Payload inspection is the act of looking at all the information a tag on your website is transmitting, not just the existence of the tag itself. The Meta Pixel, for instance, transmits a lot more than page views: it can send event data, URL parameters, hashed email addresses captured from form fields, and behavioral signals to Meta’s ad systems even by default. (Hashed data, by the way, still qualifies as PII under most regulatory frameworks, including CCPA.) Sephora’s $1.2M settlement centered on exactly this kind of pixel transmission being treated as a data “sale.” DataTrue’s payload inspection shows organizations not just what tags are firing, but what information those pixels are actually sending, and to whom.

Recently I started handwriting letters again. Very old school. I bought some nice paper, and try and write and mail one or two letters a week out to friends and family. People love getting an actual letter these days in the mail, even if my handwriting is incredibly hard to read (I’m working on it). The thing is, when you write the letter, fold it, put it in the envelope, and seal it up… The message you wrote is in that envelope, but the envelope itself is a different story. The return address, the postmark, the handwriting, even the type of stamp can say something about you. You might think you’re only sending the message, but you’re also sending the metadata wrapped around it.

Or think about it in the reverse… What if you only look at the envelope, and realize it’s a letter from your friend Sayf to you. You can see where it was sent from, where it was sent to, when it was sent, what post office stamped it, etc. What you can’t see from the outside though is what actually is inside the envelope.

The Meta Pixel is like that envelope. Most marketing teams install the Meta Pixel to send a simple message: someone visited a page. But the full pixel payload often contains a lot more information in that “envelope” than they realize, creating sometimes extremely significant compliance exposure.

The Four Ways The Meta Pixel Transmits Data (That Get Companies Into Trouble)

1. The Full URL, Parameters and All

The most basic function of the pixel is to report a page view to Meta. The problem is that it sends the entire URL. If your URLs contain query parameters that include user IDs, session information, or other identifiers, the pixel sends them directly to Meta. You might think you’re just sending `yourstore.com/products/blue-widget`, but if the full URL is `yourstore.com/products/blue-widget?session_id=12345&[email protected]`, that’s what Meta gets. I have seen a horrifically large amount of not just legally questionable, but flat-out incompetent and damaging PII in URLs because the developers decided to use a GET rather than a POST, and just throw a bunch of parameters into a URL without thinking at all about the fact that there is a Meta pixel on the page.

2. Automatic Advanced Matching

This is actually where most of the risk lives. Meta’s code is designed to find and capture user-provided information from your website to better match visitors to your website to their Facebook profiles. It can automatically detect when a user types an email address or a phone number into a form field. They then hash it (a form of encryption, but not one that is compliant under CCPA or GDPR), and then stuff that PII into their “envelope” and sends it off to Meta. Even more disturbing, is that this can happen even if the user never actually clicks the “submit” button.

Did you know it could do that?

Meta’s pixel can capture the information you START to enter into a form, even if you haven’t clicked submit yet, and even if you never do.That hashed data, as I mentioned, is still considered Personally Identifiable Information, under regulations like the CCPA.

3. Custom and Standard Event Data

Marketers often configure events to track actions like ‘AddToCart’ or ‘Purchase’ to better understand their conversion funnels. But these events can also be configured to include extra parameters like product SKUs, order values, and sometimes, customer details. If these events are even slightly misconfigured, it becomes a direct pipeline for sending sensitive transaction or user data straight to an ad network. This is a classic example of what is known as PII Leakage.

4. Inferred Behavioral Signals

The Meta pixel also doesn’t just simply see the final static page. It can also watch what you’re doing, sitting in the background, and collect signals about how a user is interacting with the page (clicks, hovers, scroll depth). This rich behavioral data is bundled with all the other information and can be used to build detailed profiles for ad targeting. The combination of all these data points can create a very detailed picture of user activity that goes far beyond a simple page view.

Why This Matters: The Sephora Case

Once again, this isn’t simply a theoretical problem. In 2022, Sephora paid a $1.2 million fine for this exact behavior. Under California’s CCPA, sharing user data with a third party like Meta in exchange for a service (like ad targeting) is considered a data “sale,” even if no money changes hands.

Sephora’s pixels were transmitting user data to ad networks without the proper consent or disclosure. They failed to process user opt-outs from these “sales,” which is a direct violation of the CCPA. The key takeaway here is that the regulators see this data transmission as a value exchange, and they expect it to be treated with the same gravity as a cash transaction.

Ultimately, you can’t just trust the settings in your Meta Business Manager. It’s your responsibility to respect your users’ consent choices, not Meta’s, and the only way to know what’s really happening inside the “envelopes” that are being sent to 3rd parties is to inspect the data packets leaving your users’ browsers. That envelope is being sent whether you look at it or not, so it’s probably a good idea to know what it says and what’s inside it.