A privacy policy that says "we never sell your data" sounds reassuring. But a recent compliance article argues that the promise can fall apart when the same website runs Meta Pixel. The piece, published on a vendor blog aimed at CTOs, says that pairing a Meta Pixel 'we never sell data' statement with the pixel's actual behavior can put a company at odds with CCPA, GDPR and FTC rules.
The source is a company blog, so treat its conclusions as one legal reading rather than a court ruling. Still, the question it raises is worth understanding, because it affects what you are told about your data every time you browse.
What Meta Pixel actually shares with Meta
Meta Pixel is a snippet of code that website owners add to their pages. When you load a page, the code runs in your browser and reports activity back to Meta. That activity typically relates to what you do on the site, such as viewing pages or taking actions, and it is tied to browser and device information that can help Meta match the visit to a user.
Two points matter here. First, the data goes from your browser directly to Meta, not only from the website's own servers. Second, the site owner usually gets something in return, such as ad measurement and targeting. That exchange of data for a benefit is the heart of the legal debate.
The source article does not publish a technical breakdown of every field the pixel transmits, so the exact payload will vary by how a site configures it.
Why a Meta Pixel 'we never sell data' claim can mislead
Many companies reason that they never hand over a spreadsheet of customer data for cash, so "we never sell your data" is true. Regulators and privacy lawyers often look at it differently.
According to the article, the key issues are:
- CCPA: California's law is not limited to traditional sales for money. It also covers sharing personal information for certain advertising purposes, and it gives residents a right to opt out. A blanket "never sell" line can be misleading if pixel-based sharing falls into those categories.
- GDPR: In Europe, loading a tracking pixel generally raises questions about lawful basis and consent. If the pixel fires before a visitor agrees, the site may have a problem regardless of how its privacy policy describes "selling."
- FTC rules: The FTC polices deceptive claims. If a company tells customers it never sells data while its website sends visitor data to an ad platform, the gap between promise and practice can be treated as a deceptive statement.
The common thread is that wording matters less than what actually happens. A privacy promise is judged against real data flows, not marketing intent.
For CTOs, the article's recommended fix is to align the policy with reality: audit what tracking tools collect, gate pixels behind valid consent where required, honor opt-out signals, and rewrite policy language so it describes sharing accurately.
Your rights: opt-outs, access requests and complaints
You do not have to accept vague privacy language. Depending on where you live, you may have several options:
- Opt out of sale or sharing. Many sites that fall under CCPA provide a "Do Not Sell or Share My Personal Information" link. Use it, especially on sites that also say they never sell data.
- Send an access request. California residents and people covered by GDPR can generally ask a company what personal data it holds and who it has been shared with. The answer can reveal whether an ad platform is involved.
- Withdraw consent. Under GDPR, consent banners should let you decline tracking as easily as you accept it.
- File a complaint. If a company's statements do not match its practices, you can report it to a regulator, such as a data protection authority in Europe or a consumer protection agency in the US.
Keep a screenshot of the privacy promise and the date you saw it. A clear record makes any complaint more useful.
How to limit pixel tracking, and where a VPN falls short
A VPN encrypts your connection and hides your IP address from the sites you visit. That is valuable, but it does not stop a tracking pixel. The pixel runs inside your browser after the page loads, so it can still report your activity to Meta. If you are logged in to a Meta account or carry its cookies, a VPN does not break that link.
To reduce pixel tracking, add protections at the browser level:
- Turn on Global Privacy Control (GPC). This browser signal tells sites you opt out of sale or sharing. Some laws require sites to honor it.
- Use a tracker blocker. Content blockers and browsers with built-in tracking protection can stop requests to known advertising domains.
- Tighten cookie settings. Block third-party cookies and clear site data regularly.
- Separate your browsing. Use different browser profiles or containers for social media and everyday browsing.
- Review your Meta ad settings. Check which data-use and ad preferences you can switch off in your account.
None of these is perfect, and sites can change how they track. Layering them gives you much better coverage than any single tool.
What This Means For You
A "we never sell your data" banner is a claim, not a guarantee. If a site runs Meta Pixel, your visit may still be shared with Meta for advertising purposes, and the law in some regions treats that as more than a footnote. You have practical tools to push back: opt-out links, access requests, consent choices and complaints.
Key takeaways
- Treat any Meta Pixel 'we never sell data' promise with healthy skepticism and check the site's cookie and opt-out controls.
- Use the opt-out link and send an access request to find out where your data goes.
- Enable Global Privacy Control and a tracker blocker in your browser.
- Keep using a VPN for what it does well, but do not rely on it to block pixels.
- Report misleading privacy claims to the relevant regulator if you find a clear mismatch.
