Magento 2: Set Up Facebook Pixel, Conversions API and TikTok Pixel, Server-Side Tracking and Consent

1. Browser events and server events compared

A pixel runs in the visitor's browser and reports events such as page view, add to cart or purchase directly to the platform. It is quick to set up and provides plenty of context, but depends on the browser, consent and the network. Meta's Conversions API and TikTok's Events API work server side instead: your shop sends the event to the platform itself, independent of the customer's browser.

Neither route sensibly replaces the other. The browser supplies information such as click identifiers and page context, the server supplies reliability for confirmed orders. A combination is therefore usually recommended, where the same event arrives through both routes and the platform recognizes it as a single one by means of a shared identifier.

2. Deduplication with event_id

If the same purchase is reported once by the pixel and once by the server, it would count twice without a countermeasure. The platforms solve this with an event_id: both reports carry the same event name and the same event_id, and the platform keeps only one of them. What matters is that the identifier is generated in the shop and passed to both routes.

For a purchase, a stable identifier derived from the order works well, for example the order number with a prefix. For events without an order, such as viewing a product page, generate a random identifier per event and pass it from the page to the server. Check in the test tools whether the platform actually merges the two reports.

After setup, look at a period of a few days: if the number of events flagged as deduplicated is close to the number of purchases, the merging works. If it stays conspicuously low, the identifier on one of the two routes is probably wrong.

// Browser side: pixel event with a shared identifier (example values)
fbq('track', 'Purchase',
  { value: 100.00, currency: 'EUR' },
  { eventID: 'order-100000123' }
);

// The Conversions API receives the same event on the server with
// event_name "Purchase" and event_id "order-100000123".

3. Consent and legal framework: GDPR, TDDDG and practice

For advertising pixels, the visitor's consent is generally required, and before the script is loaded. At its core this follows from the GDPR and from the rules on access to end devices, which in Germany used to sit in the TTDSG and now sit in the TDDDG. How you assess your shop depends on the individual case. This text is not legal advice, so involve your data protection advisor. You can find technical building blocks among our tracking extensions.

Important in practice: server side transmission is not a free pass. Even if the browser loads nothing, personal data is sent to a platform, which requires a legal basis and consent. Send server events only for visitors who agreed, and pass the consent status on to the server already during the order process.

4. Setup in Magento 2: Meta Pixel plus Conversions API

The setup follows a clear flow. The pixel is loaded after consent and sends PageView, ViewContent, AddToCart, InitiateCheckout and Purchase. In parallel the shop triggers a server side call for important events, for example when the order is completed after a Magento event, and passes the same event_id. The access token for the API belongs in configuration, not in source code.

Treat the server call like any interface: with a timeout, error logging and retries for temporary failures, so an outage on the platform side does not slow down checkout. It is best run asynchronously, for example through a queue. That keeps order processing independent, which also makes sense from the perspective of performance optimization and stability.

5. TikTok Pixel and Events API

TikTok follows a similar pattern: a pixel in the browser sends events such as ViewContent, AddToCart or CompletePayment, and the Events API adds them server side. There too an event_id serves to merge duplicate reports. The event names differ from those at Meta, so a mapping table in the measurement plan is worthwhile to make sure nobody mixes up names.

With TikTok, follow the same rules as with Meta: script only after consent, server events only for visitors who agreed, credentials in configuration. Check the platform documentation for current parameters, since details can change. If you run both platforms, it is advisable to build event creation in the shop once and maintain only the translation per platform.

6. Hashing customer data for better matching

So that the platform can assign an event to a user, the APIs expect optional customer data such as email address, phone number or name. These values are not sent in plain text but are normalized first, meaning lowercased and stripped of whitespace, and then hashed with SHA-256. The hash is a protective measure, but it does not change the fact that this is still personal data.

Process this data only when consent exists, and transmit only the fields you really need. Clean normalization is decisive, because even a trailing space produces a different hash that cannot be matched to any user. The example below shows normalization and hashing of an email address in PHP.

<?php
declare(strict_types=1);

/**
 * Normalizes and hashes an email address for use as hashed user data.
 *
 * @param string $email Raw customer email address
 * @return string SHA-256 hash of the trimmed, lowercased address
 */
function hashEmail(string $email): string
{
    return hash('sha256', mb_strtolower(trim($email)));
}

7. Event match quality and the platforms' test tools

Meta shows an assessment in Events Manager of how well events can be matched to users, the so-called event match quality. The more matching, correctly hashed customer parameters an event contains, the better it usually turns out. Treat it as a hint for improvement, not as an end in itself, and never send more data than your consent covers.

Both platforms offer test tools that let you watch browser and server events live before campaigns build on them. Use them for a complete test order and check whether event name, value, currency and event_id match on both routes and the platform reports them as deduplicated. Document the result so later changes can be compared against it.

8. Typical failure patterns and their causes

The most common failure pattern is duplicate conversions, because the event_id is missing or differs between the routes. Equally widespread are events without a currency or with a value of zero, which makes optimization run into the void. A pixel that fires before consent is also a mistake you can spot in the network log. Credentials in source code or in publicly reachable files concern the security of your shop.

Another pattern is server events sent without consent because the status never reaches the background process. Also check timing deviations: if an event is sent with a heavily delayed timestamp, the platform may reject it or attribute it incorrectly. Monitoring for error responses from the interfaces reveals such problems early, before they show up in campaign figures.

With several languages and store views there is the further question whether each view uses the same pixel with the same identifier or deliberately separate accounts. Decide this early, otherwise purchases from different markets end up in one dataset that nobody can separate cleanly later.

9. Attribution in rough terms: why the numbers are never identical

The platforms attribute purchases according to their own attribution rules and often count conversions after an ad contact without a click. GA4 evaluates differently, and the shop only knows the actual orders. Compare trends rather than single figures, and decide which source is authoritative for which decision, for example the shop for revenue and the platform for campaign steering.

Server events improve the data basis but do not close a measurement gap completely. Plan effort and benefit realistically and, for larger projects, request an offer, for example through our pricing. Start with the purchase event, test it thoroughly and then extend step by step to basket and product view.

10. Summary

11. FAQ: Facebook Pixel, Conversions API and TikTok: The Essentials at a Glance