Cookie consent for ad pixel plugins

With Cookie Rocks Pro and Meta Pixel for WordPress, the held PageView gets an event ID starting with cr. After Accept all, the same ID was carried by the browser PageView (facebook.com/tr), by the event in the plugin's fbpix_release_signals request and by its Open Bridge request (?ob=open-bridge/events), on the first page and on the next one.

window.fbwcsignal.release() sends a WordPress nonce printed in the page (security parameter, checked with check_ajax_referer). A WordPress nonce expires after 12 to 24 hours, so on a page served from a cache older than that the release request is refused: this public release API is fragile with page caches.

Meta Pixel for WordPress loads only Meta services in the browser: an inline base code that loads connect.facebook.net/en_US/fbevents.js, an inline FacebookSignal.init call and the local file facebook_signal.js. Once started it also fetched signals/plugins/openbridge3.js and signals/config from connect.facebook.net. No other provider was contacted.

When Meta Pixel for WordPress releases held events through admin-ajax (action fbpix_release_signals), the PageView sent to its server has no event ID, while the browser PageView carries an Open Bridge ID (ob3_plugin-set_...). The plugin's Open Bridge request to the site (?ob=open-bridge/events) carries the browser's event ID, and its response sets a PHPSESSID cookie. Without a shared ID the Conversions API cannot match the two PageViews, so the page view can be counted twice, with any consent tool that uses the plugin's release.

Facebook for WooCommerce sets _fbp and _fbc from the server with setcookie() when they are missing, before any choice, unless its signals are held. The held state comes from the PHP filter facebook_signals_held (since 3.6.0) or the cookie wc_facebook_signals_state. While held, events are queued and no cookie is set; window.fbwcsignal.release() then sends the queue, and the page sets _fbp and _fbc from the values returned by the server.

When Meta for WooCommerce releases held events (POST to admin-ajax, action facebook_release_signals), the PageView it sends to its server carries the same event ID as the PageView the browser sends to facebook.com/tr. Without an access token, the release request fails with 'Plugin not configured.' and nothing is released.

Meta for WooCommerce releases held events only when it has an access token: without one, the release request answers 'Plugin not configured.' and nothing is released. With a token, its admin-ajax release waits for Meta's Conversions API before answering, so the pixel started 7 to 19 seconds after the click in our tests.

Meta Pixel for WordPress sets _fbp and _fbc (90 days) from the server, with a Set-Cookie header, on any page where they are missing, before any choice, even with no pixel ID checked. Holding scripts in the page does not stop it. Its hold state stops this Set-Cookie: the PHP filter facebook_signals_held or the cookie wc_facebook_signals_state=held; release() then sends the queued events and sets the cookies.

The TikTok for Business pixel (analytics.tiktok.com events.js, test pixel code, no TikTok account) is held by Cookie Rocks until consent; after Accept all it sets _ttp and keeps tt_sessionId, tt_pixel_session_index and tt_appInfo in session storage.

Meta pixel for WordPress 5.2.2 runs its PHP Parameter Builder when the plugin file is included and, when _fbp is missing, sends Set-Cookie _fbp (90 days) from the server on the first page, before any choice; _fbc (90 days) is set the same way when the URL has fbclid. A banner that blocks scripts cannot hold it. The only way off in the code is the held state (filter facebook_signals_held, or cookie wc_facebook_signals_state=held).

Meta pixel for WordPress has no consent setting and no WP Consent API code. It prints the base pixel code inline in wp_head, and fbevents.js still loads in the held state, where it calls fbq('consent','revoke'), skips fbq('init'), queues browser and Conversions API events and stops the server _fbp. window.fbwcsignal.release() sends the queue and sets _fbp and _fbc. With Conversions API on, an Open Bridge request opens a PHP session (PHPSESSID, 90 days), and events are sent from the server to graph.facebook.com in wp_footer unless held.

Meta for WooCommerce can hold Pixel and Conversions API events until consent: signals are active by default (no wc_facebook_signals_state cookie), and a consent plugin holds them with the PHP filter facebook_signals_held or window.fbwcsignal.hold(), then window.fbwcsignal.release(). While held, PHP writes no _fbp or _fbc, fbq('consent','revoke') is sent and events are queued, but fbevents.js still loads. The state cookie lasts 1 year. It does not read WP Consent API.

Meta for WooCommerce prints the Pixel as an inline snippet in wp_head that starts with if(f.fbq)return;, so a fbq function defined before it stops fbevents.js from loading. It keeps sent event IDs in sessionStorage wc_facebook_signals_seen_event_ids, adds a facebook.com/tr noscript image, and lets the filter wc_facebook_pixel_script_attributes change the script tag attributes. Nothing loads without a Meta connection and pixel ID.

When the shop is connected to Meta and signals are not held, Meta for WooCommerce sends Set-Cookie _fbp (90 days) from PHP on a visitor's first page, and _fbc when the visitor arrives with ?fbclid=. A consent plugin that only blocks scripts cannot stop it. It also loads Meta's Param Builder from cdn.jsdelivr.net (fallback unpkg.com) on every page, which writes _fbp and _fbc on the root domain unless wc_facebook_signals_state=held.

Pixel Caffeine's optional Conversions API sends events to graph.facebook.com from the site's server, on template_redirect and shutdown and through its REST route aepc/v1/fbq, without any consent check. No consent banner can hold these server events. It is off by default and needs a saved access token.

Pixel Caffeine 2.3.3 has no consent setting and no fbq('consent') call: as soon as a pixel ID is saved, it prints the Meta Pixel code (fbq('init') and fbevents.js) in an inline script on every page, in the head or the footer. It sets no cookie of its own; _fbp and _fbc come from Meta's script and the plugin only reads them. Its filter aepc_init_script_attributes can add type="text/plain" to the pixel tag.

When a TikTok account is connected, TikTok for Business sends a PageView to TikTok's Events API (business-api.tiktok.com) from the server on every page rendered by PHP, plus WooCommerce events, with the visitor's IP address, user agent, _ttp and ttclid, without checking consent. On init it saves ?ttclid= in a tiktok_ttclid cookie for 30 days, from the server. It has no consent setting and no WP Consent API support.

The ttq stub printed by TikTok for Business declares page, track, identify, enableCookie, disableCookie and other methods, but not holdConsent, grantConsent or revokeConsent, so those calls fail before events.js has loaded. The plugin also enqueues ajaxSnippet.js (handle tt4b_ajax_script) for add-to-cart events, which assumes ttq exists.