Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
The fr cookie is Meta’s main advertising cookie. If a cookie scan of your site lists it, Meta code such as a Like button, embedded post, login button or the Meta Pixel is talking to facebook.com from your pages, and visitors who use Facebook or Instagram can be connected to what they do on your site.
What Is the fr Cookie?
Meta’s Cookies Policy describes fr as a cookie that, depending on the user’s choices, is “used to deliver, measure and improve the relevancy of ads,” with a lifespan of 90 days. It’s set on Meta’s domain (.facebook.com), so on your website it acts as a third-party cookie that Meta reads whenever its code loads.
It typically sits next to other Meta cookies, including datr, which Meta uses for security and spotting suspicious logins, and sb. These three are set on facebook.com. The Meta Pixel adds first-party cookies on your own domain, chiefly _fbp.
What Does fr Do?
- Ad delivery: helps Meta show ads to people who’ve visited a business’s website or used its app.
- Frequency capping: Meta’s policy says cookies help limit how often someone sees the same ad.
- Measurement: links ad views and clicks to later actions, such as purchases, for reporting to advertisers.
Meta’s policy also says it uses cookies when people who don’t have a Meta account visit sites with Meta technologies, so fr isn’t only about logged-in users.
How Long Does fr Last?
90 days, according to Meta. Each visit to a page with Meta code can refresh it. Safari blocks third-party cookies by default, and Firefox blocks or isolates known trackers, so in those browsers it often isn’t set from other sites at all.
Does fr Need Consent?
EU and UK
Yes. It’s an advertising cookie, so it needs opt-in consent before Meta code loads. A common mistake is gating the Pixel but leaving embedded Facebook posts or social login buttons to load freely; those can set or read fr too. Load them behind a click-to-load placeholder or the consent banner.
United States
Under the CCPA and similar state laws, sending browsing data to Meta for targeted advertising is generally “sharing” or a “sale.” Disclose it, give a “Do Not Sell or Share” option, and honor Global Privacy Control by stopping Meta tags for that visitor.
Litigation risk
Meta tracking is at the center of a wave of wiretap, CIPA and VPPA suits, especially for healthcare, finance and video sites. Our coverage of Meta Pixel lawsuits and the difference between pixels and cookies explains why. A scan showing fr on a page that handles sensitive topics is a red flag to fix first.
How to Block or Delete fr
- Site owners: list every source of Meta code (Pixel, social plugins, login, embedded videos and posts) and put each one behind consent.
- Use Meta’s consent API: the Pixel supports
fbq('consent', 'revoke')to hold events until consent is granted. - Visitors: block third-party cookies, clear facebook.com cookies (you’ll be logged out of Facebook), or change ad settings in Meta Accounts Center.
Keeping Meta Cookies Behind Consent
Captain Compliance’s scanner and consent banner find Meta cookies across your pages, show which tags set them, and hold Meta code until visitors opt in, with records of each choice. If you’re comparing options, our roundup of the best cookie consent solutions covers what to look for.
FAQ
Is fr set even if I’m not logged in to Facebook?
It can be. Meta says it uses cookies for people without Meta accounts who visit sites using its technologies.
Is fr the same as _fbp?
No. fr is set on facebook.com. _fbp is a first-party cookie the Meta Pixel sets on your domain.
Can I classify fr as necessary for social login?
Not credibly. Login can be a service the user requests, but fr‘s stated purpose is advertising.
Removing the Pixel doesn’t remove Meta from your site if a Like button or embedded post is still loading. The audit that matters is every place Meta’s code runs.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
