The Meta Pixel is a small JavaScript snippet that millions of websites — including most WooCommerce and Shopify stores — install voluntarily to track ad performance. What it sends back to Meta goes well beyond the click that produced a conversion.
When a customer visits a page on your store, the pixel fires. It captures the URL, the page title, browser fingerprint data, and — if the customer is logged into Facebook — a match between the visitor and their Facebook identity. If they add something to cart, the pixel captures product IDs and prices. If they complete a purchase, it captures the full order value. If you have also enabled Meta's Conversions API, all of that happens server-side, bypassing ad blockers and browser privacy settings entirely.
This Is Not a Bug. It Is the Product.
None of this is secret. Meta documents each data field transmitted by the pixel in its developer documentation. The problem is consent: in most WordPress installations, the pixel fires on page load regardless of whether the visitor has accepted tracking. Consent banners exist on many sites but commonly do not block the pixel before consent is granted.
That gap has produced significant regulatory liability. In 2025, Swedish authorities fined a group of pharmacy chains approximately 8 million euros for deploying Facebook Pixel before user consent was granted, transmitting health-adjacent browsing data directly to Meta. The Swedish pharmacies were not accused of doing anything unusual. They were accused of doing exactly what the pixel is designed to do, without the legally required consent mechanism in place first.
The US Litigation Wave
Nearly 50 lawsuits were filed in 2024 under the Video Privacy Protection Act (VPPA) targeting websites that used Meta Pixel to capture video viewing activity and pair it with Facebook user identifiers without written consent. The Athletic, a sports media subscription service owned by the New York Times, was named in such a suit in 2025. North Carolina health system Novant Health settled a consolidated class action for $6.6 million over Meta Pixel use in patient portals.
These cases were not healthcare outliers. They established a pattern: if your site has video content and the Meta Pixel, and your visitors have Facebook accounts, each video view potentially constitutes an unauthorized data transmission under VPPA. E-commerce stores with product demo videos, tutorial content, or embedded social clips are exposed to the same theory.
What WooCommerce Store Owners Typically Do Not Know
Most WordPress store owners install the Meta Pixel through one of several third-party plugins. The plugin handles the implementation. The store owner accepts the legal liability. When the Swedish Data Protection Authority issues a fine, it names the pharmacy chain — not the pixel implementation plugin developer, not Meta.
- Does your pixel fire before consent is granted? If yes, that is the exposure.
- Do you have a consent management platform (CMP) that actually blocks scripts pre-consent?
- Have you audited which plugins send data to third-party domains on page load?
- Have you reviewed what your privacy policy says versus what actually fires?
