
Because the script writes them to your domain, the browser treats them as if your site created them, which helps them survive in browsers that block third-party cookies. That changes nothing about their legal classification. They remain advertising trackers, the values still go to Meta, and you are still responsible for consent before they are set.
What European law requires before the Pixel loads
Under Article 5(3) of the ePrivacy Directive, you must obtain prior, informed consent before storing or reading any non-essential information on a visitor's device. Facebook cookies are never strictly necessary for a website to work, which is why the ePrivacy Directive keeps the Meta Pixel blocked until the visitor agrees to marketing cookies.
The GDPR applies too, because the Pixel collects IP addresses, browser details and browsing history. You do not hand that responsibility to Meta. The Court of Justice ruled in Fashion ID (C-40/17) on 29 July 2019 that a site embedding a Facebook plug-in is a controller, jointly with Facebook, for collecting the visitor's data and transmitting it. The same reasoning applies to the Pixel.
Regulators act on it. The CNIL, France's data protection authority, fined Shein €150 million on 1 September 2025 for advertising cookies set before visitors made any choice. Sweden's data protection authority, IMY, fined Apoteket SEK 37 million and Apohem SEK 8 million after their Meta Pixel sent sensitive purchase data to Meta, finding they lacked appropriate security measures. In the UK, the ICO wrote to the operators of 134 of the top 200 websites about their cookies in January 2025.
Consent must be freely given, specific, informed and unambiguous to count. Pre-ticked boxes are not consent, and neither is continuing to browse. Visitors need a clear choice to accept or reject the trackers, with "Reject all" as easy to use as "Accept all".
The Conversions API still needs consent
As browser restrictions tighten and ad blockers spread, Meta has promoted its Conversions API (CAPI). CAPI lets your server send events straight to Meta's servers, without the browser. Many marketers believe server-side tracking removes the need for consent.
It does not.
If you collect personal data such as an IP address, email address or phone number and send it to Meta through CAPI, you are processing personal data under the GDPR. If you read _fbp or _fbc to enrich that server-side event, you are reading a device's storage under the ePrivacy Directive. Server-side tracking for advertising needs the same consent as the Pixel in the browser, because the law looks at the purpose, not the delivery route.
Rules outside Europe
Other jurisdictions have their own rules on social media trackers. The CCPA in California requires businesses to let people opt out of the "sale or sharing" of their personal information, and sending data to Meta for cross-context behavioural advertising counts as sharing under the CPRA amendments.
In practice, that means a "Do Not Sell or Share My Personal Information" link.
When a Californian visitor uses that link, or their browser sends a Global Privacy Control signal, your site must stop the Meta Pixel from firing and stop sending their data through CAPI. Brazil's LGPD, Canada's PIPEDA and South Africa's POPIA set their own opt-in or opt-out rules, which is why most sites with visitors in several regions use a consent tool rather than managing each rule by hand.
How to audit your Facebook tracking
Start by finding out what your site does today. Many website owners inherit sites from earlier agencies or developers without knowing that the Meta Pixel is active, and some marketing plugins add the tracking code without telling the site administrator.
Use a cookie scanner to audit your pages. A thorough scan shows whether _fbp or _fbc are present and, more importantly, whether they are set before the visitor interacts with your consent banner. If they appear on the first page load, the Pixel is firing before consent, which EU and UK rules do not allow. Adjust your tag manager or CMS so the script waits until the visitor accepts marketing cookies.
Short answers on Facebook cookies
What is the _fbp cookie used for?
The _fbp cookie is a browser identifier the Meta Pixel saves on your own domain. Meta uses it to recognise the same browser across your pages and visits for advertising measurement and targeting.
Do I need consent to use the Facebook Pixel?
Yes, for visitors in the EU and the UK. Under the ePrivacy Directive and the GDPR, you must get prior consent before the Meta Pixel sets cookies or collects data, because it is an advertising tracker, not a strictly necessary one.
Does the Facebook Conversions API bypass the GDPR?
No. Sending personal data from your server to Meta through CAPI is still processing for marketing purposes, and reading _fbp or _fbc to enrich it accesses the device. You need the same consent as for the Pixel in the browser.
How long do Facebook cookies last?
About three months. Meta recommends a 90-day expiry for _fbc, and _fbp and Meta's own fr cookie typically last around three months as well.
Are Facebook cookies first-party or third-party?
Both exist. The Meta Pixel sets _fbp and _fbc as first-party cookies on your domain, while Meta's fr cookie is set on facebook.com and is a third-party cookie on your site. Either way, the data goes to Meta for advertising.
Hold the Meta Pixel until visitors accept marketing
A Pixel that waits for consent loses nothing a European visitor has refused. Kukie.io scans your site for _fbp and other trackers, sorts them into categories and can hold the script back until consent for marketing cookies, then record the visitor's choice.
