How Privacy Changes Are Affecting Your Facebook Advertising Results in Malaysia
If Facebook advertising results have felt less predictable over the past couple of years, that is not a coincidence or a sign the platform has stopped working. A handful of specific privacy changes, some from Apple, some from Malaysia’s own updated data protection law, have genuinely changed what an advertiser can measure and target. This article covers what actually changed, what did not, and what a business running Facebook advertising in Malaysia can still rely on.
TL;DR: Key takeaways
Facebook advertising results shifted because of real changes to tracking and consent, not because the platform got worse. When Apple’s App Tracking Transparency prompt first rolled out, the opt-in rate across all apps sat at only 11 to 15 percent, which permanently reduced how much cross app data advertisers could rely on. MYSense now builds every account around first party signals rather than assuming the old tracking model still applies.
- Apple’s tracking prompt cut cross app targeting data years ago, and that has not reversed
- Third party cookies were never actually removed from Chrome, despite years of warnings that they would be
- Malaysia’s updated PDPA adds consent and breach notification duties that touch ad data collection
- Meta’s own pixel still works, but it needs first party data behind it to stay accurate
- The accounts adapting fastest are the ones leaning on server side tracking, not the ad platform alone
Malaysia’s own data protection law changed substantially in 2025, with the Personal Data Protection (Amendment) Act 2024 coming into force in three phases between January and June 2025, introducing mandatory data protection officers and formal breach notification duties, and this sits alongside the platform level changes most advertisers already know about.
What privacy changes are actually affecting Facebook ad performance right now?
Three separate changes are behind most of what advertisers are noticing. Apple’s App Tracking Transparency prompt, introduced in 2021, reduced the volume of cross app data Meta could use for targeting and attribution, and that reduction has never reversed. Malaysia’s updated PDPA, in force since 2025, adds formal consent and data handling obligations that touch how businesses collect and store the data feeding their ad accounts. Third party cookies, despite years of warnings that they would disappear, are still present in Chrome, so the picture on measurement is more mixed than most summaries suggest.
None of these changes make Facebook advertising ineffective. What they change is which signals an account can rely on by default, and how much of the measurement work now falls on the advertiser rather than the platform.
Why Apple's tracking changes still shape Facebook advertising in Malaysia
Apple’s App Tracking Transparency framework requires apps to ask permission before tracking a user across other apps and websites. When it launched, Flurry’s own tracking showed the opt in rate across all apps settled at just 11 to 15 percent, with roughly a quarter of users opting in even among apps that displayed the prompt. That gap has persisted, and it means Meta’s ad delivery system now has meaningfully less cross app signal to work with than it did before 2021, for any business running ads to an iOS heavy audience in Malaysia.
The practical effect shows up as shorter attribution windows, audiences that take longer to optimise, and reporting that undercounts genuine conversions from iOS users. This is why server side tracking, sending conversion events directly from a business’s own server through Meta’s Conversions API rather than relying only on the browser or app based pixel, has become a standard part of account setup rather than an advanced option.
What changed, and what didn't, with third party cookies
Google announced in April 2025 that it would not deprecate third party cookies in Chrome after all, and formally shut down the Privacy Sandbox initiative that was meant to replace them in October 2025. Third party cookies remain active in Chrome, though Safari and Firefox continue to block them by default, so the cookie picture for a Facebook advertiser is now a patchwork rather than a single deadline.
This matters less for Facebook specifically than it does for display and programmatic advertising, since Meta’s own tracking relies primarily on its pixel and Conversions API rather than third party cookies. The bigger shift for Facebook advertisers has come from Apple’s changes and from platform side privacy defaults, not from the cookie story that dominated marketing headlines for several years.
Table 1: What changed in ad measurement, and what an advertiser can still rely on
|
Area |
Before the changes |
Current state |
|
iOS attribution |
Full cross app tracking by default |
Reduced signal, partial opt in only |
|
Malaysian data handling |
Guidance level PDPA obligations |
Mandatory DPO and breach notification |
|
Third party cookies |
Expected removal from Chrome |
Still active in Chrome, blocked elsewhere |
|
Conversion tracking |
Browser pixel alone was sufficient |
Server side tracking now standard practice |
|
Audience building |
Broad cross app lookalike data |
First party data carries more weight |
If your team has not reviewed how customer data flows into your ad accounts since these changes took effect, a social media agency in Malaysia can usually audit the setup faster than rebuilding the account from scratch.
How MYSense adjusts an account for the current privacy environment
The starting point is always the same regardless of sector: confirm whether Conversions API is properly connected and deduplicated against the pixel, check what percentage of conversions are being matched through first party data rather than browser signal alone, and review the consent and data handling process behind any customer lists used for targeting. In most reviews, the gap between reported and actual performance closes considerably once server side tracking is properly in place, without needing a larger budget.
Frequently Asked Questions About Privacy Changes and Facebook Advertising in Malaysia
No. The updated PDPA does not restrict advertising itself. It adds obligations around how personal data is collected, stored and reported if there is a breach, which affects the systems feeding an ad account rather than the ability to run ads on Facebook.
Not inherently. Reported performance can look weaker if tracking has not been updated to account for reduced iOS signal, but the underlying ability to reach and convert an audience on Facebook has not disappeared. It has become more dependent on how well an account’s measurement is set up.
Less than you might expect. Meta’s tracking relies mainly on its own pixel and Conversions API rather than third party cookies, so Google’s decision to keep cookies in Chrome has a smaller direct effect on Facebook specifically than it does on display advertising.
Connecting Meta’s Conversions API properly, with deduplication against the existing pixel, tends to have the largest single effect on reported accuracy. It restores a meaningful share of the conversion data that browser only tracking now misses.
Businesses need a clear lawful basis for collecting and using customer data, including data used for audience matching or lookalike targeting. This usually means a documented consent process and a privacy notice that covers how the data may be used for advertising.
The accounts adapting fastest treat measurement as the priority, not the platform
Facebook advertising in Malaysia has not become less effective because of privacy changes. It has become more dependent on how well an account is set up to measure what is actually happening, from server side tracking to a documented consent process for the data behind it.
If your account’s tracking has not been reviewed since Apple’s changes or Malaysia’s updated PDPA took effect, MYSense can walk through what is worth fixing first.
