Tracking Pixels: Meta, TikTok, Google & the Risk

First-party vs third-party, the four consent categories, and the strange ones — super, flash and zombie cookies — in plain English. Plus the 2026 twist most guides get wrong: third-party cookies didn’t actually go away.

Session replay tools record what your visitors do — every click, scroll, and keystroke — and that makes session replay GDPR compliance a real obligation, not a checkbox. The tools themselves are perfectly legal. What gets sites in trouble is when the recording starts. This guide covers exactly what the EU requires for Hotjar, Microsoft Clarity and FullStory, where each one stands, and the US wiretapping risk that most GDPR guides never mention.

A cookie declaration is the one privacy document that makes a specific, checkable claim: “these exact trackers run on this site.” That precision is its whole value — and its weakness. Because the trackers on your site change constantly, a declaration is accurate the day it’s made and quietly wrong not long after. Here’s what a declaration actually is, why it drifts, and how to keep it true.

In May 2025, Ireland’s Data Protection Commission fined TikTok €530 million — and the reason matters for every EU site running the pixel. This wasn’t about a cookie banner. It was about where EU data ends up. If you run the TikTok Pixel on a site with European visitors, you’re wiring your traffic into the exact data flow regulators just penalised. Here’s what that means, and what to do about it.

A consent banner tells you what should happen. Compliance tracking software tells you what actually fires on your site — before consent, after opt-out, and every time a new tag sneaks in. In 2026, that gap between intention and behavior is exactly where the lawsuits live.

HubSpot is the all-in-one marketing platform agencies deploy on hundreds of client sites. Its tracking code fires on page load by default. Its native consent banner — even after the May 2026 v2 migration — is designed as a notification tool, not a consent gate. And HubSpot is now explicitly named in active CIPA demand letters. Here’s exactly where the gaps are, which configurations are vulnerable, and what agencies need to fix for every client running HubSpot.

Microsoft Bing UET is named as a pen register in Camplisson v. Adidas (November 2025). Microsoft Clarity and the Bing UET tag together generated a $10 million CIPA settlement for Forbes in May 2026. Most agencies treat Microsoft as the safe, enterprise-grade tracking option. The case law says otherwise. Here’s what each tool captures, why the CIPA exposure is real, and the specific configuration changes agencies need to make across every client running Bing Ads or Clarity.

The Meta Pixel consent requirements vary by legal framework, visitor geography, feature set, and page type. What CIPA requires is different from GDPR. What Advanced Matching requires is different from the base pixel. What checkout pages require is different from blog pages. This article maps every scenario agencies actually manage — precisely, with case law to back each requirement.

In April through August 2025, three courts dismissed CIPA claims against the TikTok Pixel. In November 2025, a federal court in Camplisson v. Adidas found the TikTok Pixel could plausibly qualify as a pen register under CIPA — explicitly rejecting the earlier cases. The result is a genuine circuit split that leaves agencies running TikTok Ads on client sites in a legally uncertain but practically urgent position. Here’s the full picture.

Short answer: yes. But “cookie consent” is actually the wrong frame for US businesses. The Meta Pixel creates legal exposure under a 1967 California wiretapping law — not just cookie regulations — and the consent standard it requires is stricter, more specific, and far more technically demanding than the banner most agencies have installed. Here’s what’s actually required, what isn’t enough, and what happens when you get it wrong.

Most agencies treat Google Analytics as the “safe” tracker — lower profile than Meta Pixel, owned by Google, surely fine. In 2024, a court named Google Analytics specifically in a CIPA claim and let it proceed. In 2025, a Blue Shield of California misconfiguration sent 4.7 million patients’ health data to Google Ads for three years. Google Analytics has a CIPA exposure profile that’s different from Meta Pixel — and in some ways more insidious. Here’s what agencies need to know.

There are 1,919 apps in the Shopify App Store when you search “meta.” Trackify. Omega Pixel. CAPI Facebook Pixel Meta API. Parkour. Every single one installs pixels. Not one of them is a consent management platform. Installing a pixel app does not make your store CIPA-compliant. Here’s the gap most Shopify merchants don’t know exists — and what actually closes it.

Agencies buy pixel management apps through Shopify partner accounts and roll them out across dozens of client stores simultaneously. The clients assume the agency handled compliance. The agency assumes the app handles compliance. Nobody installs the CMP. The CIPA demand letter arrives at the client’s door — but under California’s aiding-and-abetting clause, the agency that deployed the configuration may be in the chain of liability too. Here’s the exposure and what to do about it across your entire Shopify portfolio.

You already know the Meta (Facebook) Pixel creates CIPA exposure if it fires before consent. This article is about fixing it — the exact configuration steps, in the right order, for every client site you manage. GTM consent mode, CMP wiring, Advanced Matching controls, GPC propagation, page exclusions, and a printable per-client audit checklist.

The Meta Pixel itself is not illegal. The default configuration, firing on page load before any visitor consent, is what courts are treating as potentially unlawful. Here’s precisely where the line is, why it matters for every client site you manage, and what makes a deployment defensible versus exposed.

Home › Blog › Cookie Consent Lawsuits › Meta Pixel Lawsuit Tracking Pixel · CIPA & Legal Risk Meta Pixel