About Meta pixel traffic permissions

The traffic permissions feature in Meta Events Manager enables you to better control if domains are allowed to send events through your Meta pixel.

You can create either an allow list or a block list in the traffic permissions setting in Events Manager. This helps to protect you from receiving events sent through your pixel from domains you don't recognise or own.

Reasons why you might see Meta pixel events coming from unfamiliar website domains include:

• Someone else put your pixel ID on their website. The Meta pixel is a piece of code that's made up of the base code and your pixel ID. When you add your pixel to your website, your pixel ID is public information. This means that other people can find your pixel ID, add it to the pixel base code and put it on their own website.
• You set up your Meta pixel using a partner integration, third-party advertising technology or an iframe. This may cause redirects on your website. These redirects may appear as the referring URL and come from an unfamiliar website domain. In cases like these, we recommend allowing events from both domains so that you don't inadvertently block events sent through your pixel from Events Manager. Learn more in our best practices for traffic permissions.

You can use an allow list or a block list, but not both. We suggest using an allow list because it provides more control over your pixel traffic than a block list. Add the domains that you want to receive pixel events from to your allow list, and the other events are automatically blocked. For example, you might want to use an allow list if there are only a few domains you want to receive pixel events from, so you can easily just exclude all others.

Traffic block lists let you choose which domains you want to block pixel events from. Add domains that you don't want to receive pixel events from to your block list, and the other events are automatically allowed. For example, you might want to use a block list if you intend to receive events sent through your pixel from many different domains. In this case, it may be easier to just add domains that you don't recognise to your block list if you begin receiving pixel events from them.

If we detect new domains sending events through a pixel, we send an email notification to people with full control of the business portfolio or ad account that owns the pixel. If there are multiple people with full control, only one will be notified via email. A notification will also appear in Diagnostics in Events Manager.

People with the correct permissions can add and remove domains to an allow list or block list at any time in Events Manager. This includes people with full control of the ad account that created the pixel or permission to manage campaigns, full control of the business account that created the pixel or full control of the pixel.

If you add a top-level domain to a list, all subdomains are also included. For example, adding "domain.com" also adds "m.domain.com".

Note: Domain block lists and allow lists determine which website domains you receive pixel events from in Events Manager. This is different from publisher allow lists and block lists, which help you control where your ads appear.