Limited Data Use (United States)

In the United States, the visitor's opt-out goes through Meta's Limited Data Use option, in the pixel and in the Conversions API alike

On the U.S. banner (CCPA), the Facebook Consent Mode option does not pause the Meta pixel. It passes the visitor's opt-out through Meta's Limited Data Use (LDU) option. Events keep being sent, and Meta limits how it uses them: it processes them as a service provider.

If you also send your events through Meta's Conversions API, from your server, each event must carry the same decision. The CMP makes it available to you in the dataLayer.

Two mechanisms not to confuse

	GDPR banner (Europe)	U.S. banner
Call to the Meta pixel	fbq('consent', 'revoke') or 'grant'	fbq('dataProcessingOptions', …)
On refusal or opt-out	the pixel is paused: nothing is sent	events are sent, limited by Meta

Do not use consent revoke to handle a U.S. opt-out: you would cut your own measurement, while the law only requires limiting its use. Conversely, Limited Data Use does not replace the consent required in Europe.

Setup

Enable the Facebook Consent Mode option (Add-on > Other partners), as described on the Facebook Consent Mode page. The same option serves both banners: the CMP picks the right mechanism depending on the regulation that applies to the visitor.

When the CMP applies Limited Data Use

The CMP applies Limited Data Use when the visitor opts out of the sale or sharing of their data, or of targeted advertising:

• they opted out of the sale in the banner: the 3rd character of the usprivacy string is Y, and SaleOptOut is 1 in GPP section 7 (US National);

• they opted out of sharing or targeted advertising, for instance on a site that declares it does not sell data: SharingOptOut or TargetedAdvertisingOptOut is 1 in GPP section 7. The usprivacy string, which only carries the sale, is not changed;

• or their browser sends the Global Privacy Control (GPC) signal, and the CMP honors it. The opt-out then applies from the first page view, before any cookie carries it.

Otherwise, the CMP calls fbq('dataProcessingOptions', []): no limitation.

The values passed

On an opt-out, the CMP specifies the visitor's state when it is on Meta's list:

• fbq('dataProcessingOptions', ['LDU'], 1, <state code>) if the visitor's state is on Meta's list;

• fbq('dataProcessingOptions', ['LDU'], 0, 0) otherwise, or if the visitor's state is unknown: Meta then geolocates the visitor itself. The CMP never makes up a code.

State	Code
California	1000
Colorado	1001
Connecticut	1002
Florida	1003
Oregon	1004
Texas	1005
Montana	1006
Delaware	1007
Nebraska	1008
New Hampshire	1009
New Jersey	1010
Minnesota	1011
Maryland	1012
Rhode Island	1013

Conversions API: passing the same decision

The Conversions API is called by your server, with your own token. The limitation set in the browser does not apply to it: an event sent by your server without these options is not limited. The CMP does not call the Conversions API for you.

Each event must therefore carry, in its data object, the three matching fields:

Conversions API field	Pixel equivalent
data_processing_options	['LDU'], or []
data_processing_options_country	1 (United States) or 0
data_processing_options_state	the state code, or 0

This is not a global setting: the options travel with each event.

The dataLayer fields

On the U.S. banner, each sirdataConsent or sirdataNoConsent event the CMP pushes to the dataLayer carries three fields:

dataLayer field	Value	Maps to
sirdataMetaLdu	true or false	data_processing_options: ['LDU'] or []
sirdataMetaLduCountry	1 or 0	data_processing_options_country
sirdataMetaLduState	the state code, or 0	data_processing_options_state

These are exactly the values the CMP has just passed to the Meta pixel. Read them rather than recomputing the rule yourself, especially from the usprivacy cookie: it does not carry the sharing or targeted-advertising opt-out, and under GPC it does not exist yet on the first page view, while the opt-out already applies.

These three fields are absent:

• if the Facebook Consent Mode option is not enabled;

• as long as the CMP has not determined the answer for this visitor yet;

• on the GDPR banner, where the decision goes through consent grant / revoke.

In Google Tag Manager, create three Data Layer Variable variables named sirdataMetaLdu, sirdataMetaLduCountry and sirdataMetaLduState, and pass them to your server container or to your Conversions API tag.

In JavaScript, for example:

// The latest decision pushed by the CMP to the dataLayer.
var decision = null;
(window.dataLayer || []).forEach(function (entry) {
    if (entry && typeof entry.sirdataMetaLdu === "boolean") decision = entry;
});

// The options to attach to each event sent to the Conversions API.
// Without a published decision (see above), the CMP tells you nothing: the call is yours.
var options = null;
if (decision) {
    options = decision.sirdataMetaLdu
        ? {
            data_processing_options: ["LDU"],
            data_processing_options_country: decision.sirdataMetaLduCountry,
            data_processing_options_state: decision.sirdataMetaLduState
        }
        : {data_processing_options: []};
}

If you gave your dataLayer another name, replace window.dataLayer with that name (see Data Layer).