What Is fbclid? Meta's Click ID Explained

Q: What is the _fbc cookie format?

Meta's documented format is version.subdomainIndex.creationTime.fbclid. The version segment is always the literal string 'fb'. subdomainIndex records which domain level the cookie was set on ('com' = 0, 'example.com' = 1, 'www.example.com' = 2). creationTime is UNIX time in milliseconds when the value was stored. The fbclid itself is everything after the final dot. Meta recommends a 90-day expiration on the cookie.

fbclid is not proof of a paid click

This is the part almost everyone gets wrong, and it's worth leading with. Meta appends fbclid to outbound links from organic posts, shares and Messenger messages — not just paid ads. Google's gclid only ever appears on a paid ad click. The two parameters look like equivalents, and they aren't.

So when you see ?fbclid=… in your analytics, all you actually know is that the visitor arrived from a Meta property. If you segment "traffic with an fbclid" as paid social, you will overstate ad performance — sometimes badly, if you have a post that's being shared. To separate paid from organic, use your own UTM parameters on ad destination URLs; fbclid can't do that job.

The _fbc cookie format

fbclid is the raw parameter in the URL. _fbc is the first-party cookie your site builds from it, and it's _fbc — not the bare fbclid — that the Conversions API expects. Meta's documented format:

version.subdomainIndex.creationTime.fbclid

version — always the literal string fb.
subdomainIndex — which domain level the cookie was set on: com = 0, example.com = 1, www.example.com = 2.
creationTime — UNIX time in milliseconds when the value was stored (not seconds — a common bug).
fbclid — the raw value; everything after the final dot.

Meta recommends a 90-day expiration on the cookie, and recommends sending fbc with every event you post to the Conversions API — not only the ones where you think it matters.

If the Meta Pixel is installed, it will normally write _fbc for you when an fbclid is present. If you're building the value yourself — common when traffic passes through a bridge page or a redirect that drops the Pixel — assemble it in exactly this shape. A malformed _fbc is silently ignored rather than rejected loudly, which is why this failure can run for months unnoticed.

Who strips it

Firefox's Enhanced Tracking Protection strips fbclid in Strict mode — and its default strip list does not include Google's gclid. Out of the box, Firefox costs Meta attribution more than it costs Google. Brave strips both by default, for every user. Safari doesn't touch the URL in normal browsing but attacks the cookie through ITP, capping JS-set cookies well below Meta's recommended 90 days.

The full breakdown by browser — including what Safari 26's Link Tracking Protection does — is in the Click ID Survival Matrix.

Keeping fbclid through your funnel

On landing. Read fbclid from the query string immediately and write _fbc first-party, on your own domain. Do it before any redirect fires.
Through the flow. Affiliate-network redirects that strip unknown parameters are the most common way fbclid disappears. Verify the parameter survives every hop by clicking a real ad and checking what actually arrives.
At conversion. Send fbc (and fbp, from the _fbp cookie) in the Conversions API payload. These are user-matching signals, sent unhashed. They are not the deduplication key — that's event_id, covered in Conversion API vs Pixel.

Common fbclid failure modes

Counting it as paid traffic. The reporting error above. Organic shares carry fbclid too.
Seconds instead of milliseconds. A creationTime in seconds produces a valid-looking _fbc that matches poorly.
Sending the bare fbclid. The API wants the assembled fb.… value, not the raw parameter.
Relying on the browser to carry it. Firefox-Strict and Brave users simply won't deliver it. Capture early, replay server-side.

For how fbclid compares with the other platforms' identifiers, see the click ID explainer; for the full capture-and-forward build, the tracking-setup playbook.

Frequently asked questions

What is fbclid?

fbclid, the Facebook Click ID, is a tracking parameter Meta appends to an outbound URL when someone clicks a link on Facebook, Instagram, Messenger or Threads. Your site captures it into the _fbc cookie and sends it back with conversion events through the Meta Conversions API, letting Meta match the conversion to the click that produced it.

Why do I see fbclid on traffic that isn't from an ad?

Because Meta appends fbclid to outbound links from organic posts, shares and Messenger messages too — not only paid ads. This is the single biggest difference between fbclid and Google's gclid, which only ever appears on paid ad clicks. An fbclid in your analytics tells you the visitor came from a Meta property; it does not tell you they came from an ad. Treating every fbclid visit as paid traffic will overstate your ad performance.

What is the _fbc cookie format?

Meta's documented format is version.subdomainIndex.creationTime.fbclid. The version segment is always the literal string fb. subdomainIndex records which domain level the cookie was set on (com = 0, example.com = 1, www.example.com = 2). creationTime is UNIX time in milliseconds when the value was stored. The fbclid itself is everything after the final dot. Meta recommends a 90-day expiration on the cookie.

Does Firefox strip fbclid?

Firefox's Enhanced Tracking Protection strips fbclid in Strict mode — and notably does not strip Google's gclid in the same default list, so out of the box Firefox hurts Meta attribution more than Google's. Brave strips both by default. The fix is the same either way: capture fbclid on landing, store it first-party, and replay it server-side through the Conversions API rather than relying on the browser to carry it to conversion.