Advertising pixels and consent

What a pixel is

EDPB Guidelines 2/2023 (version 2.0, adopted on 7 October 2024) describe a tracking pixel as a hyperlink to a resource, usually an image file, embedded in a website or an email. A pixel usually has no connection with the content the visitor requested: its purpose is to establish automatically a communication with the server that hosts it, which would not otherwise have taken place. A pixel may also carry identifiers or data about the visitor's activity on the site, and these may be generated dynamically by code running in the browser.

Guidelines 8/2020 on the targeting of social media users (adopted on 13 April 2021) describe the mechanism from an advertising perspective.

The visitor opens the pageThe site contains the pixel's code snippet.
The browser sends a requestThe browser automatically sends a request to the provider's server.
The provider can observe the sessionThe observed data can be used, for example, to add the visitor to a target audience.

Simplified diagram, based on footnote 69 of EDPB Guidelines 8/2020.

Why pixels fall under the cookie rules

Article 5(3) of the ePrivacy Directive, transposed in Romania by Article 4(5) of Law No 506/2004, does not apply only to cookies. According to Guidelines 2/2023, it also covers similar technologies, and pixels are addressed explicitly:

Storage: sending the pixel to the visitor's device constitutes storage, at least through the caching mechanism of the client-side software, even if it is not permanent.
Access: the pixel instructs the device to send back an identifier. With dynamically generated pixels, the instruction is the distributed code itself, usually JavaScript. The collection of identifiers can therefore be regarded as “gaining of access”.

In its judgment of 1 October 2019 in Planet49 (C-673/17), the CJEU held, in relation to cookies, that a pre-ticked checkbox does not constitute valid consent, whether or not the information stored is personal data. According to the same judgment, the information given must include how long cookies operate and whether third parties may have access to them.

Falling under Article 5(3) does not end the analysis. Guidelines 2/2023 do not address the exemptions and state that, in each case, it must be assessed whether consent is required or an exemption applies. For targeted advertising through a social network's pixel, Guidelines 8/2020 go further: the EDPB considers that legitimate interest cannot be an appropriate legal basis, because targeting relies on monitoring people's behaviour across websites through tracking technologies. According to the same guidelines, the appropriate legal basis for subsequent processing is likely to be the person's consent.

How responsibility is shared

In Fashion ID (C-40/17, judgment of 29 July 2019), a German online clothing retailer had embedded Facebook's “Like” button on its website. According to the Court's press release, visitors' data appeared to be transmitted to Facebook as soon as the page was opened, without the visitor's knowledge and regardless of whether the visitor had an account or clicked the button. The Court held that:

Collection and transmission: the website owner can be considered a joint controller with Facebook for these operations.
Subsequent processing: in principle, the website owner is not a controller for processing carried out afterwards by Facebook alone.
Information and consent: the website owner must provide, at the time of collection, information such as its identity and the purposes of the processing. Where processing is based on consent, that consent must be obtained in advance for the operations for which the owner is a joint controller, namely the collection and transmission of the data.

The case concerned a social plug-in and was decided under Directive 95/46/EC, since replaced by the GDPR. Guidelines 8/2020 concern social networks and deal directly with the pixels they offer. The example in the guidelines is a backpack website that embeds a social network's pixel in order to show advertising to people who visited without buying. The EDPB notes that, without the pixel, the data would not have been collected and transmitted, and concludes that the website and the social network are joint controllers for collecting and transmitting data through the pixel, for matching and displaying the advertising, and for reporting on the campaign. The guidelines add that the website is also responsible for complying with the ePrivacy Directive requirements relating to this tool.

According to the same guidelines, who collects consent depends on who is first involved with the data subject, and joint controllers should agree how consent is collected in practice. The terms of the arrangement between them do not, however, bind supervisory authorities, which may exercise their powers in relation to either joint controller under their competence.

What Meta and Google require

Advertising providers' terms contain their own obligations for website owners.

Meta: the Business Tools Terms require a clear and prominent notice on each web page where Meta pixels are used. Where the law requires consent for storing and accessing cookies, including in the European Union, the website owner must ensure, “in a verifiable manner”, that the visitor has given the necessary consent before using Meta's tools for that purpose.
Google: the EU user consent policy applies to end users in the European Economic Area, the UK and Switzerland. The website owner must obtain legally valid consent for cookies, where legally required, and for the collection, sharing and use of personal data to personalise advertising. The owner must also retain records of consent, provide clear instructions for withdrawing it, and identify each party that may collect, receive or use the data.

How the visitor's choice reaches Google tags is explained in our article on Consent Mode v2 on Shopify.

How consent is documented

Article 7(1) GDPR places the burden of proof on the controller. EDPB Guidelines 05/2020 state that the regulation does not prescribe a specific method, but that the controller must be able to prove, in each case, that the person consented, without collecting more data than necessary.

Online, the guidelines give as an example retaining information about the session in which consent was expressed, documentation of the consent workflow at that time, and a copy of the information presented to the person. Merely referring to a correct configuration of the website is not sufficient.

According to the guidelines, the obligation lasts for as long as the processing continues. Once it ends, proof should be kept only for as long as strictly necessary to comply with a legal obligation or to establish, exercise or defend legal claims. The guidelines also note that the GDPR sets no time limit for consent; how long it lasts depends on the context, the scope of the original consent and the person's expectations. If the processing changes considerably, new consent is required, and the EDPB recommends refreshing consent at appropriate intervals as best practice.

Configuration on Shopify

Shopify's documentation describes how pixels relate to consent:

Permissions: in markets configured to require consent, usually the European Economic Area and the United Kingdom, web pixels run only when visitors have given the permissions required in the pixel configuration. By default, new pixels require Marketing and Analytics permissions.
Banner apps: a third-party tool must sync consent to Shopify through the Customer Privacy API. Without this sync, app pixels might not fire even after the visitor has given consent.
Regions: the consent regions in the Customer privacy settings must match those in the third-party app. If they differ, non-essential data can be processed before the visitor gives consent.
Theme code: when adding a custom pixel, existing pixel code must be removed manually from places such as theme.liquid. Separately, Shopify warns that using code snippets to bypass consent requirements breaches its Terms of Service and can lead to legal liability for the merchant.
Responsibility: Shopify states that complying with the law and obtaining the necessary consents is the merchant's responsibility.

Review questions for your store

On the basis of the documents above, a pixel set-up can be reviewed with the following questions. The list is a working tool, not a guarantee of compliance, and does not replace legal advice.

Inventory: do you know which pixels and tags are active, including any added directly in the theme code?
Timing: do advertising pixels start only after the visitor has made a choice?
Information: are visitors told who receives the data, for what purpose, how long cookies last and whether third parties have access to them?
Regions: do the consent regions in Shopify match those in the banner app?
Withdrawal: do visitors have clear instructions for withdrawing consent?
Proof: can you show how and when consent was obtained and what information was presented?

About Consentia

Consentia is a cookie consent app for Shopify stores. Further information is available on the Features page. A website can also be checked with our free cookie scanner.

Sources: EDPB, Guidelines 2/2023, version 2.0 · EDPB, Guidelines 8/2020 · EDPB, Guidelines 05/2020, version 1.1 · CJEU, press release No 125/19 (Planet49) · CJEU, press release No 99/19 (Fashion ID) · Meta, Business Tools Terms · Google, EU user consent policy · ANSPDCP, Law No 506/2004 (in Romanian) · Shopify Help Center: pixels, app pixels, custom pixels, privacy settings. Photograph: Unsplash.

Advertising pixels and consent: the store owner's responsibility