Is Meta's Limited Data Use Enough to Honor Opt-Outs? Why Doubts Remain

What Does Limited Data Use Do?

Limited Data Use is a flag that businesses attach to the information that the Meta Pixel sends. Meta's documentation states that when it receives data with the flag from people in the covered states, it "will process that data in accordance with our role as a service provider or processor." Those are the terms that state privacy laws use for vendors that handle information only on behalf of the businesses they serve. The same option is available for Meta's Conversions API, which sends events from businesses' servers.

The flag does not block the pixel. The pixel sends the same events to Meta, with the flag attached. Meta notes that "retargeting and measurement capabilities will be limited" when the flag is enabled.

Meta's documentation states that the flag is available only for people in 14 states. Businesses can specify visitors' states or ask Meta to determine them through geolocation. For visitors outside those states, the flag appears to have no effect, which leaves Meta's usual terms in place.

Based on Meta's documentation and California's privacy rules, as of October 2026.

Does It Satisfy State Privacy Laws?

The flag is designed around the definitions in state privacy laws. In California, consumers can opt out of the sale and sharing of their personal information. Both terms refer to disclosures to third parties, which can use the information for their own purposes. In contrast, a service provider is not a third party, because it handles the information only on the business's behalf under a contract, as a payroll processor or an email delivery service does.

Meta's State-Specific Terms say that, with the flag enabled, Meta will not sell or share the information or use it outside of its relationship with the business. However, California limits what a service provider may do in advertising. Its regulations state that a service provider "cannot contract with a business to provide cross-context behavioral advertising," meaning ads targeted to people based on their activity across other businesses' websites and apps. Both the regulations and the statute also bar a service provider from combining the information of consumers who opted out with information that it "collects from its own interaction with consumers."

The regulations illustrate the line with a social media company acting as a service provider. It can run non-personalized ads for businesses, but it cannot use their lists of customer email addresses "to identify users on the social media company's platform to serve advertisements to them." Meta says that retargeting and measurement are limited with the flag, but it does not say what remains. Measuring Facebook ads generally involves linking website visits to the accounts that saw the ads, which may be the kind of activity that the rules prohibit.

Meta does not directly explain how it chose the 14 states in which the option is available. However, the list appears to match the states whose privacy laws define a sale to include exchanges for non-monetary value, which is how advertising tools can count as a sale. (In states such as Virginia and Utah, a sale requires monetary exchange, so pixel data may not be a sale there at all. Those states still give consumers a right to opt out of targeted advertising, which the flag does not address.)

Regulators expect these arrangements to be verified. In its 2025 action against Healthline, California's Attorney General said that the company's advertising contracts lacked the privacy protections that the law requires. According to the release, Healthline "had assumed, but not verified," that its advertising partners had agreed to an industry contractual framework.

Meta's help page describes an opt-out of sale or sharing as one reason to send the flag, along with a Global Privacy Control signal from people in California or Colorado. However, it also states that it is "up to you, with the advice of your legal counsel, if and when the Limited Data Use flag should be sent." I am not aware of a regulator that has clearly accepted or rejected the flag as a way to honor an opt-out.

Does It Matter for Wiretapping Claims?

Wiretapping claims focus on the transmission of information to another company. Meta's Limited Data Use flag does not stop that transmission. Because businesses cannot eavesdrop on their own conversations with visitors, these wiretapping claims often depend on whether a vendor counts as part of the business or as an outside listener. Courts are divided on how to decide that.

Some courts ask whether a vendor used the information for its own purposes, and treat a vendor that did not as an extension of the business. The flag may help under that approach. In a 2026 federal case in California, a defendant argued that the flag "would require Meta to act only as a service provider." The court dismissed the wiretapping claim on other grounds without addressing that argument.

Other courts ask only whether the vendor was capable of using the information for its own purposes. The flag is less likely to help under that approach. In a 2025 ruling, a federal judge in California wrote that whether a vendor has permission to use information "is irrelevant to the question of its capabilities."

Should Businesses Block the Pixel or Send the Flag?

Businesses generally have two ways to respond when visitors opt out. Blocking the pixel is the most defensible approach, because nothing is sent, but it removes those visitors from advertising measurement. Sending the flag preserves limited measurement. However, this approach leans on a service provider role that California's rules call into question, while the transmission continues.

Some platforms make that choice by default. Shopify's documentation says that pixels configured as a data sale will not run for customers who opted out, "unless the pixel supports limited data use." On those stores, the Meta Pixel may keep running for opted-out visitors with the flag attached.

Businesses that use Google Tag Manager should also confirm that the pixel responds to visitors' choices at all. Google's consent signals adjust Google's own tags, but they do not necessarily stop a Meta Pixel tag. Unless the tag is set to require additional consent or is blocked by a trigger, the pixel may keep running after an opt-out with no flag attached. Gating the tag itself avoids that result, because the pixel then does not run when visitors opt out.

I recommend that businesses confirm which approach their websites use today. Whichever approach they use, the banner and privacy notice should describe what happens after an opt-out accurately, since a promise to stop sharing with advertising partners would conflict with a pixel that keeps sending information to Meta.