A Meta Pixel can look correct in Events Manager and still break the consent rules on your site. Events Manager shows what Meta received. It does not show whether the browser contacted Meta before the visitor said yes. This article sets up the pixel in Google Tag Manager with one of two consent patterns, then checks each visitor state in the browser.
The GTM side of consent (consent types, additional consent checks, and the "Once per page" trap) is covered in which consent signals to use for additional consent checks in GTM. Here the focus is what Meta's code does.
What Meta documents about the pixel and consent
Meta's get started guide describes a base code that loads fbevents.js from connect.facebook.net, calls fbq('init', ...) with your Pixel ID and tracks a PageView. Its fallback image tag points to www.facebook.com/tr with the Pixel ID and event name in the query string.
Meta's GDPR page gives two consent calls. fbq('consent', 'revoke') pauses pixel fires and must be called on every page, before init. fbq('consent', 'grant') resumes them after affirmative consent. The page also lists what the pixel receives: HTTP headers such as IP address, browser and page location, the Pixel ID and Facebook cookie, button click data, optional values you send, and form field names.
Three things the page does not say matter for testing:
