What the Pinterest Tag Tracks

The Pinterest Tag is loaded from s.pinimg.com/ct/core.js and identifies users with a Pinterest-specific cookie called _pinterest_ct_ua alongside the platform's _pin_unauth cookie for unauthenticated visitors. Once present, it reports a base PageVisit event automatically, then accepts a stream of additional event calls for AddToCart, Checkout, Purchase, Lead, Signup, WatchVideo, and custom events you define. Each event carries a JSON payload that can include product IDs, order values, currency, and content categories — exactly the kind of payload that, combined with the cookie identifier, allows Pinterest to attribute conversions back to specific pin impressions and ad clicks.

From a regulatory perspective, three things matter. First, the cookies are non-essential — they exist for advertising attribution, not for site function. Second, the data leaving the page is personal data under the GDPR because it can be linked to an identifier. Third, Pinterest is established in the United States, which means the transfer is subject to the EU-US Data Privacy Framework and the standard contractual clauses that sit underneath it. All three conditions push the Pinterest Tag firmly into "requires prior, freely given consent" territory in the EU and the UK.

Native Pinterest Privacy Controls vs a Third-Party CMP

Pinterest does expose some native privacy controls. The advertiser dashboard has a Limited Data Processing toggle for California traffic, the Tag accepts a consent property on individual event calls, and Pinterest documents a Server-Side Tagging path through the Conversions API. None of these is the same as a working consent banner. The native controls assume that consent has been collected somewhere upstream and is being passed in as a signal — they do not collect consent themselves, and they do not block the Tag from firing if consent is missing. For any publisher operating across multiple jurisdictions, the realistic architecture is a third-party CMP that decides whether the Tag is allowed to load at all, with Pinterest's native flags used to refine behavior once consent is granted.

Step-by-Step Integration with a Third-Party CMP

The reliable integration pattern is identical to other major pixels: stop the Tag from firing at page load, hand control to the CMP, and let the CMP load and configure the Tag when the visitor accepts the marketing category. The specifics for Pinterest follow.

1. Remove the inline base code

Pinterest provides a base code snippet that installers typically paste into the document head. Remove it. Replace it with a placeholder that your CMP can rewrite later — most CMPs do this by changing the type attribute from text/plain to text/javascript and adding a data-category="marketing" attribute.

2. Map the Tag to the marketing category

Pinterest's tag touches both analytics-like events (PageVisit) and pure advertising events (Purchase, AddToCart). For audit defensibility the entire snippet should sit under the marketing category, not the analytics category. The conservative reading of the EDPB guidance treats any pixel that feeds an ad platform as marketing irrespective of which event type fires.

3. Configure the load callback

When the visitor grants marketing consent, your CMP fires an event. In that handler, rewrite the Tag placeholder back to text/javascript, append it to the document, and let it execute. The base code initializes a global pintrk queue, then loads the core script. After the script is loaded, any queued events from the page flush automatically.

4. Route per-event consent for Limited Data Processing

If you have California traffic and want to use Pinterest's Limited Data Processing path for users who have not opted in, push the appropriate data_processing_options on each event call. Pinterest accepts a value like ['LDU'] with country and region codes to flag the event as restricted-use. This is not a substitute for consent in the EU — it is a CCPA-specific mechanism — but it is the right pattern for users who have rejected sale or sharing under California rules.

5. Bridge to Consent Mode v2 if you run Google tags alongside

Most stores running the Pinterest Tag also run Google Ads and GA4. Your CMP must publish the v2 signals — ad_storage, analytics_storage, ad_user_data, ad_personalization — into the dataLayer before any Google tag fires. Pinterest does not consume these signals natively, but Google does, and inconsistency between the two stacks will show up as a measurable revenue gap in your attribution reports.

The Conversions API as a Server-Side Alternative

Pinterest's Conversions API lets you send conversion events directly from your server to Pinterest, bypassing the browser entirely. This is increasingly attractive for two reasons: it survives third-party cookie deprecation, and it sidesteps some of the consent fragility of the browser-side Tag because the server has clearer information about who consented to what.

Conversions API does not eliminate the consent requirement. The events you send still carry personal data, and the GDPR applies the same way regardless of whether the request originates from a browser or a backend service. What it does do is move the decision point from "did the Tag fire before consent" to "did our server include this event in the API payload" — a much more controllable surface. For most stores the right pattern is to run both: the browser Tag for real-time attribution when consent is granted, the Conversions API for deduplicated, server-side events that can be filtered by stored consent state before they leave.

Common Pitfalls

Three integration mistakes account for most of the issues we see when auditing Pinterest installations.

Treating PageVisit as analytics

Some teams gate Purchase and AddToCart behind marketing consent but allow PageVisit to fire under the analytics category, on the reasoning that a pageview is "just analytics". Pinterest does not see it that way — PageVisit feeds the retargeting audience builder, which is unambiguously a marketing function. Gate the whole Tag.

Hardcoding the Pinterest base code in a tag manager without consent guards

If you install the Tag via Google Tag Manager, the Pinterest tag template needs the Additional Consent field set to require marketing consent before firing. Without that flag, GTM will fire the Tag regardless of the visitor's CMP state, and the consent banner becomes decorative.

Sending Enhanced Match without checking consent first

Pinterest supports Enhanced Match, which lets you hash and pass identifiable user data (email, phone) to improve attribution. Sending Enhanced Match for a user who has not granted marketing consent is the highest-risk pattern in this stack — it is a direct transfer of personal data to a US ad platform without lawful basis. Make Enhanced Match conditional on the same consent signal as the rest of the Tag.

Audit Checklist

Six concrete questions to answer for any Pinterest Tag deployment touching EU, UK, or California traffic.

• Does the Tag wait for consent? Open the page in a private window with strict tracking protection and confirm no s.pinimg.com requests fire before the banner is accepted.
• Is the marketing category mapped correctly? Verify the CMP places the Tag under marketing, not analytics or functional.
• Does GTM honor consent? If the Tag is installed via Google Tag Manager, confirm the Additional Consent setting is configured.
• Is Limited Data Processing routed for California? For CCPA opt-outs that still allow tracking under LDP, confirm data_processing_options is on every event.
• Is Enhanced Match conditional? Confirm Enhanced Match payloads only ship for users who have granted marketing consent.
• Does the Conversions API mirror browser consent? If you run both surfaces, confirm the server-side path filters events by stored consent state before forwarding.

Where Pinterest Fits in a Consent-First Stack

Pinterest is a smaller piece of the marketing pixel landscape than Meta or Google, but the regulatory treatment is identical. The pattern that works is the same pattern that works for every major ad platform: keep the Tag out of the page until the visitor accepts marketing, use the CMP as the single source of truth for consent state, and configure the platform's own privacy flags (Limited Data Processing, the Conversions API's consent fields) to align with what the banner recorded. Brands that get this right preserve their Pinterest attribution while reducing audit exposure to a fraction of what a default install carries.