Consent tool guide · OneTrust

Meta Pixel and OneTrust: fire only after cookie consent

For the findings “Meta Pixel fires before cookie consent” and “Meta Pixel does not fire after cookie consent”. See also the general guide.

What goes wrong with OneTrust and the Meta Pixel

A working setup does two things: the Meta Pixel (still often called the Facebook Pixel) sends nothing while the OneTrust banner is waiting for an answer, and it sends a PageView right after the visitor accepts targeting cookies, on the same page. Broken setups usually fail in one of two ways:

  • The pixel fires before consent. The pixel is not linked to any OneTrust category: it has no optanon-category class, its Google Tag Manager (GTM) tag fires on “All Pages”, or auto-blocking does not know about it.
  • The pixel stays silent after consent. The pixel is linked to the wrong category ID, or its GTM trigger runs once on page load, before the visitor has clicked anything.

In our scan of showcase sites, 2 of the 21 OneTrust sites with a Meta Pixel (about 1 in 10) sent pixel data before the visitor answered the banner. That is a small sample, not a random one, so treat it as a sign that the problem happens, not as a market figure.

We report technical behaviour only; we cannot tell you whether your setup is legally compliant.

Find your category ID first. OneTrust identifies cookie categories by group IDs. In OneTrust’s own examples, Targeting Cookies is C0004, but IDs can be customised. Look yours up under Cookie Consent > Categorizations > Categories. This guide uses C0004; replace it with the ID of the category that holds the Meta Pixel.

How to check your site

  1. Open a private (incognito) window, open developer tools (F12), go to the Network tab and type facebook.com/tr into the filter. If your banner only appears in some countries, test from one of them (for example with a VPN).
  2. Load the page and do not touch the banner. Any facebook.com/tr request at this point means the pixel fires before consent.
  3. Accept all cookies. Within a few seconds you should see a request with ev=PageView on the same page. If it only appears after you open another page, you lose the first page view of every new visit.
  4. In the Console tab, type OnetrustActiveGroups before and after accepting. After accepting, the list should include your targeting ID (for example C0004).
  5. In a fresh private window, reject all cookies. No facebook.com/tr requests should appear.

Meta Ads Data Advisor (formerly Meta Pixel Helper), Meta’s Chrome extension, shows the same events if you prefer not to read network requests.

How to fix it

First find every copy of the pixel: search the page source for fbevents.js and fbq(, and check your GTM container, CMS plugins and shop apps. Choose one of the routes below and remove the other copies.

Pixel in Google Tag Manager

OneTrust documents a trigger-based setup for GTM:

  1. Create a Data Layer Variable and set its Data Layer Variable Name to exactly OnetrustActiveGroups.
  2. Create a Custom Event trigger with the event name OneTrustGroupsUpdated. Set it to fire on Some Custom Events, when OnetrustActiveGroups matches RegEx ,C0004,.
  3. Make this the Meta tag’s only firing trigger and remove All Pages. OneTrust raises OneTrustGroupsUpdated when consent becomes available on page load and whenever consent changes, and notes that a tag that was blocked and is then allowed fires without a page reload.
  4. Under Advanced Settings > Tag firing options, choose Once per page, so a visitor who changes their choice does not send a second PageView.

If you also use Google Consent Mode (the OneTrust CMP template on the Consent Initialization - All Pages trigger, or Consent Mode enabled in your geolocation rules), OneTrust maps the Targeting category to ad_storage, ad_user_data and ad_personalization by default. You can then add ad_storage under the Meta tag’s Advanced Settings > Consent Settings > Require additional consent for tag to fire as an extra check. Keep the OneTrustGroupsUpdated trigger anyway: Consent Mode only adjusts Google tags with built-in consent checks, and GTM checks the consent setting only when the tag is triggered. A Meta tag on All Pages is checked once, before the click, and never again on that page.

Also note: the OneTrust CMP template injects the banner script itself, so remove any other OneTrust banner script; and auto-blocking can block the GTM container itself (OneTrust’s GTM guide shows how to prevent this).

Pixel in your site code or a CMS

OneTrust’s recommended method for code on the page is script type rewriting. Change the pixel’s script tag so the browser treats it as plain text:

<script type="text/plain" class="optanon-category-C0004">
  // Meta Pixel base code, unchanged
</script>

When the visitor grants consent for that category, OneTrust changes the type to text/javascript and the code runs. Apply this to every copy of the base code, for example in a shared header template. If the class lists several categories (such as optanon-category-C0002-C0004), the pixel only runs when all of them are accepted.

Alternatively, use Meta’s consent API, which keeps the pixel loaded but paused. Add fbq('consent', 'revoke') before fbq('init', ...) in the pixel code, and grant consent from the OptanonWrapper function that is already part of your OneTrust snippet:

function OptanonWrapper() {
  if (OnetrustActiveGroups.includes('C0004')) {
    fbq('consent', 'grant');
  }
}

OneTrust runs OptanonWrapper on every page load and whenever the visitor changes their choices. Keep a single OptanonWrapper on the page, and place the pixel code above the OneTrust snippet so fbq exists when the wrapper runs.

OneTrust auto-blocking

Auto-blocking intercepts scripts as they are added to the page, sets them to text/plain with a category class, and lets them run once consent is given. For the Meta Pixel it only works when:

  • You published a script with Enable Automatic Blocking of Cookies switched on (under Cookie Consent > Scripts) and replaced your old banner script with it. The option Automatically Block Known Tracking Technologies maps scripts from common hosts, facebook.net included, to the Targeting category.
  • The auto-blocking script is the first script in the head, loads synchronously, and is added directly to the page, not through a tag manager.
  • Your site has been rescanned since the pixel was added, the Meta cookies are categorised (cookies left as Strictly Necessary or Unknown are not included), and they have the correct source URLs.

OneTrust recommends validating auto-blocking in a test environment first, because it can change the order in which scripts run.

Common causes

Pixel fires before consent:

  • The pixel is in the page source without type="text/plain" and an optanon-category class, and auto-blocking is off or does not cover it.
  • The auto-blocking script is not first in the head, or is loaded through a tag manager.
  • The Meta tag in GTM fires on All Pages with no OneTrust trigger or consent requirement.
  • A plugin or app adds its own browser pixel next to yours.

Pixel silent after consent:

  • The class or GTM regex uses a default ID such as C0004, but your targeting category has a custom ID.
  • The Meta tag requires ad_storage but is only triggered by All Pages.
  • fbq('consent', 'revoke') is in place, but nothing calls fbq('consent', 'grant'), or a second OptanonWrapper definition overwrites the one that does.

How to verify

  1. Repeat the private-window test: no requests before you answer the banner, a PageView within a few seconds after you accept (on the same page), and nothing after you reject.
  2. If you use GTM, open Preview, accept the banner and check that the Meta tag fires on the OneTrustGroupsUpdated event. Then reload: for a returning visitor who already accepted, the tag should fire without any click.
  3. Re-run the check on IsPixelWorking.

Questions people ask

Meta’s counterpart is the pixel’s consent API: fbq('consent', 'revoke') before fbq('init', ...) pauses sending, and fbq('consent', 'grant') resumes it. The pixel does not read OneTrust’s choice by itself, so something on the page has to call these commands, as in the OptanonWrapper example above.

Google Consent Mode passes the visitor’s choice to Google tags, which adjust their own behaviour. A Meta Pixel tag has no built-in consent check, so it needs its own control: the OneTrustGroupsUpdated trigger in Google Tag Manager, an optanon-category script tag, or Meta’s consent API.

Can blocking the Meta Pixel affect ad tracking and performance?

Yes. While the pixel waits, Meta receives no pixel events from that visitor, and visitors who reject send none at all, so reported conversions, retargeting audiences and the data Meta optimizes on are smaller. That is why the setups above release the pixel on the same page as soon as the visitor accepts, not one page later.

How do I set up Limited Data Use for the Meta Pixel?

Limited Data Use is a separate Meta data processing option for US state privacy laws (California among them), not a consent signal. Meta’s documentation turns it on with fbq('dataProcessingOptions', ['LDU'], 0, 0); placed before fbq('init', ...), where the two zeros ask Meta to determine the visitor’s location. Whether you need it is a legal question we cannot answer.

Sources