Works with your stack
Cookie consent for Meta Pixel for WordPress
the cookie comes from the server
Meta Pixel for WordPress adds the Meta pixel to every page. It also writes Meta’s cookies from your server, with the page itself, before the visitor chooses. A banner that only holds scripts cannot stop that part.
By Meta · facebook.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Meta pixel for WordPress
WordPress plugin
- Tested version
- 5.2.2
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 5.2.2 tested
- Active installs
- 400,000+
What Meta Pixel for WordPress adds to your visitors’ browser
Trackers it loads
- Meta Pixel →Marketing3 browser storage keys
Cookies seen in our test
wc_facebook_signals_state_fbpfr
Browser storage
fbpix_seen_event_ids
Also from your server Meta Conversions API once a Meta account is connected (access token). A banner holds what runs in the visitor’s browser. What Meta pixel for WordPress sends from your server is set in Meta pixel for WordPress itself.
What matters for consent with Meta Pixel for WordPress
Cookies written by the server
The plugin sends Meta’s cookies with the page, on the first visit, even before a pixel ID is set. They arrive before any banner script runs, so blocking scripts in the page does not help.
A held state
The plugin has one way to stop this: its held state. While held, the server writes no Meta cookie, the pixel does not start and events wait in a queue. When the visitor agrees, the queue is sent and the cookies are set.
Meta’s script still loads
Even when held, Meta’s script file is still loaded from Meta’s servers. The plugin has no consent setting of its own and does not read the WP Consent API.
Server events
With the Conversions API on, events also go to Meta from your server, and a PHP session cookie is opened. Both stop only in the held state.
Cookie Rocks with Meta Pixel for WordPress
- Holds the scripts it adds to your pages, such as tags, pixels or a chat, until the visitor consents. In advanced Consent Mode, Google’s tags load with consent denied instead.
What our tests found on Meta Pixel for WordPress
Good to know · Meta Pixel for WordPressWhat Meta Pixel for WordPress stores in visitors' browsers
Meta Pixel for WordPress: 1 cookie(s) or browser key(s) for visitors, recognised by Cookie Rocks from 2.9.8.
Name Kept in Category What it is for fbpix_seen_event_idssessionStorage Marketing Avoids sending the same event twice to Meta Read in its code, 2 November 2026, Meta Pixel for WordPress.
Full detail
Meta Pixel for WordPress can store these in a visitor's browser: fbpix_seen_event_ids (sessionStorage, marketing: Avoids sending the same event twice to Meta). Cookie Rocks recognises them from 2.9.8, with this category and purpose, and lists them in the cookie policy when it sees them.
Set before the choiceCookie Rocks Pro holds both Meta plugins, server cookies included
No _fbp or _fbc cookie is set and nothing goes to Meta before the choice. After consent, the held events are released once, without a reload.
Seen in our tests, 18 October 2026.
Full detail
With Cookie Rocks Pro, Meta Pixel for WordPress and Meta for WooCommerce set no _fbp or _fbc cookie from the server for a new visitor, even with fbclid in the address, and the page makes no request to facebook.com or connect.facebook.net before the choice, fbevents.js included. After Accept all or allowing the Meta Pixel service alone, the held events were released without a reload: one fbq('init'), a PageView, and _fbp, _fbc and wc_facebook_signals_state=active set by the page.
Set before the choiceCookie Rocks releases held Meta events on the same page after consent
The queued page view is sent, _fbp (and _fbc with fbclid) is set and the pixel starts once, without a reload. On next pages the server still sets no Meta cookie.
Seen in our tests, 18 October 2026.
Full detail
After Accept all, or after allowing the Meta Pixel alone, Cookie Rocks releases the held events of Meta Pixel for WordPress and Meta for WooCommerce on the same page, without a reload: the queued PageView is sent, _fbp (and _fbc with fbclid) is set, and fbq('init') runs once. On the next pages the server still sets no _fbp or _fbc cookie.
Set before the choiceWithdrawing consent removes Meta cookies set by both Meta plugins
With both Meta plugins, CookieRocks.rejectAll() after Accept all reloaded the page, removed _fbp and _fbc, and no request went to Meta afterwards.
Seen in our tests, 18 October 2026.
Good to knowWithdrawing consent removes Meta cookies and the signal state cookie
After Reject all, the page reloaded and removed _fbp, _fbc and wc_facebook_signals_state. Only the consent cookie stayed, and nothing went to Meta afterwards.
Seen in our tests, 18 October 2026.
Full detail
With Meta Pixel for WordPress or Meta for WooCommerce, CookieRocks.rejectAll() after Accept all reloaded the page and removed _fbp, _fbc and wc_facebook_signals_state; only the consent cookie stayed on the site and no request went to Meta afterwards. On a plain page without a Meta plugin, the purge list of the page (crConfig.pg) is absent.
Good to know · Meta Pixel for WordPressCookie Rocks gives held Meta page views one shared event ID
With Meta Pixel for WordPress, the browser and server events carry the same ID starting with cr, on the first page and the next one.
Seen in our tests, 18 October 2026, Meta Pixel for WordPress 5.2.2.
Full detail
With Cookie Rocks Pro and Meta Pixel for WordPress, the held PageView gets an event ID starting with cr. After Accept all, the same ID was carried by the browser PageView (facebook.com/tr), by the event in the plugin's fbpix_release_signals request and by its Open Bridge request (?ob=open-bridge/events), on the first page and on the next one.
See the 7 other findings
Good to know · Meta for WooCommerceMeta for WooCommerce release can fail on pages cached too long
It sends a WordPress security code that expires after 12 to 24 hours, so the release is refused on a page cached longer than that.
Read in its code, 18 October 2026, Meta for WooCommerce 3.7.8.
Full detail
window.fbwcsignal.release() sends a WordPress nonce printed in the page (security parameter, checked with check_ajax_referer). A WordPress nonce expires after 12 to 24 hours, so on a page served from a cache older than that the release request is refused: this public release API is fragile with page caches.
Good to know · Meta Pixel for WordPressMeta Pixel for WordPress contacts only Meta
It loads fbevents.js and its own signal file, then fetches more files from connect.facebook.net. No other provider was contacted.
Seen in our tests, 18 October 2026, Meta Pixel for WordPress 5.2.2.
Full detail
Meta Pixel for WordPress loads only Meta services in the browser: an inline base code that loads connect.facebook.net/en_US/fbevents.js, an inline FacebookSignal.init call and the local file facebook_signal.js. Once started it also fetched signals/plugins/openbridge3.js and signals/config from connect.facebook.net. No other provider was contacted.
Good to know · Meta Pixel for WordPressMeta Pixel for WordPress sets a PHPSESSID cookie through Open Bridge
Once the pixel runs, Meta Pixel for WordPress sends each event to the site itself through Open Bridge (POST to ?ob=open-bridge/events), and the response to that request sets a PHPSESSID session cookie.
Seen in our tests, 18 October 2026, Meta Pixel for WordPress 5.2.2.
Depends on a setting · Meta Pixel for WordPressMeta Pixel for WordPress release can count a page view twice
Released events reach the server without the browser's event ID, so Meta cannot match them. This happens with any consent tool that uses the plugin's release.
Seen in our tests, 18 October 2026, Meta Pixel for WordPress 5.2.2.
Full detail
When Meta Pixel for WordPress releases held events through admin-ajax (action fbpix_release_signals), the PageView sent to its server has no event ID, while the browser PageView carries an Open Bridge ID (ob3_plugin-set_...). The plugin's Open Bridge request to the site (?ob=open-bridge/events) carries the browser's event ID, and its response sets a PHPSESSID cookie. Without a shared ID the Conversions API cannot match the two PageViews, so the page view can be counted twice, with any consent tool that uses the plugin's release.
Sent from your server · Meta Pixel for WordPressMeta Pixel for WordPress sets _fbp and _fbc from the server before the choice
The server sets these Meta cookies before any choice, even with no pixel ID, so holding the scripts in the page does not stop them. Only the plugin's hold state does.
What to do: A consent banner can keep wc_facebook_signals_state=held (window.fbwcsignal.hold()) until marketing consent.
Read in its code, 17 October 2026, Meta Pixel for WordPress 5.2.2.
Full detail
Meta Pixel for WordPress sets _fbp and _fbc (90 days) from the server, with a Set-Cookie header, on any page where they are missing, before any choice, even with no pixel ID checked. Holding scripts in the page does not stop it. Its hold state stops this Set-Cookie: the PHP filter facebook_signals_held or the cookie wc_facebook_signals_state=held; release() then sends the queued events and sets the cookies.
Set before the choice · Meta pixel for WordPressMeta pixel for WordPress sets _fbp from the server before any choice
_fbp (90 days) is set on the first page, and _fbc (90 days) when the address has fbclid. A banner that blocks scripts cannot hold it. Only the plugin's held state stops it.
Read in its code, 16 October 2026, Meta pixel for WordPress 5.2.2.
Full detail
Meta pixel for WordPress 5.2.2 runs its PHP Parameter Builder when the plugin file is included and, when _fbp is missing, sends Set-Cookie _fbp (90 days) from the server on the first page, before any choice; _fbc (90 days) is set the same way when the URL has fbclid. A banner that blocks scripts cannot hold it. The only way off in the code is the held state (filter facebook_signals_held, or cookie wc_facebook_signals_state=held).
Good to know · Meta pixel for WordPressMeta pixel for WordPress has no consent setting; its held state queues events
- No WP Consent API code; the pixel code is printed directly in the page.
- In the held state, fbevents.js still loads, sends a revoke, skips init and queues events.
- Releasing the queue sends the events and sets _fbp and _fbc.
- With Conversions API on: PHPSESSID (90 days), and server events to graph.facebook.com unless held.
Read in its code, 16 October 2026, Meta pixel for WordPress 5.2.2.
Full detail
Meta pixel for WordPress has no consent setting and no WP Consent API code. It prints the base pixel code inline in wp_head, and fbevents.js still loads in the held state, where it calls fbq('consent','revoke'), skips fbq('init'), queues browser and Conversions API events and stops the server _fbp. window.fbwcsignal.release() sends the queue and sets _fbp and _fbc. With Conversions API on, an Open Bridge request opens a PHP session (PHPSESSID, 90 days), and events are sent from the server to graph.facebook.com in wp_footer unless held.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Meta pixel for WordPress 5.2.2, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Its own tags, set with a test ID, do not load before the choice and load after “Accept all”.
- Settings of the test: Meta Pixel ID (test value), no Meta account connected.
- Last run: Meta pixel for WordPress 5.2.2 on 7 November 2026, with WordPress 7.1.3.
Analytics and ad pixels
Other plugins of the same kind.
Questions
What does Cookie Rocks hold here?
Cookie Rocks holds known trackers such as the Meta Pixel until consent. Cookies sent by the server with the page are outside what a banner in the browser can hold: only the plugin’s held state stops them.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with the Meta pixel
Ask first, then let Meta in.
advertising waits for a yes
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.