trackers

What the Meta Pixel Sends From a Website, Field by Field

The Meta Pixel is the most common ad tracker on small business websites. A shop installs it to see which Facebook and Instagram ads lead to sales, and to build audiences of people who visited. Each time it fires, the browser makes a request to facebook.com/tr, usually as a tiny image.

That request is short and easy to read once it’s decoded. PXTA’s catalog entry for the pixel knows what each field means, and the report shows them in a table under every finding.

A Meta Pixel request decoded by PXTA: the pixel ID, the event name, the page address in dl, the referring page in rl, and a hashed email address in ud[em], with the page address and the hash highlighted.

The Fields That Matter

  • id is the pixel ID, which says whose ad account gets the data.
  • ev is the event: PageView, ViewContent, AddToCart, Purchase, or a name the site made up.
  • dl is the full address of the page, query string included. If the address holds an email, an order number or a search, Meta gets it.
  • rl is the page the visitor came from.
  • fbp and fbc come from Meta’s own cookies and tie this visit to the browser and to an ad click.
  • cd[...] fields carry whatever the site adds to an event, such as a product name or an order value.
  • ud[...] fields carry customer data, hashed with SHA-256: ud[em] for the email, ud[ph] for the phone, ud[fn] and ud[ln] for the name, ud[external_id] for the site’s own customer ID.

Where It Usually Goes Wrong

The page address. The pixel always sends dl. Sites that put an email or a name in a URL, often on a confirmation page or in a link from an email campaign, send it to Meta without anyone deciding to. PXTA reports this as an email address “inside the page address”.

Advanced matching. Meta’s advanced matching sends hashed customer details so Meta can link the visit to a Facebook account. The automatic version reads email and phone fields on the page by itself. A hash isn’t anonymous to Meta: it hashes the addresses it already has and looks for a match. PXTA types a marker address into email fields and checks for its hash, so it catches the automatic version even when nobody submits a form.

Timing. The usual install is a snippet pasted into the page template, which runs before any cookie banner has loaded. If the tag isn’t wired to the banner, it fires in all three of PXTA’s passes.

What PXTA Can’t See

Meta also takes data straight from a site’s server through its Conversions API. That traffic never passes through the browser, so no browser-based audit sees it, PXTA included. If a site uses both, the report covers the browser half.

The Harbor & Pine sample report shows the Meta Pixel sending a customer’s email from an order confirmation page, and the newsletter post shows automatic matching at work.