How Facebook ads tracking actually works

When you launch a campaign, Meta doesn’t know who your customers are. It starts by showing your ad to broad slices of people and watches what happens. Every conversion you report back is a training signal: this kind of person, in this context, took the action you care about.

Feed it nothing and it keeps optimizing for cheap clicks and video views — the things it can see on its own. Feed it real conversions (who visited, who filled the form, who bought) and the model shifts from targeting broad categories to finding people who actually convert. The quality of that feedback loop is the single biggest lever you control.

Everything else in this guide is about making that feedback loop accurate: getting the event to Meta reliably, tying it to the right person, and making sure your ad gets the credit.

A conversion event can reach Meta by two paths. The browser path fires the Meta Pixel — JavaScript running on your site sends the event straight from the visitor’s browser. It’s easy to set up, but it’s also the fragile path: ad blockers, tracking-prevention (ITP), and people bouncing before the script loads all quietly drop events on the floor.

The server path uses the Conversions API (CAPI). Your own server sends the event to Meta directly, browser-to-Meta blockers never see it, and it fires even when the visit was too short for a pixel to load. It’s more work to build, but it’s the reliable path — and it’s where a conversion that the browser missed can still get through.

The strongest setups send both and deduplicate: the same event goes out over the browser and the server with a shared event ID, Meta keeps one copy, and you get the browser’s richness plus the server’s reliability.

An event is only useful if Meta can tie it to a person. It does that by matching the identifiers you send against its own graph of users — a process it scores as Event Match Quality. The more (and stronger) the identifiers, the higher the score, and the more conversions get attributed instead of thrown away.

You don’t send raw personal data — strong identifiers like email and phone are hashed before they leave your server. But the difference between sending just an IP address and sending a hashed email, phone, and name is the difference between a coin-flip match and a near-certain one.

When someone clicks your ad, Meta appends a click ID (fbclid) to the destination URL. Your pixel reads it and stores it as the fbc cookie; a separate fbp cookie identifies the browser itself. When the conversion finally fires, sending that click ID back is what tells Meta “this sale came from that click” — it’s how your ad earns the credit.

The catch is that the click and the conversion often don’t happen in the same moment. Someone clicks today, thinks about it, and buys three days later from a different device. If the click ID wasn’t captured and stored server-side at the moment of the click, there’s nothing to send back later — and the sale looks organic even though your ad paid for it.