Meta Conversions API Setup Guide for 2026

Why does the Meta Pixel miss conversions?

The Meta Pixel runs in the visitor’s browser, and browsers and devices limit it in several ways:

• Since iOS 14.5, apps need permission through App Tracking Transparency to track people across other companies’ apps and websites (Apple).
• Safari deletes JavaScript-set cookies after seven days without a visit, and after 24 hours when a visitor arrives through a decorated link from a domain Safari classifies as a tracker (WebKit).
• Since Safari 26 (iOS 26), Safari blocks known fingerprinting scripts from writing long-lived cookies and reading query parameters in all browsing modes (WebKit, Safari 26.0). Private Browsing also strips known click IDs from links (WebKit).
• Ad blockers stop the Pixel script from loading.

The Conversions API (CAPI) is Meta’s server-to-server connection. Your server sends the event straight to Meta, so browser limits don’t block it. For the wider picture on signal loss, read why your ad data goes missing.

What does CAPI do?

1. Recovers events the browser Pixel never sent because of blockers or tracking prevention.
2. Adds customer data such as hashed email, phone, fbp, fbc, IP and user agent, which helps Meta match events to accounts.
3. Deduplicates against the Pixel, so one purchase counts once.

Get the third step right. A setup that double-counts conversions inflates your reporting and feeds Meta’s bidding wrong numbers.

Which implementation should you choose?

• Partner integrations (Shopify, WooCommerce and other platforms). Quickest to switch on, and they cover standard e-commerce events. You get less control over which customer data you send and how.
• Conversions API Gateway. Meta’s own hosted option that mirrors Pixel events server-side, with little configuration.
• GTM server-side with Meta’s Conversions API tag. The most control over events, enrichment and consent, but you set up and maintain a server container.
• Managed server-side hosting such as TAGGRS (an Octomize partner) or Stape. The same GTM server container, with someone else running the servers.
• Direct API integration from your backend. Best fit for custom platforms with a development team.

If you’re choosing between self-hosted and managed GTM server-side, see TAGGRS vs GTM server-side.

Which events should you send server-side?

Send the events you optimize on, not only Purchase:

1. PageView
2. ViewContent (product views with content IDs)
3. AddToCart
4. InitiateCheckout
5. AddPaymentInfo
6. Purchase (with value, currency and order ID)
7. Lead (for lead generation)
8. CompleteRegistration (for sign-ups)

Attach customer information to each event: hashed email and phone, hashed name and location fields where you have them, plus IP address, user agent, fbp and fbc.

How does deduplication work?

Meta deduplicates a Pixel event and a CAPI event when the Pixel’s eventID matches the server’s event_id and the event names match. It only does so if the second event arrives within 48 hours of the first (Meta, deduplication).

Two rules:

• Generate the event_id once, send it with the Pixel event, pass it to your server, and send the same value with the CAPI event.
• Base it on the order ID or another unique transaction ID, not a timestamp.

Check deduplication in Events Manager. Meta’s dataset quality metrics show the share of events received with each deduplication key (Meta, Dataset Quality API).

How should you hash customer data?

Meta requires SHA-256 hashing for contact fields such as email, phone, name, city, state, zip and country. It tells you not to hash IP address, user agent, fbp or fbc (Meta, customer information parameters).

Normalize before you hash:

• Email: trim spaces and lowercase. Keep the dots.
• Phone: remove symbols, letters and leading zeros, and include the country code (for example 16505551212).

Common mistakes:

• Hashing IP, user agent or the cookies.
• Hashing a value that’s already hashed.
• Normalizing the same field two ways in two code paths.
• Sending a hashed email but an unhashed phone.

How do you handle fbp and fbc cookies?

Meta matches on two cookies: _fbp (browser ID) and _fbc (click ID, built from the fbclid URL parameter). Send the current value of both with every CAPI event when they exist.

If you run GTM server-side on your own subdomain, such as metrics.yourbrand.com, your server can set these as first-party cookies through HTTP headers. Safari’s seven-day cap applies to cookies created in JavaScript, so server-set cookies hold up better.

How do you check that CAPI works?

Open Events Manager and look at three metrics for your dataset (Meta, Dataset Quality API):

• Event Match Quality (EMQ): a score out of 10 for how well your customer data matches events to Meta accounts. Raise it by sending more fields, normalized and hashed the way Meta specifies. Start with email and phone, since most checkouts and forms already collect them.
• Event coverage: the share of Pixel events also sent through CAPI with matching deduplication keys. Meta’s best-practice goal is 75%.
• Additional Conversions Reported (ACR): Meta’s estimate of the extra conversions you report because you use CAPI alongside the Pixel.

ACR answers the question of whether the work paid off, using your own data instead of someone else’s benchmark.

Where should you start?

If you haven’t set up CAPI, start with Purchase or Lead plus deduplication, then add the funnel events. If you set it up a while ago, audit EMQ, event coverage and deduplication keys, because broken setups often look fine in Ads Manager.

Our tracking service builds and audits CAPI setups, and our Meta Ads management runs campaigns on that data. For online stores, see how we work with e-commerce brands.

FAQ

Do I still need the Meta Pixel if I use the Conversions API?

Yes. Meta recommends running both with deduplication. The Pixel captures browser signals, and CAPI fills the gaps when the browser drops events.

What is a good Event Match Quality score?

Meta reports EMQ out of 10 and higher is better. Compare your score before and after changes, and focus on sending more customer fields, normalized and hashed to Meta’s rules.

How long is Meta’s deduplication window?

48 hours. Meta deduplicates a Pixel and server event with the same event name and event ID if the second arrives within 48 hours of the first.

Should I hash fbp, fbc or IP address?

No. Meta asks you not to hash IP address, user agent, fbp or fbc. Normalize contact fields such as email and phone, then hash them with SHA-256.

Does the Conversions API work without consent?

You still need consent where the law requires it, such as for EU visitors under GDPR. CAPI changes how you send data, not whether you may send it.