Tracking pixel: what it is and how to spot one on your site

A tracking pixel is a tiny, usually invisible image or script on a page that makes your visitor’s browser call another company’s server. That call is the point. It tells the other company who turned up, on which page, and often what they did.

Most small websites have at least one. It arrived with an ads account, a newsletter tool or a plugin, and nobody has looked at it since. This post covers what a tracking pixel is, what it can send, what regulators in the EU, UK and US have done about pixels, and how to find the ones on your own site from your phone.

What a tracking pixel is

The name comes from the original trick: a one-by-one pixel image, transparent, placed somewhere on the page. The browser has to fetch that image from wherever it lives, and the fetch itself is the message. The server at the other end logs the request, the time, the page it came from and the browser’s details.

The European Data Protection Board describes it plainly. A tracking pixel is a hyperlink to a resource, usually an image file, whose sole purpose is to make the browser open a connection to the pixel’s host, one that would otherwise not have happened.

Pixels have grown since then. The FTC’s Office of Technology notes that they have evolved from tiny images into a broad range of HTML and JavaScript embedded in websites and email. The “pixel” you install today is usually a script that loads the image and much more.

A tracking pixel example

Take the Meta Pixel, since it’s the one most shops have. You paste a short script into your site’s head. On every page, it loads a small image from Meta and reports a PageView event with the page address and an identifier for the browser. You can add events: ViewContent on a product, AddToCart, Purchase with a value. Google Ads, TikTok, LinkedIn, Pinterest and Snap all offer the same shape under different names.

An email pixel works the same way. The newsletter tool puts a one-pixel image in each message, with a code unique to the recipient. When the image loads, the tool marks the email as opened.

What a pixel can send

The FTC’s technologists listed what they’ve seen pixels collect: how a person interacts with a page, including specific items purchased, information typed into forms while on the site, and identifiers that let a platform match the visit to a social media profile. They add that hashing a name or email before sending it may not help much, because hashes can be reversed or used to link records across databases.

The EDPB makes a similar point from the other direction. Pixels on websites may link to one company collecting many such requests, and that company can then track users’ behaviour across all of them. Extra identifiers and page details can ride along in the link.

The page address alone can say a lot. On a shop it names the product. On a clinic’s site it can name the condition.

Is pixel tracking allowed?

People type “is pixel tracking legal” into Google. It depends on where the visitor is, when the pixel fires and what it carries.

In the EU, the rule is Article 5(3) of the ePrivacy Directive. The EDPB’s 2024 guidelines say the article does not exclusively apply to cookies, but also to similar technologies, and they work through tracking pixels as a named case. Sending a pixel to a browser counts as storage, at least through the browser’s cache, and reading the identifier back counts as gaining access. The Court of Justice has said the protection applies regardless of whether the information is personal data. So an advertising or analytics pixel waits for consent, with narrow exceptions for what the visitor actually asked for.

In the UK, PECR regulation 6 does the same job. The ICO lists tracking pixels, scripts and tags alongside cookies as storage and access technologies, and says regulation 6 applies whenever a script or tag stores or reads information on a device. On advertising, the ICO is direct: the use of storage and access technologies for online advertising purposes requires consent, because on a technical level the service can be provided without any advertising. Its guidance on exceptions adds that there are no advertising purposes that meet the strictly necessary exception. Since February 2026 regulation 6 also covers whoever instigates the storage or access, which may reach the pixel’s vendor as well as you. No published decision has tested that yet.

In the US, there’s no general consent rule for pixels. The FTC acts under its own Act when a pixel contradicts a privacy promise, or sends health information to an ad platform. California’s privacy law adds an opt-out that has to work. The posts on cookie consent in the USA and the CCPA checklist cover that side.

Four decisions about pixels

Regulators have written about pixels in plain terms. These four show the pattern: the pixel fired early, or the pixel sent too much.

A pixel firing before the banner was answered

On 17 September 2024 the ICO announced a reprimand to Bonne Terre Limited, trading as Sky Betting and Gaming. Between 10 January and 3 March 2023, the company shared people’s data with advertising technology companies as soon as they accessed the SkyBet website, before they could accept or reject advertising cookies. The ICO’s reprimand describes a pixel from an advertising platform setting around 40 third-party marketing cookies before the visitor had set a preference. The company fixed it in March 2023. No fine followed, but the finding was that the processing was not lawful, transparent or fair.

A pixel on treatment pages

On 11 April 2024 the FTC announced a proposed order against Monument, an alcohol addiction treatment service. The complaint alleged that from 2020 to 2022 the company placed tracking pixels and APIs on its website that sent users’ personal and health information to Meta, Google and other ad platforms. Custom event names such as “Paid: Weekly Therapy” went out alongside email addresses and IP addresses, so the recipient could tie the event to a person. Up to 84,000 users were affected. Monument had told users their information was “100% confidential”. The order bans disclosing health information for advertising; a $2.5 million penalty was suspended because the company couldn’t pay it.

A banner that didn’t switch the trackers off

On 1 July 2025 the California Attorney General announced a $1.55 million settlement with Healthline Media. The complaint alleged that the site’s consent banner did not disable tracking cookies, despite purporting to do so, that opt-outs of targeted advertising weren’t honoured, and that article titles suggesting a diagnosis were shared to target ads. The settlement requires the opt-out to work and bars sharing those titles.

Advertising trackers that ignored Refuse all

On 1 September 2025 the CNIL fined the SHEIN group’s Irish company €150 million. It found that advertising cookies were placed on visitors’ devices as soon as they arrived on the site, before they interacted with the banner, and that clicking Refuse all still led to new cookies being placed. The decision is about cookies, but the trackers that set them are the same ad scripts a pixel install brings in.

How to check if a pixel is on your website

You don’t need a tool. A phone and ten minutes will do.

1. List your ad and email accounts. Meta, Google Ads, TikTok, LinkedIn, Pinterest, Snap, and your newsletter tool. Each one that offers a “pixel”, “tag” or “insight tag” has probably put one on your site.
2. Open your site in a private window. Don’t touch the cookie banner. Browse three pages, including a product or service page.
3. Look at the ad account. In Meta, open Events Manager and the test or recent activity view. In Google, open the tag’s recent events. If your visit is there, the pixel fired before anyone said yes.
4. Go back and press Reject. Browse again. Check the account again. A visit recorded after Reject is the Healthline pattern.
5. Read your banner’s partner list. Does it name the companies whose pixels you found? The ICO expects you to name third parties clearly, even when their tag looks like it comes from your own domain.
6. Walk your sensitive pages. Health, debt, legal trouble, fertility, addiction. Does the page address or an event name describe the visitor’s situation? That’s what Monument’s event names did.
7. Check your email tool. Find the open-tracking setting. If it’s on, every newsletter carries a pixel, and your privacy notice should say so.

If you’re on Android or a laptop, there’s one more step: put view-source: in front of your address and search the page for facebook.com/tr, fbq, gtag, googletagmanager, ttq, lintrk or snaptr. Each hit is a pixel or tag. The post on how to check website cookies goes further with the browser’s own tools.

What to do with what you find

Most fixes are small. Wire each pixel to your consent tool so it loads only after a yes; the consent mode post covers the Google side. Make sure Reject stops it rather than just hiding the banner. Name every pixel’s company in the banner and in your cookie notice, and say how long its cookies last. Take ad pixels off pages where the address alone describes a visitor’s health or trouble. Turn off email open tracking unless you tell people about it.

For what the cookies a pixel sets actually do, the types of cookies on websites post sorts them out.

Peeky reads the public pages of your site. For pixels and trackers that fire before consent, the checks are EU-01 and UK-05 in the Handbook, and US-12 for ad tools on pages about health.

Questions people ask

Is pixel tracking legal?

It depends on when the pixel fires and what it sends. In the EU and UK, a pixel used for advertising or analytics waits for consent, because the ePrivacy rules cover any technology that stores or reads information on a device, and the EDPB says a tracking pixel falls within Article 5(3). In the US there is no general consent rule, but the FTC has acted when a pixel sent health details or contradicted a privacy promise.

Can you give me an example of a tracking pixel?

The Meta Pixel is the one most small sites have. It's a short script that loads a one-pixel image from Meta's servers when a page opens, and sends along the page address, a browser identifier and any events you set up, like a purchase. The FTC's technologists describe pixels that can also capture information typed into forms.

How do I check if a Facebook pixel is on a website?

On your own site, the quickest route is your Meta Events Manager: open your site in a private window on your phone, don't touch the banner, then look at whether Events Manager recorded the visit. On Android or a laptop, add view-source: before the address and search the page for facebook.com/tr or fbq. The phone check in this post walks through it.

Does a tracking pixel count as a cookie?

Not quite, but the rules treat it the same way. A cookie is a file the browser keeps; a pixel is a request the browser sends. The ICO lists tracking pixels, scripts and tags alongside cookies as storage and access technologies, and PECR regulation 6 applies to all of them.

Can I keep a pixel on my health or symptom pages?

Regulators have been strict here. In 2023 the FTC and the US health department wrote to hospitals and telehealth firms about the Meta Pixel and Google Analytics sending identifiable information from health pages. The FTC's Monument case in 2024 was about exactly that. Keeping ad pixels off those pages is the simplest answer.