Pinterest Ads GDPR Compliance: A Practical Guide for EU Businesses

Pinterest Ads GDPR compliance for EU advertisers starts with a contract most teams never open: the Pinterest Advertising Services Agreement with Pinterest Europe Ltd., its Joint Controller Addendum, and the Ad Data Terms, which change on 12 November 2026. Those documents decide who answers for the Pinterest Tag, the Conversions API and customer lists. This guide covers each one, the targeting rules Pinterest applies, and the DSA transparency rules that make your ads public, with a settings table and checklist as of October 2026.

For the cross-channel basics, see our complete guide to GDPR-compliant marketing for European SMEs.

1. The contract: joint controllers for the Tag, independent controllers for the rest

The EMEA version of the Pinterest Advertising Services Agreement is concluded with Pinterest Europe Limited in Dublin. It attaches a Data Sharing Addendum (Exhibit A), a Joint Controller Addendum (Exhibit B), US state privacy terms (Exhibit C), and incorporates the separate Ad Data Terms. The agreement also says that if you use conversion tracking or any Pinterest technology that stores or reads cookies, you must give clear notice and get any consent the law requires, both for your use and for Pinterest's.

The role split is narrower than many advertisers assume:

Activity	Your role	Pinterest's role	Governing document
Collecting and sending activity data via the Tag, a Pinterest API or a similar feature	Joint controller	Joint controller (Article 26 GDPR)	Joint Controller Addendum
What Pinterest does with that data afterwards	Not involved	Independent controller	Data Sharing Addendum
Customer list uploads and all other ad data	Independent controller	Independent controller	Data Sharing Addendum and Ad Data Terms

Two points stand out. First, Pinterest does not act as your GDPR processor for any of these, so on our reading of the addendum a customer list upload is a disclosure to another controller. Your privacy notice should say so, and your legal basis has to cover it. Second, if someone exercises GDPR rights against you about the joint processing, or a regulator contacts you about it, you must forward the request to Pinterest promptly and within seven calendar days at most, and you may not answer on Pinterest Europe's behalf. Build that into your data subject request process. For the paperwork side, see our explainer on data processing agreements for marketers.

What changes on 12 November 2026

Pinterest has published updated Ad Data Terms that take effect on 12 November 2026. The points that matter most for EU advertisers:

• "Activity Data" is defined to include HTTP header information such as IP address, user agent, country and language, alongside site and app activity.
• Where the law requires consent for device storage or access, naming the EU as an example, you must have obtained it "in a verifiable manner".
• Pinterest data you receive that can identify a user, household or device (for example reporting linked to an IP address) may only be used to evaluate your campaigns, may not be combined with personal data or shared, and must be deleted or anonymised within six months at the latest.
• Pinterest data may not be used to train AI or machine-learning models.
• Agencies warrant they are authorised to share data for their clients, and Pinterest may ask for reasonable evidence of compliance.

"Evidence on request" is the practical bit: make sure your consent tool keeps logs you can export.

2. The Pinterest Tag: gate the script and its noscript pixel

Pinterest's help centre is direct about this: if you operate in the EU, you must obtain legally compliant consent before sending any events to Pinterest. That matches the EDPB's Guidelines 2/2023 (version 2.0, adopted 7 October 2024), which treat tracking pixels as covered by Article 5(3) of the ePrivacy Directive even when nothing is stored long term.

The standard base code, copied from Ads Manager under Conversions, then Tag manager, does two things: a script loads core.js from s.pinimg.com, and a noscript image calls ct.pinterest.com for browsers without JavaScript. A consent tool that blocks the script but leaves the noscript image in your HTML still lets that request through for those visitors, so remove the fallback or render it only after consent.

Pinterest also provides a consent call, pintrk('setconsent', true) or false. According to the base code help page, true means events are sent and first-party cookies and storage are set; false means events are not sent and first-party cookies and storage are deleted. This is useful when a visitor withdraws consent mid-session. It does not replace gating, because the call only works once the Pinterest script has already loaded from Pinterest's servers. A separate fp_cookie: false option stops first-party cookies, which is a measurement choice and does not remove the need for consent.

Enhanced match adds a hashed email (the em parameter) so Pinterest can match conversions without a Pinterest cookie, including cross-device checkouts. Hashed or not, it is personal data. It is enabled under Conversions, then Event quality, and the tag set-up flow also offers automatic enhanced match, so check which is on. Send emails only for consenting visitors and mention it in your privacy notice.

The Ad Data Terms also require telling visitors that their information is shared with third parties for online behavioural advertising and that they can opt out via their Pinterest personalisation settings, the AdChoices site or their mobile ad ID settings. In the EU that text sits on top of your consent banner, not instead of it. Our cookie consent guide covers banner design.

3. Conversions API: same consent, and the LDP flag is not a GDPR switch

The Pinterest Conversions API sends web, in-app and offline conversions server to server, using a token generated on the Conversions page. Pinterest asks for sending within an hour and an event_id to deduplicate against the Tag. Legally, API data is part of the same joint processing as the Tag: store the consent decision with each session or order and send identifiers only where it is positive. Offline conversions from in-store sales need their own legal basis and notice, for example in your loyalty terms. Our article on server-side tracking and consent explains why moving the call to your server changes nothing legally.

A Pinterest-specific trap is the Limited Data Processing (LDP) flag. Pinterest designed it for US state privacy laws under its US State-Specific Data Terms: for flagged data from users covered by those laws, Pinterest acts as a service provider or processor. It does not apply to customer lists, and it is not a GDPR mode. Setting it for EU visitors neither replaces consent nor makes Pinterest your GDPR processor.

4. Audiences: site visitors, customer lists and actalikes

Site visitor audiences are built under Audiences, then Create audience, then Site visitors, where you pick a conversion source, a look-back window in days and, optionally, past traffic. They are only as lawful as the Tag consent behind them, so a correct banner protects your retargeting pool as well.

Customer list audiences take a single-column CSV of email addresses or mobile ad IDs. Pinterest hashes the list on upload, it cannot be downloaded again, and it needs at least 100 matches before you can use it. Lists do not refresh on their own unless connected to a CRM through a Pinterest API partner, so withdrawals must be removed manually with Edit, then Remove people. Pinterest's own rules forbid lists based on user activity from an app or website on an iOS device, and lists containing people who opted out of targeted advertising.

The bigger risk is consent at collection. On 30 December 2025 the CNIL fined a company €3.5 million for sending loyalty-programme members' emails and phone numbers to a social network for ad targeting without valid consent: the sign-up form never mentioned it, and no data protection impact assessment had been done. Before uploading, check that your collection wording names advertising on social platforms, ideally with its own unticked checkbox.

5. Targeting rules that matter in Europe

Pinterest's advertising guidelines ban targeting based on sensitive health or medical conditions, race or ethnic origin, personal hardship, religious or philosophical beliefs, sexual behaviour, orientation or gender identity, criminal records, trade union membership and political opinions. Proxies for these are banned too. You also cannot target ads to anyone under 18. These rules map closely onto two DSA duties for platforms: Article 26(3), which bans ads based on profiling with special-category data, and Article 28(2), which bans profiling-based ads to users known to be minors.

Ads for credit, employment and housing face extra limits in some markets: no actalike, age, gender or postal code targeting, and no excluding protected groups. Pinterest also does not accept political campaign ads, including ads designed or likely to influence voting in the EU or the outcome of a referendum or legislative process. On the user side, Pinterest requires users to be at least 13, and older where national law sets a higher age of digital consent.

6. Pinterest's own consent question

On 22 October 2024 the privacy group noyb filed a complaint with the CNIL alleging that Pinterest switches ad personalisation on by default for EU users and relies on legitimate interest rather than consent, citing the CJEU's 2023 judgment in case C-252/21 (Meta v Bundeskartellamt). The complaint also alleges an incomplete reply to an access request. Check the CNIL's and noyb's sites for the current status before citing an outcome.

For advertisers, the lesson is simple: a user's settings inside Pinterest are not consent on your website. Whatever happens to Pinterest's own legal basis, the Tag and Conversions API on your properties need your own valid consent.

7. The Ads Repository: what the public can see

Pinterest is designated a very large online platform under the DSA, with Pinterest Europe Ltd. as its EU establishment and Ireland as its Digital Services Coordinator. Article 39 therefore requires a public repository of every ad shown in the EU, kept while the ad runs and for a year after it was last shown, including the content, the advertiser, the payer if different, the dates, the main targeting parameters and reach. Pinterest's Ads Repository at ads.pinterest.com/ads-repository can be filtered by dates, ad category, country, gender, age and advertiser name.

Many repository entries show full product titles and descriptions. If you run shopping ads from a catalogue, that feed text is ad copy the public can read, so health, environmental or price claims in it deserve the same review as any headline.

8. Transfers and your privacy notice

Under the Data Sharing Addendum, Pinterest Europe Ltd. receives ad data that originates in the EEA, Switzerland or the UK, and each party must cover its own transfers outside those areas with a valid mechanism. Pinterest's privacy policy names Pinterest Europe Ltd. and Pinterest, Inc. as joint controllers for European users, and an updated policy takes effect on 12 November 2026. Your own notice should name Pinterest Europe as joint controller for Tag and API data, state the purposes, link Pinterest's privacy policy, and explain how to opt out.

Pinterest Ads settings for EU campaigns

Setting	Where	Recommended for EU traffic
Tag base code	Ads Manager, Conversions, Tag manager; fired by your consent tool	Load only after marketing consent
noscript fallback	Your HTML template	Remove, or render only after consent
setconsent	Tag code	True after opt-in, false on withdrawal
fp_cookie	Tag load options	Measurement choice; consent still required
Enhanced match (manual and automatic)	Conversions, Event quality	Consenting visitors only, disclosed in your notice
Conversions API	Your server or a partner; token from the Conversions page	Same consent gate; event_id for deduplication
LDP flag	Tag or API parameter	US state laws only; not a GDPR setting
Customer lists	Audiences, Create audience, Customer list	Ad-specific consent at collection; remove withdrawals
Targeting	Ad group targeting	No under-18s, no sensitive categories or proxies

Common mistakes

• Blocking the Tag script but leaving the noscript image in the page template.
• Treating setconsent as a substitute for not loading the Tag before a choice.
• Switching on the LDP flag for EU users and calling it GDPR compliance.
• Uploading a newsletter list whose sign-up form only promised emails.
• Forgetting that withdrawals do not leave a customer list unless you remove them.
• Writing catalogue descriptions without the claim checks you apply to ad headlines.

Checklist: what to do this week

1. Decline your banner in a private window and confirm in the network tab that nothing reaches s.pinimg.com or ct.pinterest.com.
2. Search your templates for the noscript Pinterest image and fix it.
3. Check whether manual or automatic enhanced match is on, and that it only runs after consent.
4. Confirm your Conversions API integration drops identifiers for declined sessions.
5. Add Pinterest Europe's joint controller role and the seven-day request forwarding duty to your privacy and DSAR processes.
6. Review every customer list against its collection wording and remove withdrawals.
7. Read the 12 November 2026 Ad Data Terms and set up exportable consent logs.
8. Look up your brand in the Ads Repository and read your ads and product text as an outsider would.

Where Adverizeo fits

Most of this work happens in your tag setup and Pinterest Ads Manager. For the ad text, Adverizeo writes copy for 24 channels within each channel's format limits, and every text ad gets a compliance score from 0 to 100 with suggestions, including country rules for EU locales. It is a risk check, not a legal guarantee. Try a draft in the free GDPR ad checker, see how the checks work on our GDPR page, or start on the free plan. For a platform with a different contract model, compare our TikTok Ads GDPR guide.

This article is general information, not legal advice.