Using Facebook Pixel Legally: A Guide

The Facebook Pixel is probably the most popular remarketing instrument and at the same time highly sensitive from a data protection law perspective. The contribution shows how one can use the Facebook Pixel relatively lawfully.

Facebook Pixel and Data Protection

It is well known that the company Facebook (USA) collects a lot of data from its users. The platform itself is free, the user pays with his data. What was already somewhat problematic in the past, to put it politely, has been highly explosive since May 25, 2018 with the General Data Protection Regulation.

The core of the solution proposal is a self-developed opt-out possibility for the Facebook Pixel, which in combination with other measures helps to be as compliant as possible with the General Data Protection Regulation. However, nobody knows exactly what data Facebook or Meta processes for what purpose. At least there is a judgment on the Facebook plugin (ECJ ruling of 29.07.2019 – C-40/17 – "Fashion ID"), according to which joint responsibility exists. In case of problems, therefore, both the website operator who integrates the FB Pixel and Meta are in the same boat. However, one should assume that Meta does not participate actively.

Requirements

For analysis tools on websites to have a chance at legal security, several requirements must be met, including: 1:

• Consent request: The pixel may only be loaded after the user (=visitor to the website) has consented. This results, among other things, from Section 25 TTDSG, Art. 49 GDPR, the Schrems II ruling of the ECJ (ruling of 16.07.2020 – C-311/18) and Art. 5 para. 1 lit. c GDPR (“data minimization”)
• Ordinary text for data protection statement: Mention of component, its purpose, providing company (address), link to data protection statement from providing company to component, personal data collected, other hints (such as linking with Facebook account if user is currently logged in there)
• Option to opt out of data collection by the analysis tool
• IP address anonymization (see Google Analytics, for example)
• Minimizing the data to be collected to a justifiable extent (I wouldn't know why one needs to know the exact age of their website visitors, no one has that right on demand)
• Contract for commissioned data processing with the provider of the analysis tool
• Guarantee that the provider of the analysis tool complies with applicable data protection regulations here

Those who believe this is possible with the Facebook Pixel can continue. Some points do not necessarily concern this pixel because it should not be seen as an analysis tool by necessity.

Obtain consent

Step 1: Do not load pixels

Under no circumstances play out the code for the FB Pixel actively and hope that a consent tool suppresses this code effectively until the user has given their consent. See my investigation into cookie tools.

Instead, use one of the following two options:

1. Load code for the FB pixel after user has agreed.
2. Play code inactive and only activate after user has agreed.

One possibility can, for example, be realized with my free consent tool.

Possibility two uses the already quite widespread Directive data-src (instead of src) in script instructions. The code for the FB pixel looks like this then:

<script data-src="/script/to/pixel-code"></script>

The prerequisite is that the code for loading the Facebook Pixel must be in a script file. Those looking for technical tips on this can find them in my post about the linked consent tool. Maybe the following code example will also be helpful.

Step 2: Data protection notices on consent request

In my checklist for consent requests, you will find the specifications that are often referred to as "Cookie Popup" when making a consent popup. These include in particular:

• Service name, here: Facebook Pixel (or equivalent, depending on the type of loaded FB service)
• Brief purpose description
• Providers are named: Meta with country specification (the full address also or at least in the data protection declaration)
• Point out that risks exist according to Art. 44 GDPR due to data transfer to the US
• All cookies are named. Per cookie
  • Name
  • Purpose description
  • Service life

Make sure that the option to agree is not visually emphasized over the option to decline on the "Cookie Popup". Decline must be at least as easy to do as agreeing.

Opt-out possibility

The Facebook Pixel does not have a built-in opt-out option. I suggest the following solution:

Step 1: Insert JavaScript code

Add the following code on every page of your website, adjust the Facebook ID in the code, it can be inserted in the BODY area, perhaps right at the beginning: