Free tool
GDPR Compliance Checker for Facebook Ads
Eight questions on the things EU regulators actually act on — pixel consent, Custom Audiences, lead forms and special-category targeting. Instant verdict, no signup.
Facebook and Instagram ads — GDPR check
Answer for the EU campaigns you are running right now
0 of 8 answered · runs in your browser, nothing is sent or stored
1.Does the Meta Pixel load only after the EU visitor has actively accepted marketing cookies?
2.Does your cookie banner offer a 'Reject all' option on the same layer, with the same prominence, as 'Accept all'?
3.Are you sure none of your audiences are built from health, religion, political opinion, ethnicity or sexual-orientation signals?
4.For every customer list you upload as a Custom Audience, can you show the lawful basis and the notice the contacts received?
5.Does every Meta lead form state who collects the data, what it is used for, and how long it is kept — before the user submits?
6.Can you produce a timestamped consent record for an individual EU user if a regulator asks?
7.Is your ad copy free of phrasing that implies you know something personal about the reader?
8.Can an EU user withdraw advertising consent as easily as they gave it, and does that actually stop the tracking?
Answer every question to get your verdict.
What the checklist covers
Where Facebook advertising meets GDPR
GDPR compliance for Facebook ads is decided in four places, and only one of them is inside Ads Manager. The pixel decides whether your audiences are lawfully built. The cookie banner decides whether the pixel consent is valid. The audience list decides whether you are processing special category data. And the copy decides whether you are advertising, in plain language, that you profile people.
Meta is a joint controller with you for parts of this — the CJEU settled that in Wirtschaftsakademie and Fashion ID — but joint controllership does not move your obligations onto Meta. You still owe the notice, the lawful basis, and the ability to demonstrate consent.
For the underlying rules, see our GDPR rules for Facebook ad copy and the deeper treatment of audience building in retargeting ads and GDPR compliance. If your ad was rejected rather than merely risky, start from Meta ad rejection reasons.
FAQ
GDPR and Facebook ads — questions
Are Facebook ads GDPR compliant by default?
No. Meta provides the advertising tools, but you are the controller for the personal data you feed into them — pixel events, Custom Audience uploads, and lead form submissions. GDPR compliance depends on your consent mechanism, your lawful basis, and your transparency notices, none of which Meta supplies for you.
Does the Meta Pixel need consent under GDPR?
Yes. The Meta Pixel stores and reads information on the user's device, which requires prior informed consent under the ePrivacy Directive, and it processes personal data for advertising, which requires a lawful basis under GDPR. EU regulators consistently treat advertising pixels as consent-only — legitimate interest is not accepted for them.
Are hashed customer lists safe to upload as Custom Audiences?
Hashing reduces exposure but does not remove the data from GDPR's scope: the hash is still used to identify an individual, so it is still personal data. You need a lawful basis for the disclosure to Meta and a privacy notice that told the contacts their data would be used this way.
What is the Article 9 risk in Facebook advertising?
Audiences built from health, religion, political, ethnic or sexual-orientation signals process special category data, which requires explicit consent under Article 9(2)(a). Retargeting visitors to a health product page is the most common way teams create this exposure without realising it.
Does this checker analyse my actual ad copy?
The checklist covers your setup — consent, audiences, lead forms and disclosures. To check the wording of the ads themselves, paste the copy into the free GDPR ad copy checker, which flags the specific sentences that create consent, transparency or special-category risk.
Check the copy, not just the setup
The checklist covers your configuration. Paste the ad itself into the free scanner to see which sentences create consent, transparency or special-category risk.