Meta Pixel and GPC: How to Check Limited Data Use

If your site runs a Meta Pixel, the setting that matters most for California visitors is one line of code you may never have seen. Meta calls it Limited Data Use, and Meta's documentation describes it as something the site turns on, not something the pixel infers from a visitor's browser.

What Limited Data Use does

Limited Data Use (LDU) is a flag your site passes to Meta. Meta's documentation says that when it receives data with the flag set for people in an applicable state, it processes that data in its role as a service provider or processor, and limits use as its State-Specific Terms specify. California is on the list of applicable states. Meta also warns that retargeting and measurement get more limited once the flag is on.

The flag is separate from Global Privacy Control. A visitor whose browser sends GPC has made an opt-out request under the CCPA regulations, and that request reaches your site, not Meta. If nothing on your side connects the two, the pixel keeps firing as it always did.

What website owners must do

Whether to rely on LDU or to stop the pixel for opted-out visitors is a decision for you and your counsel. Either way, an opt-out signal has to change what the page does, and you can only know it did if you look. Here is the browser-side setup Meta documents.

if (navigator.globalPrivacyControl === true) {
  // 1 = United States, 1000 = California
  fbq('dataProcessingOptions', ['LDU'], 1, 1000);
}
fbq('init', 'YOUR_PIXEL_ID');
fbq('track', 'PageView');

Order matters: Meta says to set the option before fbq('init'). Passing 0, 0 instead of 1, 1000 asks Meta to work out the visitor's location itself. If you also send events from your server through the Conversions API, those need their own data_processing_options fields, because the browser flag doesn't carry over.

How to check it

Turn GPC on in a browser that supports it, open DevTools, filter the Network tab for facebook.com/tr, and load a page. A request that carries dpo=LDU, dpoco=1 and dpost=1000 has the flag. A request without them doesn't. Check a page that fires a purchase or lead event too, since those are often added by a different tag than the page view.

Where Privisy fits

The manual check covers one browser and one page. The free GPC checker loads your URL with the signal on and lists the third-party requests that still go out, so you can see whether the Meta request is among them. If it is, our guide to why GPC isn't working on a site walks through the usual causes, and the pre-consent tracker check covers pixels that fire before any choice is made.