GDPR and Tracking Consent

PixelFlow respects your visitor's consent before sending events or saving visitor and advertising information.

It automatically reads the choice from the cookie banner you already use (it never shows its own banner), and this behavior is enabled by default for every site.

• If your visitor accepts, PixelFlow tracks as normal

• if they decline, it stays off for that visit.

You can disable this in the "Sites & Pixels" page in your dashboard but you must ensure you are compliant with the laws in your jurisdiction.

What you need to do

Find your situation below. For most sites the answer is: nothing.

You use a supported cookie banner

Nothing to do. Install and run your banner as you normally would; there are no PixelFlow settings inside the banner. PixelFlow automatically understands these banners:

Not sure whether your banner sends Google Consent Mode v2? Nearly every Google-certified banner supports it: some send it out of the box, others have a setting you enable once (Iubenda, for example). Look for a "Google Consent Mode" option in the banner's settings or help pages, or check it live with Google Tag Assistant: connect your site, click through your banner, and the Consent tab will show the signal switching to granted when you accept.

In any banner, visitors must be able to accept marketing / advertising cookies, not only analytics. PixelFlow tracks for your ads, so an analytics-only accept does not switch it on.

You built your own banner (or use one PixelFlow does not understand)

Tell PixelFlow when the visitor decides. One line on your banner's buttons is enough:

<button type="button" onclick="window.pixelFlow.consent('granted')">
  Accept
</button>
<button type="button" onclick="window.pixelFlow.consent('denied')">
  Reject
</button>

Or from your own JavaScript:

// Visitor accepted marketing / ad cookies
window.pixelFlow.consent("granted");

// Visitor declined or withdrew consent
window.pixelFlow.consent("denied");

How to use it:

• Call it at the moment the visitor decides, and again if they change their mind. A button click is the perfect place.

• The command exists once the PixelFlow snippet has loaded, so wire it to your banner's buttons rather than running it immediately as the page starts loading.

• PixelFlow remembers the choice for about six months, so you do not need to call it on every page.

• Only 'granted' and 'denied' do anything; other values are ignored.

• A denied call stops new tracking and deletes PixelFlow's own identifiers for that visitor. It does not delete events that were already sent.

You have no cookie banner

PixelFlow keeps working as usual. It waits a couple of seconds, sees that the page has no banner and no consent setup, and then sends events under your normal triggers and blocking rules.

How it works

When your page loads, PixelFlow starts in a short hold and does two things at once:

1. It looks for a consent setup on the page: a supported banner, Google Consent Mode, or your own window.pixelFlow.consent(...) call.

2. It resolves the visitor's country on PixelFlow's own servers, using a local location database. The visitor's IP address is never sent to any third party for this.

What happens next:

• No consent setup found: PixelFlow tracks as usual.

• A consent setup is found: the visitor's country decides what happens while the banner is still unanswered.

• The visitor decides: an accept starts tracking and a decline stops it, anywhere in the world. GPC can still block tracking after an accept, but only in the listed US states.

Ask first, or track until told to stop?

What happens while the banner is still unanswered depends on where the visitor is. PixelFlow detects the location automatically on each visit, resolving the visitor's IP against a local MaxMind GeoLite2 database on PixelFlow's own servers (the IP never leaves them). You do not configure this, and it follows the visitor's location, not where your company is registered.

Ask-first regions (opt-in)

PixelFlow waits for an accept before tracking. A banner nobody has clicked yet means "keep waiting". So does a Google Consent Mode setup that starts everyone as declined until they choose: PixelFlow treats that as "no decision yet" and keeps waiting. Applies to visitors in:

• European Union: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden

• EEA (non-EU): Iceland, Liechtenstein, Norway

• United Kingdom, Switzerland, Brazil, South Korea, Japan

• Canada: Quebec only (when Quebec is detected as the region)

• Unknown location: treated as ask-first, the safer default

Track-until-declined regions (opt-out)

Tracking can start before the visitor answers the banner. A later decline on the banner stops new events from that moment on. Events collected before the decline were collected lawfully under opt-out rules and are not deleted. Applies to visitors in:

• United States and most other countries

• Canada outside Quebec (or when the province cannot be detected)

GPC is a separate rule and only applies in twelve US states.

Example. The same page, the same banner, two visitors who have not clicked anything yet. Anna is in Germany: PixelFlow holds her page view in memory and waits for her answer. If she leaves without answering, her held events are deleted and never sent. Tom is in Texas: PixelFlow tracks him right away, and if he clicks "Reject", tracking stops from that click onward.

Remembering your visitor's choice

After a real decision, PixelFlow saves it in a small first-party cookie named _pf_consent for about six months (183 days). It stores only the decision (accepted or declined), which tool it came from, when it was made, and a version number of the consent format. It contains no visitor ID and cannot identify anyone. On the next visit, PixelFlow follows the remembered choice right away.

Global Privacy Control (GPC)

Some browsers and extensions (Brave, for example) send Global Privacy Control, a built-in "do not sell or share my data" signal, with every visit.

When Consent mode is Enabled, PixelFlow honors GPC only for visitors in these US states: California, Colorado, Connecticut, Texas, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Delaware, and Oregon. Those twelve require a covered business to treat a browser opt-out signal as a "do not sell or share" request. GPC is the signal browsers actually send. There is no single US-wide law; each state wrote its own. See California's Attorney General on GPC and this 2026 state-by-state GPC guide (statute listed for each state).

If we can tell the visitor is in the United States but not which state, we honor GPC as well (safer default). In those places GPC wins over everything else, even an "Accept all" click on your banner. Tracking stays off for that visit.

Everywhere else, including the EU and other US states, PixelFlow ignores GPC and follows the banner and the regional rule above. A visitor in Germany who accepts the banner is tracked even if Brave is sending GPC.

US sites in the listed states should expect some visitors to stay untracked even after accepting the banner. That is expected: those visitors have GPC turned on.

Consent mode (the dashboard switch)

Everything on this page is controlled by one per-site switch called Consent mode. It is PixelFlow's own setting, and it is Enabled by default for every site.

Where to find it:

• Overview: the Connection status card shows Consent mode as Enabled or Disabled.

• Sites: the table shows the status for each site.

• Edit site: this is where you change it.

There is no separate consent settings page. Install a supported banner (or the one-line command above) and leave Consent mode Enabled unless you intentionally want PixelFlow to ignore consent signals on that site.

Testing your setup

PixelFlow never clicks your cookie banner for you, so when you test, accept it yourself first:

1. Open your site in a regular browser window.

2. Accept cookies in your banner. If it asks per category, accept marketing / advertising too.

3. Trigger the event you want to check your events in PixelFlow.

If you reject or ignore the banner during a test, the event may never fire even though your snippet is installed perfectly. The same goes for the Verify step of site setup: it waits for a real event from your site, so accept your banner first or it can look broken. You will find a reminder about this on the Verify screen, and the Get Started checklist item "Configure a consent banner to stay GDPR compliant" links to this page. Meta Events Manager test events and browser extensions follow the same rule: accept consent on the page first.

WordPress and WooCommerce

The PixelFlow WordPress plugin follows the same rules. It reads consent through the standard WP Consent API when your banner supports it (most WordPress consent plugins do). When that API is not available, it falls back to the _pf_consent cookie described above. While a supported banner is present but unanswered, the script also sets a session cookie _pf_consent_source (the banner name only, no visitor ID) so WooCommerce events sent under track-until-declined rules carry the same unknown + source proof as browser events. While an ask-first banner is still unanswered, the script also sets _pf_no_consent_decision=true so WooCommerce server events are not sent yet. Add to cart and checkout events wait in the WooCommerce session (value, quantity, and hashed customer data when the shopper is logged in) and are sent with their original times if the visitor accepts. If the visitor declines, or leaves without answering and comes back without a grant, those events are recorded as anonymous blocked_events rows instead. Purchase events skipped during a hold, declines, and bot user agents still write blocked_events immediately.

Frequently asked questions