GDPR-Compliant Facebook and Instagram Ads: A 2026 Guide for EU Businesses

Running GDPR compliant Facebook ads from the EU comes down to four things: the Meta Pixel and Conversions API only send data for visitors who agreed to advertising tracking, every customer list you upload has its own legal basis, nothing you send Meta reveals health, financial or other sensitive information, and your privacy notice explains your part in Meta's processing. Instagram follows the same rules, since both run through one Ads Manager and one set of Meta terms. This guide covers each piece as of October 2026.

1. Who is responsible for what

Many mistakes start with the belief that Meta "handles GDPR". In Fashion ID (C-40/17, 29 July 2019) the Court of Justice of the EU held that a website embedding a Facebook plug-in can be a joint controller with Facebook for collecting visitor data and sending it on, though not for what Facebook does afterwards. The site must inform visitors at collection and obtain any prior consent for its part. Meta's Business Tools Terms (effective 3 November 2025) and related terms now spell out the roles:

Activity	Your role	Meta Platforms Ireland's role	Governing terms
Pixel or Conversions API events used to target and deliver ads	Joint controller for collection and transmission	Joint controller for that step, independent controller afterwards	Business Tools Terms, Controller Addendum
Events used for campaign reports and analytics	Controller	Processor	Business Tools Terms, Data Processing Terms
Customer list for a Custom Audience	Controller	Processor that matches, then deletes	Customer List Custom Audiences Terms
Lead ad submissions	Responsible for using and protecting the leads	Runs the form	Lead Ad Terms

The Controller Addendum (effective 25 April 2023) is the joint controller arrangement GDPR Article 26 requires, and it comes with the Business Tools Terms rather than as a separate signature. It puts three duties on you: have a legal basis for the collection and transmission; tell people that Meta Ireland is a joint controller, which Meta tools you use and why, with a pointer to Meta's Privacy Policy; and forward any data subject request or regulator contact about the joint processing to Meta within seven calendar days, without answering on Meta's behalf. Meta handles access, deletion and similar rights for the data it stores after the transfer. Our explainer on data processing agreements for marketers covers how these contract types differ.

2. The Meta Pixel needs consent before it runs

Article 5(3) of the ePrivacy Directive allows storing or reading information on a visitor's device only with consent, unless strictly necessary for a service the visitor asked for. Ad measurement and audience building are not. Meta's contract follows suit: where the law requires consent for cookies and device storage, you must ensure "in a verifiable manner" that visitors consented before you use Meta's Business Tools. You also promise a prominent notice that third parties, including Meta, use pixels and similar technologies on your site, and how to opt out.

• Block or hold the Pixel. Load the base code only after the visitor accepts marketing cookies, or call fbq('consent', 'revoke') before fbq('init') on every page and fbq('consent', 'grant') after acceptance.
• Keep proof. "Verifiable" means you can show what the visitor saw, chose and when.
• Cover advanced matching. It adds email, phone, name or postcode to Pixel events, hashed with SHA-256 by the Pixel; the automatic version is enabled in Events Manager. Hashed contact details are still personal data, so they must not leave the browser for a visitor who declined.
• Name Meta. "Marketing partners" does not tell people that Meta Ireland is a joint controller.

For banner design, see our practical guide to GDPR cookie consent. A quick test of whether your banner really blocks the Pixel is in GDPR retargeting: what EU advertisers need in place.

3. The Conversions API follows the same rules

The Business Tools Terms list the Conversions API alongside the Pixel, the app SDK and offline conversions, so the same consent clause and joint controllership apply. Nothing on Meta's side stops a server event for a visitor who clicked "Reject"; the filter has to sit in your code. Our post on server-side tracking and GDPR covers hashed fields, why hashing is not anonymisation, and deduplication.

4. Custom Audiences and Lookalikes

Customer lists

Under the Customer List Custom Audiences Terms (effective 3 December 2025) you are the controller and Meta is your processor. Contact details are hashed before upload, and Meta deletes the list data after matching unless you choose optional features. You promise a lawful basis for using the data, and anyone who opts out after you built an audience must be removed from it.

Regulators read this more broadly than the contract. The European Data Protection Board's Guidelines 8/2020 on targeting social media users treat list uploads as joint controllership covering upload, matching, ad display and reporting. Either way, the original collection is yours alone, including whether people were told their details could be used for advertising on Meta. The retargeting guide above covers the legal basis and a recent French fine on this point; for the general choice, see legitimate interest vs. consent for ads.

Website Custom Audiences

Website audiences are built from Pixel and Conversions API events, so they inherit your consent setup. If the Pixel fired before consent, the audience holds people you had no right to add. Pick a retention period per audience that you can explain.

Lookalike audiences

Meta's developer documentation says a lookalike can be built from a Custom Audience of at least 100 people, with Meta modelling the characteristics of that source. A lookalike is only as clean as its seed: a list uploaded without a valid basis, or a seed that stands in for a sensitive group, carries the problem forward. With Advantage+ audience switched on, Meta can deliver beyond a lookalike you add; only constraints such as location, minimum age, language and custom audience exclusions stay fixed, as our complete guide to Facebook and Instagram advertising explains.

5. Restricted data in Meta's own rules

Some data may not be sent to Meta at all. Under the Business Tools Terms you promise not to share data that you know, or should know, is from or about children under 13, or that includes or is based on health, financial, consumer report or other sensitive information. The Customer List Custom Audiences Terms apply the same bans to the names and criteria of your audiences.

Meta's developer documentation says that from 2 September 2025 it began rolling out proactive restrictions: custom audiences, lookalikes and custom conversions that suggest a specific health condition (Meta's examples: "arthritis", "diabetes") or financial status ("credit score", "high income") are flagged and cannot be used in new campaigns. Meta advises switching to a non-affected audience or conversion.

• Health and wellness businesses. A URL or event name such as "booking-confirmed-knee-surgery" reveals health information by itself. Use neutral event names and strip revealing paths and query strings.
• Lenders, insurers, debt advisers. Audiences built around income, credit status or arrears are exactly what gets flagged.
• Ad copy. Meta's personal attributes policy bans ads that assert or imply a person's health, financial vulnerability, religion, sexual orientation or similar traits. "Struggling with your diabetes?" breaks it; "Diabetes care advice from qualified nurses" does not.

6. The Digital Services Act

The Digital Services Act (Regulation (EU) 2022/2065) bars platforms such as Facebook and Instagram from showing ads based on profiling that uses the special categories in GDPR Article 9(1), such as health, religion, ethnic origin, political opinions or sexual orientation (Article 26(3)), and from showing profiling-based ads to users they know with reasonable certainty are minors (Article 28(2)). These duties sit with Meta, but your inputs decide whether a campaign tries to cross the line, so do not plan audiences around sensitive traits or youth interests. Article 26(1) also requires each ad to show on whose behalf it is presented and, if different, who paid for it, so enter advertiser and payer details correctly, especially as an agency.

7. What Meta's EU user choices mean for advertisers

EU users choose how Meta uses their data for ads, separately from any consent you collect:

• November 2023: Meta offered a paid subscription for no ads, or free use with personalised ads.
• November 2024: Meta cut the web price from 9.99 to 5.99 euros a month and added free "less personalised ads", which Meta says use only the context of a session plus age, location, gender and how the person engages with ads.
• April 2025: the European Commission fined Meta 200 million euros under the Digital Markets Act for offering only "consent or pay" between March and November 2024.
• December 2025: the Commission acknowledged Meta's commitment to offer EU users, from January 2026, a choice between fully personalised ads and sharing less data for more limited personalisation, and said it would gather evidence on uptake.

Court rulings set the backdrop. In Meta Platforms v Bundeskartellamt (C-252/21, 4 July 2023) the Court held that personalised advertising cannot justify, as Meta's legitimate interest, processing the off-Facebook data at issue without consent, and that visiting sites revealing sensitive information does not make it "manifestly public". In Schrems (C-446/21, 4 October 2024) it held that data minimisation bars a social network from using all the data it obtains for targeted ads without limits on time or type.

• Meta's consent is not yours. A user who accepted personalised ads on Instagram must still accept your banner before the Pixel runs.
• Expect smaller EU audiences. Meta describes less personalised ads as using session context plus age, location, gender and ad engagement, which does not include your website or list data, so website and list audiences are unlikely to reach those users.
• Let the copy qualify the viewer. Say who the offer is for, what it costs and why it matters in the first line.

8. Lead ads

The Lead Ad Terms (last modified 10 October 2025) set the limits for instant forms:

• Using leads beyond the service behind the call to action, such as a newsletter, needs consent as necessary. Optional custom disclaimer checkboxes are the usual way to ask; Meta's API returns those answers separately from the form fields.
• Lead data may never be sold, and may only be passed on for the purpose it was collected for.
• No sensitive data or data prohibited by Meta's Advertising Standards, and no targeting of minors.
• Give people a way to contact you about their data, and keep appropriate security measures.

Ask only for the fields the next step needs, link a privacy policy that names lead ads as a source, and set a retention period for unconverted leads in your CRM.

9. Data transfers

Your contracts are with Meta Platforms Ireland, but Meta also processes data in the United States, and Meta Platforms, Inc. states it is certified under the EU-US Data Privacy Framework. On 3 September 2025 the EU General Court dismissed an action to annul the framework (Latombe v Commission, T-553/23). Mr Latombe appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P), so note the mechanism in your record of processing and check the appeal's status at each review.

10. Settings at a glance

Where	What to set or check	Why
Consent tool and Pixel code	Pixel off or in revoke mode until marketing consent	ePrivacy Art. 5(3); Business Tools Terms
Events Manager	Automatic advanced matching only under the same consent; neutral event and parameter names	Hashed data is personal data; sensitive data ban
Conversions API	Forward only consented events; drop revealing URLs and fields	No automatic consent gate
Ads Manager audiences	Legal basis recorded per list; objectors removed; no health or financial audiences	Custom Audiences terms; September 2025 restrictions
Instant forms	Minimal fields, privacy link, optional checkbox for extra uses	Lead Ad Terms
Privacy notice	Meta Ireland as joint controller, tools, purposes, retention, link to Meta's Privacy Policy, opt-out	Controller Addendum; Fashion ID

11. Common mistakes

• "Meta is compliant, so we are." Meta's terms put consent, notice and legal basis for your part on you.
• Pixel in the header, banner as decoration. The choice is recorded after the Pixel has already fired.
• A Conversions API that sends everything, including visitors who rejected tracking.
• Sensitive event or audience names built around treatments, conditions or credit products.
• Uploading the whole CRM, including people who objected or were never told about ad use.
• Lead ads feeding the newsletter without a separate opt-in.
• Copy that implies personal traits with "you" plus a condition or money problem.

12. Checklist: what to do this week

1. Reject cookies in a private window and confirm no Meta requests leave the browser.
2. Test that the Conversions API drops events for a rejected session.
3. Decide whether automatic advanced matching stays on, and document why.
4. Rename or retire events, custom conversions and audiences that hint at health or finances.
5. Record the legal basis for each customer list and remove objectors.
6. Update the Meta section of your privacy notice.
7. Write a procedure for forwarding Meta-related data requests within seven days.
8. Review every instant form and your live ad copy.

Where Adverizeo fits

Consent, events and audiences live in your consent tool and Ads Manager, not in Adverizeo. Adverizeo writes Facebook and Instagram ad copy within each placement's limits and gives every text ad a compliance score from 0 to 100 with suggestions, which helps catch wording such as implied personal attributes. It is a risk check, not a legal guarantee. Try the free GDPR ad checker, read our GDPR page, or start free. For the wider picture, see the complete guide to GDPR-compliant marketing for European SMEs.

This article is general information, not legal advice.