Ad Tracking and Consent: What You Can Actually Collect

Lionel Lowery
August 05, 2026

Last Updated: August 5, 2026

TL;DR

A tracking pixel reports what someone did on your own site. Calling it surveillance overstates it. Calling it benign understates it.
Standard events tell you someone arrived. Custom events tell you something happened. Most accounts never build the second kind.
Ad platforms need roughly 50 of your chosen events per week to make reliable decisions. Below that, the system is guessing along with you.
Server-side tracking gets around ad blockers. It has no effect on whether you were allowed to collect the data.
Which rules apply depends on where your visitor is sitting, regardless of how big your business is.
The UK just exempted some analytics from consent.
Advertising pixels are specifically not covered, and that gap is where people will get caught.
The goal was never to know more about people. It was to be clear enough about who this is for that the right ones recognize themselves.

You've been told to install a pixel. You've maybe been told to add a consent banner, usually by someone who never explained why. Somewhere underneath all that, for a lot of people, is a feeling that they're being asked to take part in something a little grubby, without ever being told plainly what's being collected or who it's for.

What follows is the informed version. What these tools actually see, which rules apply to you, and where I think the line sits. If you're earlier than this and still working out whether your foundation is ready for ads at all, start with the three things worth fixing first.

What These Tools Actually See

A tracking pixel is a small piece of code on your website that reports back what someone did while they were on it: which pages they opened, whether they filled in a form, whether they bought something. It sends that to the ad platform, so the platform can connect an ad it showed to something that happened afterward.

Two wrong ideas about this are worth puncturing at once, because most people hold one or the other.

The first is that it reads minds, follows people around, or knows things about them you never gave it. It doesn't. It reports activity on property you own, most of which you could already see in your own website analytics.

The second is that it's therefore nothing to worry about. That one is more common among business owners, and it's the one that gets people in trouble. You're sending a record of an individual's behavior to an advertising company, whether that's Meta, Google, TikTok, LinkedIn, or another one. That company keeps it, connects it to a profile it already holds, and uses it for purposes well beyond your campaign. The person on the other end has a real interest in knowing that's happening.

Both readings are partly right. Calling it surveillance overstates what's happening. Calling it benign understates it. Anyone offering you only one of those readings wants something from you.

One more piece worth knowing, because it explains a lot of what you'll be sold. Browser pixels get blocked constantly now, by ad blockers, by browser privacy settings, and by Apple's app tracking rules. The industry's answer was to move the reporting off the browser and onto your own server, so your website sends the data to the platform directly. Meta calls its version the Conversions API. LinkedIn calls its version the same thing. The other platforms have their own equivalents.

That change affects where the data travels from. It has no effect on whether you were allowed to collect it, which is the subject of the third section.

Standard Events Tell You Someone Arrived. Custom Events Tell You Something Happened.

Most accounts stop at the defaults, and it costs them.

Out of the box, tracking records a handful of standard moments, usually a page load or an arrival on a thank-you screen. Those tell you a person showed up, which is useful and incomplete. They say nothing about whether anything meaningful happened while that person was on your site.

A custom event does. It's a signal you define for an action that indicates real interest: opening the pricing section, playing more than half of a video, expanding a service description, starting a form even if they abandon it. Those are things a serious prospect does and a bounced visitor doesn't. Worth knowing if someone else is building this for you: a platform-standard event like Lead or Purchase isn't limited to the default trigger it ships with. It can be fired on your own custom condition too, so "standard" describes the label the platform recognizes, not how it got triggered.

Here's why the choice matters more than it sounds. Your campaign optimizes toward a goal you set, which the platforms label a conversion, and the system learns from whatever you told it to count. Tell it to count page loads and it will find you excellent page loaders. Tell it to count the moment someone opens your pricing and it starts looking for people who do that. The system pursues your definition of success more literally than most people expect, which is why the definition deserves more thought than the budget.

Three things go wrong here regularly, and all three are worth checking before you spend anything.

The Event Was Never Installed Correctly

This is the most common failure and the least noticed, because nothing announces it. The campaign runs, the budget spends, and the reporting column sits at zero. Zero reads as poor performance rather than a broken sensor, so people respond by changing the creative or the audience, which fixes nothing.

Nobody Verified It Fires

Installing an event and confirming an event are separate jobs, and the tools for the second one are free.

Meta has a Chrome extension called Pixel Helper and a Test Events tab inside Events Manager.
Google has Tag Assistant.
LinkedIn's version lives inside Campaign Manager itself, under Analyze, then Insight Tag, no separate tool to install.

Use two of them, because they answer different questions. A browser extension tells you the event fired on the page. The platform's own testing view tells you the platform actually received it. Those are separate failures, and checking one leaves the other open. Click through your own site as a visitor would, watch the event appear on both sides, and do it deliberately once before launch. If it doesn't appear, you found the problem for free instead of paying to discover it in your ad reporting a month later.

The Event Fires, But It Doesn't Gather Enough Information

This one catches people who did everything else right.

An event that genuinely happens twice a month is real data and still not enough to act on. Two occurrences can't separate a pattern from a coincidence. That isn't a platform limitation, it's how inference works: the smaller the sample, the more of what you're seeing is noise, and the more confidently wrong any conclusion drawn from it will be. A human analyst has the same problem. The machine just makes decisions faster.

The platforms are explicit about the threshold. Meta's guidance is that an ad set needs roughly 50 of your chosen optimization events per week before its delivery system has enough signal to make reliable decisions, and an ad set that falls below that can drop back into its learning phase. Other platforms differ on the number and agree on the principle.

If your real conversion is genuinely rare, optimize toward something earlier in the sequence that happens often enough to be learnable:

If the outcome you care about is a signed contract, optimize toward a booked call.
If it's a booked call, optimize toward a completed contact form.
If it's a large purchase that happens a few times a month, optimize toward an add-to-cart or a pricing page view.
If it's a donation, optimize toward the first step of the donation form rather than the completed gift.

Keep measuring the rare event. Just stop asking the system to learn from a sample that can't teach it anything.

A conversion campaign pointed at an event that has never fired is the purest form of wasted budget I see. It looks like it's working the entire time it's running.

The Rules Depend on Where Your Visitor Is, Not How Big You Are

These rules apply at every size. A one-person shop and a national brand are held to the same standard, because the standard attaches to the visitor, not to the business.

What matters is where the person visiting your site is sitting. If you get visitors from outside your own state or country, and you almost certainly do, more than one set of rules applies to your site at once.

In the EU and EEA, under the General Data Protection Regulation and the ePrivacy Directive, consent comes first. Opt-in, before the pixel fires at all. Not after the banner appears, and not while it's still on screen. Before. The notice also has to name the advertising specifically, because "third-party cookies" and "our advertising partners" aren't considered specific enough.

If you run Google Ads or Google Analytics 4 in the EU, UK, or EEA, there's a second layer on top of that consent decision. Google requires a technical signal called Consent Mode, telling it what the visitor agreed to before Google will process the remarketing or conversion data. No signal, or the wrong signal, and Google restricts what your account can do with that traffic. This is a requirement, not a substitute for the consent decision itself. You still need a real opt-in under GDPR and ePrivacy before anything fires. Consent Mode is how you tell Google what was decided, not how you decide it.

note:

Server-side tracking doesn't get you out of asking.

Ad blockers and browser privacy settings stop a lot of pixels from firing. The fix the industry sells is to move the reporting onto your own server, so your website sends the data to the ad platform directly instead of the visitor's browser sending it.
That solves a technical problem. It leaves the legal one exactly where it was. Whether you were allowed to collect the information has nothing to do with which machine transmits it.
A working setup blocks both. When someone declines, it has to stop the browser pixel and stop your server, and it has to keep working if they change their mind halfway through a visit. A banner that stops the pixel while your server keeps sending is a banner that does nothing.
Worth checking specifically, because server-side tracking is often sold as a way to "recover lost data" that ad blockers or browser settings would otherwise stop. Some of that "lost data" was never lost. It's data a visitor deliberately declined to share, and routing it through your server instead of their browser doesn't undo that decision. Recovering it anyway is the exact thing consent was supposed to prevent.

In the UK, under the Privacy and Electronic Communications Regulations, the standard is similar and it just moved. On 29 April 2026 the Information Commissioner's Office, the regulator that enforces this, updated its guidance to reflect three new consent exemptions for low-risk technologies that took effect on 5 February 2026. One of those covers statistical purposes, meaning first-party analytics used only to understand and improve your own site.

That exemption sounds like it covers your ad pixel. It doesn't. This one is genuinely confusing, so here it is slowly. The exemption covers analytics you use to understand and improve your own website, where the data stays with you. That's the whole scope of it.

An advertising pixel does something else. It sends data to an advertising platform to help decide who sees your ads. Different purpose, and the exemption doesn't reach it.

The part that catches people: one tool can do both jobs at once. If the same technology feeds your site analytics and your ad targeting, the exemption stops applying to it at all. Doing something exempt alongside something that isn't doesn't make the whole thing exempt.

Expect to hear "analytics doesn't need consent anymore" repeated confidently over the next year. It's true in a narrow case and wrong in the case most businesses are actually in.

In California, under the California Privacy Rights Act, the model differs again. It runs on opt-out rather than opt-in, treating this as sharing personal information for cross-context behavioral advertising. That comes with a required "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" link, and an obligation to honor browser-level opt-out signals like Global Privacy Control automatically, whether or not anyone clicks anything.

For a small business, the practical move is to skip the decision tree entirely. Build the consent gate once, to the stricter standard, and stop guessing which visitor triggers which rule. It costs about what doing it halfway costs, and it stops being something you think about.

A straightforward option to mention, since I use it when building some of my websites: you can track visitor activity without sending data to a third party. Cookieless, first-party analytics never leaves your own dashboard, identifies no individual, and never reaches an advertiser. That's genuinely the statistical-purposes case the UK exemption above was written for, and it's the reason a setup like that needs no consent banner at all. It solves a narrower problem than the pixel does, though. If you're running ads, you still need the pixel, and the pixel still needs everything covered above. Cookieless analytics removes one layer of the decision. It doesn't remove all of it.

Consent management platforms exist for what's left. Most of them handle the gating for you. CookieYes and CookieHub are two, both Google Certified CMP partners and IAB Transparency and Consent Framework certified. They're examples rather than endorsements. I have no relationship with either, and there are a dozen more.

Where to check for yourself. I'm not a lawyer and this isn't legal advice. These rules also change, and one of them changed three months before this was written, so treat anything you read about this, including this post, as accurate at a date rather than accurate permanently. If you operate outside the US, or you have meaningful traffic from somewhere you haven't checked, read the primary source instead of a summary of it.

Sources

Before you rely on any of it, have someone qualified look at your actual setup. This post is a starting point. It won't stand in for advice about your specific situation.

Marketing Isn't Mind Reading

Back to the discomfort, now that the mechanics are on the table.

Nobody in this profession can read minds. What a marketer can actually do is notice which version of a message reached people who were already looking for something like it, and then do more of that. That's the entire mechanism. It's less impressive than the industry suggests and less sinister than the reaction to it assumes.

Calling it a privacy question is fair. It is one. The answer is to stay inside the guidelines, keep people genuinely informed, and stay out of territory that feels wrong even when no law or regulation prohibits it.

The rules will always lag behind what the tools can do.

That gap is permanent. Regulation responds to technology, which means there will always be a window where something is possible, effective, and not yet addressed by any rule.
Compliance can't be the whole standard, then. It tells you what's currently prohibited, which is a moving line and always a step behind.
Here's the test that holds up in the meantime: if a tactic only works because the person doesn't understand what's happening, that's the line, whether or not anything prohibits it yet.

The alternative to measuring isn't privacy, though. It's guessing, which means more ads shown to more people who never wanted them. That's worse on every axis, including the one people are worried about. Better measurement usually means fewer and more relevant impressions.

Some marketing is built to sell something to a person who doesn't want it. That approach exists and it works often enough that people keep using it, so what follows is my position rather than a law of the universe. My goal is never to sell something to someone it wasn't built for. Anyone who has tried it the other way knows how badly it goes, and how expensive it gets on the far side, in refunds and bad reviews and clients who were never a fit. The job is to find the people it was actually built for. Reaching the wrong person is a failure at the work itself.

Which is why I don't think of measurement as manipulation, and don't build it that way. It's alignment. Tracking exists to make the match more accurate, not to make the pitch more forceful. The aim was never to reach everyone. It's to be unmistakable to the right ones.

Where the Line Is

It comes down to something simple enough to hold in your head.

Someone should know what's being collected and sent to advertisers. They should be able to say no. That no should actually work, including when they express it through a browser setting instead of a button, and including when honoring it costs you data you wanted.

When those three things are true, the exchange is honest. You get to be useful to the people who want what you do, and everyone else is left alone. That's a good trade, and it's the only version of this I'll build for a client.

None of which means staying quiet about the problem you solve. Plenty of people have a problem they haven't named yet, and putting words to it is a real service. Someone who has been losing leads for a year without knowing why is better off once they can see it.

The difference is direction. Naming a problem the person actually has, in language they'd recognize, is useful. Inventing urgency around a problem they don't have, or inflating one they do, is the other thing. The two can look identical on the page, and the reader can usually feel which one they're reading, which is a decent argument for staying on the right side of it even when nobody would catch you.

If you're setting this up and something about it feels off, that instinct is usually worth more than the compliance checklist. The checklist tells you what you're permitted to do. The instinct tells you what you'll still be comfortable having done in three years.

Getting the measurement right is worth doing before the spending starts. If you want a look at what's currently on your site and whether it's set up honestly, that's part of what the free brand and web audit covers.