Is the Meta Pixel Illegal? When a Tracking Pixel Becomes a Legal Problem

Lawsuits and settlements involving the pixel rest on general laws: wiretap statutes, a video privacy statute, state consumer privacy acts and the Federal Trade Commission Act. None of them names the pixel. Each one applies to something the pixel may be doing on a given site.

That makes the useful question narrower than the title. For a given page, ask what the pixel sends, whether any of it is sensitive, whether the visitor was told, and whether an opt-out stops it. The table lists the main theories found in the research and what triggers each.

This is a description of what the sources say. It is not legal advice about any particular site.

The Federal Trade Commission's technology office described the mechanism in a March 2023 post. A company picks a provider, which generates a small snippet of code for the site. The company then sets the events it wants tracked, such as purchases, clicks or page views.

The post says tracking pixels 'can be hidden from sight and can track and send all sorts of personal data'. It notes that pixels can capture how people interact with a page, including items they buy and information they type into forms, and that pixel data can be matched to social media profiles through identifiers such as an email address.

The FTC also addressed hashing, which some pixels apply to names or emails before sending them. Its view was that 'hashes can be reversed or used to link data across different databases'. A site owner who assumes hashed data is anonymous is making an assumption the regulator has rejected in print.

Meta's Business Tools Terms, with an effective date of 3 November 2025, place the compliance duties on the business that installs the pixel. The business represents and warrants that it has given sufficiently prominent notice to the people using its site or app about the collection of Business Tool Data. For websites, the notice has to explain that third parties, including Meta, may use pixels, web beacons and other storage technologies to collect information from the site.

The terms also require that the business has all necessary rights and permissions and a lawful basis to share the data, and that 'an end user provides all necessary consents' before the business uses the tools where consent is required.

Section 1.h restricts the data itself. The business agrees not to share data it knows or reasonably should know is from or about children under 13, or data that 'includes or is based on, directly or otherwise, health information, financial information, consumer report information, or other categories of sensitive information'.

The wording leaves these duties with the business that installs the pixel. A site that sends sensitive data through it is breaching the terms as well as risking a claim under law.

Section 631 of the California Penal Code reaches anyone who 'willfully and without the consent of all parties to the communication' reads or attempts to learn the contents of a communication in transit, and anyone who aids that. Section 637.2 lets an injured person sue for the greater of $5,000 per violation or three times actual damages. Plaintiffs argue that a site which installs a third-party tag has helped the third party read the visitor's communications with the site.

The second theory used section 638.51, which restricts pen registers and trap and trace devices. It needed no allegation about contents. WilmerHale reports that SB 690, signed on 30 September 2026, removes the private right to sue under that section for conduct on websites, online applications and mobile apps, and leaves enforcement to the Attorney General. Privacy World gives the operative date as 1 January 2027. WilmerHale notes that plaintiffs can continue to bring other claims under the Act.

ConsentStack, a consent-software vendor, read 58 federal complaints filed from April to June 2025. The Meta Pixel was named in 24 of them, behind Google's tags in 34. Section 631 appeared in 69% of the complaints and section 638.51 in 53%.

One verdict involves Meta directly. ConsentStack reports that on 1 August 2025 a federal jury in the Flo Health case found that Meta violated section 632, which covers recording a confidential communication, and that at a hearing on 29 October 2026 the parties agreed class members should each receive $5,000. The same report notes that the data came from a period-tracking app through Meta's software kit. It was not a website pixel case, and the size of the class was still contested.

The Video Privacy Protection Act makes a 'video tape service provider' liable for knowingly disclosing personally identifiable information about a consumer. The statute defines that information to include information 'which identifies a person as having requested or obtained specific video materials or services'. It allows disclosure with informed, written consent given in a form distinct and separate from other legal or financial obligations.

Jeffer Mangels describes the pixel theory in a September 2026 article. On a page with video, a pixel allegedly sends the title or address of the video together with an identifier such as a Facebook ID. Plaintiffs call that a disclosure. The firm gives the statutory floor for damages as $2,500.

The reach of the law is unsettled. Jeffer Mangels reports that federal appeals courts disagree on who counts as a 'consumer' and that the Supreme Court granted review in Salazar v. Paramount Global on 26 January 2026. The research for this article could not confirm whether the case has been argued, and no decision had been reported as of 12 November 2026.

The California Attorney General puts the rule this way in the Healthline announcement: the Consumer Privacy Act gives people the right to opt out of the sale or sharing of their personal information for certain targeted advertising, and businesses and website publishers must honor those requests, including requests submitted through the Global Privacy Control.

The Healthline case shows how a pixel fits. The Attorney General's announcement on 1 July 2025 says Healthline allowed online trackers, 'like cookies and pixels', to communicate data about readers to advertisers. The complaint alleged that Healthline 'continued to share data with some third parties involved in advertising' even for people who had opted out. It also alleged that the site's consent banner did not disable tracking cookies despite purporting to do so. The settlement included $1.55 million in civil penalties.

InfoTrust, which sells consent and analytics services, audited 450 US sites in 2025. It reported the Meta Pixel on 62% of them and still loading after an opt-out on 30%. The page does not make clear whether the 30% is a share of all sites or of sites with the pixel, and it does not publish its method. It remains the only measurement of this point found in the research.

The FTC's February 2023 action against GoodRx alleged that the company shared sensitive health information with advertising companies and platforms, including Facebook, Google and Criteo, contrary to its privacy promises. The agency said GoodRx had uploaded lists of people who bought particular medications to target them with ads. GoodRx agreed to a $1.5 million civil penalty and a permanent bar on disclosing health information for advertising. The order was subject to court approval when announced.

The FTC's technology post says companies using pixels that improperly disclose personal information may violate the FTC Act, the Health Breach Notification Rule and HIPAA.

Health information is not limited to medical records. In Healthline the data was the title of an article, such as one addressed to people newly diagnosed with multiple sclerosis, sent with an identifier. The settlement bars Healthline from sharing article titles that reveal a reader may already have been diagnosed. A page address or title can be sensitive without any form being filled in.

Jeffer Mangels reports that plaintiffs' firms are increasingly pairing or replacing their California counts with other statutes. The federal Wiretap Act normally allows a party to a communication to intercept it. Plaintiffs rely on an exception for interceptions made for a criminal or tortious purpose, and the firm says courts are split on how strict that requirement is. It gives statutory damages as the greater of $100 per day of violation or $10,000.

The same article says a federal court in the Middle District of Florida declined to dismiss a pixel-tracking claim under Florida's Security of Communications Act, reasoning that the trackers captured substantive information. Florida's statute has its own pen-register section.

These are one firm's reports of an area that changes monthly. They show that fixing a California problem does not settle the question elsewhere.

Most site owners have never looked at the pixel's network requests. The checks below come from the facts of the cases above. They are a way to find out what is happening on your site. They do not establish that a setup is lawful.

• List every page type where the pixel loads, including account, checkout, search results and any page with video.
• For each event, read the parameters sent: page address, page title, product names, search terms and any form fields.
• Look for health, financial or similarly sensitive meaning in addresses and titles, and for pages aimed at children.
• Check whether advanced matching or a server-side connection sends email addresses or phone numbers.
• Opt out through the banner, reload, and confirm the pixel stops on that page and the next.
• Repeat with the Global Privacy Control signal on and the banner untouched.
• Confirm the privacy policy tells visitors that third parties including Meta collect information through pixels.
• Save the date, pages, browser and results.