Facebook lead ads and Meta Pixel privacy policy requirements

Compare the policy with the instant form and what happens after someone submits it. Include the fields requested by the form, the CRM or inbox they reach, and the messages your team sends next. A policy describing only website visits leaves that journey unexplained. Cover these points explicitly:

• Source: that you collect information through lead forms on Meta platforms, and that some fields may be prefilled from the person's profile before they submit.
• Data collected: the exact fields you ask for, such as name, email, phone number, city, or answers to qualifying questions.
• Purpose: the service in the call to action, such as sending a quote, booking a consultation, or delivering a download.
• Recipients: your CRM, email marketing platform, integration tools, and any partner who fulfils the request.
• Follow-up: whether you will call, email, or text, and how people can stop it.
• Retention: how long you keep leads that never become customers.
• Rights and contact: how to access, correct, or delete the data, and a contact address that someone actually reads.

The Lead Ad Terms already forbid selling lead data, so make sure nothing in your policy suggests otherwise.

When you build an instant form, the setup flow includes a privacy section where you enter the URL of your privacy policy and the link text people will see. You can also add a custom disclaimer, for example to explain additional consents or offer terms. Meta changes its ads interface regularly, so follow the current Meta Business Help Center steps for the exact screens.

A few practical rules make this step go smoothly:

1. Use a public URL. The page must load without a login, on mobile, and in any country where the ad runs.
2. Keep it stable. If you move or rename the page, every live form pointing to it breaks.
3. Match the language. If the ad runs in Spanish, a Spanish policy or summary helps people understand it.
4. Make the content match the form. If the form asks for phone numbers and job titles, the policy should mention both.

If you do not have a website, you still need somewhere to host the policy. Our guide on how to get a privacy policy URL explains your options.

You can use it for what the person asked for. Anything beyond that needs care.

The Lead Ad Terms limit use to the service in the call to action unless you obtain consent where necessary. Local marketing laws apply on top. In the EU and UK, electronic marketing to individuals generally needs prior consent, with narrow exceptions. In the US, commercial emails must follow the CAN-SPAM Act, and calls and text messages raise separate telemarketing rules.

A safe pattern looks like this:

1. Use the lead form to deliver exactly what the ad offered.
2. If you want to send ongoing marketing, add an optional consent question or custom disclaimer that clearly asks for it.
3. Record which leads opted in, when, and through which form.
4. Sync only the opted-in leads to marketing lists in your CRM.
5. Honor unsubscribes everywhere the lead data lives.

Describe this flow in your privacy policy so the promise matches reality. For more on email consent and disclosures, see the email newsletter privacy policy guide.

The Meta Pixel and the Conversions API send website events, and sometimes hashed customer information, to Meta for measurement and ad targeting. Meta's Business Tools Terms set out what you must tell people:

• Where: a clear and prominent notice on each web page where Meta pixels are used, linking to a clear explanation.
• What it covers: that third parties, including Meta, may use cookies, web beacons, and other storage technologies to collect or receive information from your website and elsewhere, and use it to provide measurement services and target ads.
• Choices: how people can opt out of the collection and use of information for ad targeting, and where they can access a mechanism to do that.
• Consent where required: in jurisdictions that require informed consent for storing and accessing cookies or other information on a device, such as the EU, you must ensure in a verifiable manner that people give the necessary consents before you use the tools.

The terms also prohibit sending data you know or should know is from or about children under 13, or that includes health or financial information and other sensitive categories. Our advertising privacy disclosures guide covers pixels from other platforms too.

If you upload customer lists to create Custom Audiences, you are sharing customer contact information with Meta for advertising, so your policy should say so.

Meta's Customer List Custom Audiences Terms describe how the feature works and what you must ensure:

• Contact information is hashed before it is passed to Meta for matching.
• You must have all necessary rights and permissions and a lawful basis to disclose and use the data.
• The list must not include people who have opted out of that use, and you must remove people who opt out later.
• Meta says it deletes the customer list data after the match process is complete, subject to optional features you choose.

In your privacy policy, explain that you may use hashed contact details to show relevant ads on Meta platforms or to exclude existing customers, describe the lawful basis or consent you rely on, and give people a simple way to object. Hashing protects the data in transit, but it does not make the activity invisible to privacy law, because the purpose is still to match individuals.

Often, yes. California's privacy law defines sharing as disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands. Retargeting visitors through a pixel that sends browsing activity to an ad platform is a common example. Other states use the term targeted advertising for similar activity.

If these laws apply to your business, your privacy policy and website typically need:

• A statement that you sell or share personal information, or process it for targeted advertising, and the categories involved.
• A clear opt-out method, such as the Do Not Sell or Share My Personal Information link in California.
• An explanation of how you handle opt-out preference signals such as Global Privacy Control, which California requires businesses to honor.

The CCPA only covers businesses that meet its thresholds, so check whether it applies before adding California sections. The CCPA and CPRA privacy policy guide explains the thresholds, and the US state privacy laws overview covers the other states.

Lead ads let people submit their details through an instant form without leaving Facebook or Instagram. That convenience comes with contractual duties in Meta's Lead Ad Terms, which you accept when you run them. The key obligations:

• Disclosures and choices: your lead forms must include all disclosures and choice mechanisms necessary and sufficient to comply with applicable laws.
• A way to contact you: you must provide a mechanism for people to contact you and respond to requests for more information about how you use their data.
• Honor what you promised: you must comply with the terms people agreed to when they submitted the form, including any privacy policy you link to.
• Purpose limits: using lead data beyond the service in the call to action requires consent where necessary from the person.
• No selling: you may not sell lead generation data under any circumstances.
• Limited sharing: transfers to third parties are restricted to the original purpose and happen at your own risk.

In other words, the privacy policy you link is not decoration. It becomes the promise Meta expects you to keep.

Start by listing every Meta tool you use: lead ads, the Meta Pixel, the Conversions API, Custom Audiences, and any Meta SDK in an app. Then match each to a section of your policy.

In the Privacy Policy Generator, describe your advertising level, such as retargeting or conversion tracking, select Meta Pixel as an advertising provider, and answer when non-essential tracking starts and how people change their preferences. The questionnaire also asks about regions, so EU, UK, and US state modules only appear when you need them. Clauses are selected deterministically from your answers and are versioned, with no AI writing them at runtime.

The preview and simple HTML and PDF download are free. If you need a public URL to paste into the instant form, optional hosting adds $0.99 once and gives you a web page you can link to. Add a short paragraph listing the exact lead form fields you collect, then check the whole document against your Meta setup. Generated text is not legal advice. Developers using Facebook Login or Meta APIs should also read Meta app privacy policy requirements.