Are Facebook Pixel GDPR compliant?
<p>GDPR states that a data subject have the right to get a copy of the data about the subject the data controller has collected, and in some cases deletion of said data. If I understand correctly, this also includes data that are collected with an ID set in a cookie, like Facebook Pixel does. Do Facebook Pixel have any way of getting the data of a single user through a userID, and also a function for deleting this data?</p>
<p>I know Google Analytics have a function for deleting the data of a userID, and was wondering if Facebook Pixel had a similar function.</p>
<p>If this doesn't exist, then I can't believe that Facebook Pixel is GDPR compliant.</p>

<p>The Facebook Pixel analytics solution does not seem to support access or erasure for data subjects. While there are some GDPR compliance features, these focus on collecting consent prior to collecting data. The relationship between the pixel user and Facebook is also murky. For certain kinds of data, Facebook acts as the data processor only, and the user has all the responsibility as the data controller. For other kinds of data, Facebook and the Pixel user are joint controllers, and therefore jointly responsible.</p>
<p>This lack of features doesn't necessarily mean that Facebook Pixel is in violation of the GDPR, since the GDPR Right to Erasure only applies under certain circumstances. However, it is really difficult to argue that a website or app that integrates Facebook Pixel would be compliant. It is also rather dubious that Facebook could be compliant themselves, since their pixels will also collect data about persons who are not Facebook members.</p>
<p>While these problems are most apparent with the Facebook Pixel since it's explicitly intended for tracking, this problem also applies to any other embeds provided by Facebook, such as like buttons. This was the subject of the Fashion ID case, in which the ECJ determined (in 2019) that the site operator is a joint controller with regards to data collection on the website by the Facebook embed. This effectively means that third party embeds can only be loaded after the website visitor has given consent for sharing data with Facebook.</p>
<p>The tracking of non-users by Facebook was seen as especially problematic in Belgium, where Facebook had been banned from collecting such data already in 2015 (which was upheld in 2018). Since this was pre-GDPR, FB is currently litigating whether Belgium can continue enforcing their ban. I expect that Belgium will prevail with their ban. While this has no immediate consequences for Pixel users, this would make it more likely that Pixel users could be sued or fined successfully.</p>
<p>From an advertiser perspective, Facebook does have valuable data that make the integration of Facebook Pixel an attractive proposition. However, other analytics solutions are much easier to bring into compliance. This is ultimately a business decision: will the better understanding of your ad spend on Facebook outweigh the risk and effort of integrating the Pixel?</p>

gdpr