Social media cookies are cookies that social networks such as Meta, LinkedIn, TikTok, X and Pinterest set or read through the pixels, share buttons and embeds a website loads, so the platform can recognise the visitor and use the visit for advertising. They are marketing cookies, so in the EU and the UK they need the visitor's consent before they are set.
Every time a visitor lands on a page that contains a Facebook Like button, a LinkedIn share widget or an embedded TikTok video, something fires in the background. The social platform sets or reads one or more cookies in that visitor's browser, even if they never click the button. Those cookies exist to follow people across the web and feed that data back to the platform's advertising systems.
Where social media cookies come from
Social media cookies activate whenever a website loads a resource from a social platform: a tracking pixel, an embed, a share button or a login widget. Some are set by the platform's own servers on its domain, which makes them third-party cookies. Others are written by the platform's script onto your domain as first-party cookies, which carry an identifier the script then sends back to the platform.
These cookies overlap heavily with marketing and advertising cookies: they build profiles, enable retargeting and measure ad conversions. The difference is the source. Social media cookies come from social platforms, not from standalone ad networks.
Which platforms set these cookies and what they collect
The platforms with the widest reach are Meta (Facebook and Instagram), LinkedIn, TikTok, X (formerly Twitter) and Pinterest. Each uses its own tracking pixel or JavaScript tag that website owners install to measure ad performance.
| Platform | Key cookies and identifiers | Purpose | Default duration |
|---|---|---|---|
| Meta (Facebook and Instagram) | _fbp, _fbc, fr | Ad attribution, retargeting, conversion tracking | 90 days (rolling) |
bcookie, li_sugr, UserMatchHistory | Insight Tag tracking, audience matching, campaign reporting | 1 to 2 years | |
| TikTok | _ttp, ttclid, ttcsid | Pixel conversion tracking, ad optimisation | 13 months |
| X (Twitter) | muc_ads, personalization_id, guest_id | Ad targeting, interest profiling, engagement tracking | Up to 2 years |
_pin_unauth, _pinterest_sess | Conversion tracking, interest-based targeting | 1 year |
Meta's _fbp cookie deserves particular attention. Meta's documentation says the Pixel saves a unique identifier to an _fbp cookie on the website's own domain if one does not already exist, so it is a first-party cookie with a different value on every site. The _fbc cookie stores the click ID (fbclid) that Meta appends to ad links. Meta links these identifiers to activity elsewhere through its own fr cookie on facebook.com and through matching on its side. You can look up each of these names in the cookie database.
TikTok's help centre lists _ttp, ttcsid and ttclid as first-party cookies on your domain, plus a third-party _ttp on tiktok.com, each lasting 13 months from last use. Advertisers can switch the first-party cookies off in the pixel settings. Existing cookies keep working until they expire.
How social media pixels work behind the scenes
A website owner pastes a snippet of JavaScript, the "pixel", into the site's header. When a page loads, the pixel sends an HTTP request to the platform's server. That request carries the cookie value, the page URL, the referring URL and often additional event data (page views, add-to-cart actions, purchases). The platform matches this incoming data against its own user database.
If the site has Automatic Advanced Matching turned on, the Meta Pixel also looks for form fields such as email addresses, phone numbers and names, hashes them and sends the hashes to Meta for identity matching. A setting like this is how two Swedish pharmacies ended up sending health-related data to Meta, as covered below.
LinkedIn's Insight Tag works on a similar principle. Once installed, it sets a cookie in the visitor's browser, tracks page visits, button clicks, referrer URLs, IP addresses and timestamps, then matches the visitor to their LinkedIn member profile. LinkedIn uses this matched data for campaign reporting and ad optimisation.
Why social media cookies need consent first
Social media cookies are non-essential cookies. They are not required for a website to function, and the visitor did not ask for them. Under Article 5(3) of the ePrivacy Directive, storing or accessing information on a user's device requires prior informed consent, unless the storage is strictly necessary to deliver a service the user explicitly requested.
A Facebook Like button is not a service the user requested. Neither is a LinkedIn retargeting pixel. The cookie therefore stays blocked until the visitor actively opts in.
The GDPR reinforces this through Article 6 (a lawful basis for processing personal data) and Article 7 (the conditions for valid consent). Consent must be freely given, specific, informed and unambiguous. Pre-ticked checkboxes do not count. Bundling cookie consent with terms of service does not count. Burying the reject option behind multiple clicks does not count either, a point the French data protection authority, the CNIL, has made repeatedly and expensively.
In the UK, the Data (Use and Access) Act 2025 added consent exceptions to PECR from 5 February 2026, but they cover first-party statistics and the site's appearance, not advertising pixels. Social media cookies still need consent there too.
Recent enforcement against pixels and banners
In January 2023, the CNIL fined TikTok 5 million euros for making it harder to refuse cookies than to accept them on its website. Users needed several clicks to reject all cookies but only one to accept them, a textbook dark pattern.
Sweden's data protection authority (IMY) fined the pharmacy chains Apoteket (SEK 37 million) and Apohem (SEK 8 million) after the Meta Pixel on their websites sent health-related data to Meta. The trigger was a sub-feature of the Pixel that the companies switched on, and IMY found they had not put appropriate security measures in place.
In September 2025, the CNIL fined SHEIN 150 million euros because cookies were placed before any choice and refusing did not stop them. On 30 December 2025, it fined a company it did not name 3.5 million euros for sending loyalty programme members' email addresses and phone numbers to a social network for ad targeting without valid consent. The same decision found that 11 cookies requiring consent were placed before the visitor had made a choice.
What website owners get wrong
The most common mistake is loading social media scripts before consent. If the Meta Pixel fires on page load, it sets _fbp immediately. If the LinkedIn Insight Tag starts before the visitor interacts with your cookie banner, bcookie is already set. Consent collected afterwards cannot cover storage that has already happened.
The second mistake is leaving cookies in place when consent is refused or withdrawn. In its December 2025 decision, the CNIL objected that the 11 cookies stayed in the browser and continued to be read after visitors refused. Removing them means sending a Set-Cookie header with an expiry date in the past, or running a script that deletes cookies without the HttpOnly attribute.
The third is vague banner language. Describing social media cookies as helping to "improve your experience" or "personalise content" does not tell visitors what happens. The banner should explain that data will be shared with named third parties (Meta, LinkedIn, TikTok) for advertising purposes.
Blocking social media cookies until consent
Block all social media scripts by default and load them only after the visitor grants consent to the relevant cookie category (usually "marketing"). A consent management platform handles this by holding the script tags back until consent is recorded.
In Kukie.io, a script you tag with type="text/plain" and data-cc-category="marketing" stays inert until the visitor accepts marketing cookies, and an embed with data-cc-src in place of src gets its address only then:
<script type="text/plain" data-cc-category="marketing" src="https://snap.licdn.com/li.lms-analytics/insight.min.js"></script>
<iframe data-cc-category="marketing" data-cc-src="https://www.tiktok.com/embed/v2/VIDEO_ID"></iframe>With automatic script blocking switched on, Kukie.io also holds the Meta Pixel, the LinkedIn Insight Tag, TikTok's Pixel, the Pinterest tag and X's ad script by their script addresses, without changes to your tags.
Meta's own consent switch
Meta's Pixel has a built-in consent API. Call fbq('consent', 'revoke') before the Pixel initialises, on every page, to pause sending, then call fbq('consent', 'grant') when the visitor opts in. This lets you load the Pixel early without sending events before consent. For the LinkedIn Insight Tag and the TikTok Pixel, blocking the script itself until consent is the dependable approach.
Google Consent Mode and other platforms' tags
If you deploy social media pixels through Google Tag Manager, Google Consent Mode v2 sets default states for ad_storage, ad_user_data and ad_personalization to "denied" until your consent platform sends an update. Consent Mode changes how Google's own tags behave. Meta, LinkedIn and TikTok tags in Google Tag Manager wait only if you give each tag an additional consent check (such as ad_storage) or fire it from a trigger that runs after consent.
Cookieless tracking with Meta's Conversions API
Meta's Conversions API sends events from your server to Meta instead of from the visitor's browser. Meta's documentation describes it as a connection between an advertiser's server and Meta's endpoint, with server events processed like Pixel events. Because nothing runs in the browser, no cookie is set by the API itself.
That does not take it outside the law. The events carry personal data: hashed email addresses or phone numbers, IP addresses, and often the fbp and fbc values read from the visitor's cookies. Reading those cookies needs consent under Article 5(3), and sending the data to Meta for advertising needs a lawful basis under the GDPR, which in practice is consent. A server-side setup should send events only for visitors who accepted marketing, using the same choice your banner records.
Social media cookies under other privacy laws
The GDPR and the ePrivacy Directive set the strictest standard, but social media cookies trigger obligations under other frameworks too.
Under the CCPA (as amended by the CPRA), sharing personal information with social platforms for cross-context behavioural advertising counts as "sharing" and requires a visible "Do Not Sell or Share My Personal Information" link. Meta provides a Limited Data Use (LDU) flag that restricts data processing for California users, but the website owner must turn it on.
Brazil's LGPD requires a legal basis such as consent for processing personal data for advertising. Canada's PIPEDA requires meaningful consent for the collection, use and disclosure of personal information, and the Office of the Privacy Commissioner has scrutinised online tracking practices. South Africa's POPIA similarly requires a lawful justification for processing, with consent the most practical basis for social media tracking.
What browsers block without a consent tool
WebKit's tracking prevention documentation says Safari blocks all third-party cookies and deletes cookies created in JavaScript after 7 days without interaction on the site. Cookies created in JavaScript on a page reached through a decorated link, such as one carrying a click ID, are capped at 24 hours. Firefox's Enhanced Tracking Protection blocks social media trackers and cross-site tracking cookies from a list of known trackers, and its Total Cookie Protection confines every cookie to the site where it was created. Chrome still permits third-party cookies by default: Google dropped its plan to deprecate them in July 2024, and in April 2025 confirmed it would not roll out a separate user-choice prompt either.
Browser protections are not a substitute for consent. Even if Safari blocks a third-party cookie, the Meta Pixel can still send event data, and first-party cookies like _fbp are not caught by third-party cookie blocking. The law asks for consent before the storage happens, whatever the browser does afterwards.
Quick answers on social media cookies
Do social media cookies track visitors who are not logged in to the platform?
Yes. Cookies like Meta's _fbp assign a unique identifier to every browser that visits a page with the Pixel installed, whether or not the visitor has a Facebook account. The platform can still build a browsing profile and use it for ad targeting.
Can I use social media share buttons without setting cookies?
Yes. Some consent platforms replace embedded share buttons and posts with a placeholder until the visitor consents to marketing cookies. Another option is a plain link that opens the platform's share URL directly, with no embedded script or iframe.
Are social media cookies classified as first-party or third-party?
It depends on how they are set. Meta's _fbp is a first-party cookie stored under your domain, while the fr cookie is a third-party cookie stored under facebook.com. LinkedIn's bcookie is third-party. The consent requirement applies regardless of party classification.
What happens if I load the Meta Pixel before getting consent?
The Pixel immediately sets cookies and starts sending visitor data to Meta. In the EU that breaks the prior-consent rule in Article 5(3) of the ePrivacy Directive and the national laws that implement it. Swedish and French regulators have issued multi-million-euro fines over pixels and cookies set before a choice.
Do social media cookies fall under the CCPA's definition of "sharing"?
Yes. Sending personal information to a social platform for cross-context behavioural advertising counts as "sharing" under the CPRA amendments. You must offer a "Do Not Sell or Share" opt-out and honour Global Privacy Control signals.
How do I audit which social media cookies my site currently sets?
Use a cookie scanner to crawl your domain and list every cookie, its source, category and duration. Many social media cookies are set only when specific pages load, so scan across several pages to catch them all.
Is server-side tracking for social platforms exempt from consent requirements?
No. Server-side tracking, such as Meta's Conversions API, still processes personal data and still needs a lawful basis under the GDPR. It does not rely on browser cookies, but it sends hashed identifiers and event data to the platform, which is personal data processing.
See which social pixels your pages load
If social media pixels run on your site, they are almost certainly setting cookies, and the first page view is where it usually goes wrong. Kukie.io's scanner finds cookies from Meta, LinkedIn, TikTok, X, Pinterest and other third-party services and sorts each into a category, so your consent banner can hold them until the visitor accepts.
