How Social Media Cookies Fire on Your Site, and How to Gate Them Behind Consent

Most developers add a Meta Pixel or LinkedIn Insight Tag by pasting a snippet into the page <head>. From then on, the script runs on every page load, which is how social media cookies track visitors before anyone has touched the consent banner.

What actually gets set

Meta's developer documentation says that when first-party cookies are on, the Pixel saves a unique browser ID to _fbp on your domain. If the visitor came from an ad, the fbclid value is stored in _fbc. LinkedIn's Insight Tag uses UserMatchHistory on .linkedin.com to sync IDs for ad targeting.

The first-party detail catches people out. _fbp lives on your domain, yet it serves Meta's advertising, so it still needs consent.

Why the site owner is responsible

In Fashion ID (C-40/17), the Court of Justice of the EU held that a site embedding Facebook's Like button is a joint controller for collecting and sending visitor data to Facebook, starting from page load.

Gating the scripts

1. Remove hardcoded pixel snippets that run before your consent banner.
2. Load them through a consent manager, or Google Tag Manager with consent checks.
3. Reject all in a clean session, then confirm there is no _fbp cookie and no request to facebook.com/tr.
4. Accept, and confirm the pixel fires once.

Letting Seers do the gating

Wiring this up tag by tag gets tedious. The Seers consent platform scans your site, sorts every cookie and script into a category, and blocks it in real time until the visitor consents. Google Consent Mode v2, Microsoft Consent Mode and IAB TCF v2.2 switch on with one toggle, and there are plugins for WordPress, Shopify, Magento and Drupal.

Where server-side fits

A server container cuts the scripts running in the browser and gives you one place to apply consent rules. Seers server-side tagging syncs consent with each event and forwards it to Meta's Conversions API, LinkedIn's Conversion API and TikTok's Events API.