> How to embed Outbrain Widgets in compliance with GDPR and ePrivacy. Cookies, profiling, US transfers and consent management. > > Canonical: https://www.flowconsent.com/en/services/advertising/outbrain-widgets Advertising # Outbrain Widgets Marketing Outbrain Widgets is a native advertising and content recommendation product that publishers embed at the bottom of articles to monetise their inventory through sponsored links. [Block Outbrain Widgets until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=advertising) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Advertising](https://www.flowconsent.com/en/services/advertising) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 5 - Servers United States Overview ## What does Outbrain Widgets do? ## **What Outbrain Widgets is** Outbrain Widgets is the native advertising and content recommendation surface that powers the You may also like blocks at the bottom of countless news and media sites. Publishers embed a JavaScript widget which loads sponsored stories alongside editorial content, and Outbrain monetises clicks on a cost per click basis. ## **What data Outbrain collects** Outbrain sets first and third party cookies, captures the IP address, user agent, page URL, referrer, hashed identifiers and browsing events on the publisher pages where the widget loads. Across the Outbrain publisher network, this data is aggregated to build content interest profiles used for recommendation personalisation and for advertiser targeting. ## **GDPR and ePrivacy implications** Cookie storage falls under Article 5(3) of the ePrivacy Directive, content profiling and personalised recommendations require consent under Article 6(1)(a) GDPR, and the IAB TCF v2.2 framework signal must be passed when relying on it. The publisher and Outbrain operate as joint controllers for the targeting purposes. ## **Consent requirements** Block the Outbrain widget script until the visitor has accepted the marketing or advertising category in your consent banner. Provide a contextual fallback widget for visitors that decline. Honour withdrawal by stopping events and clearing the obuid identifier. ## **Data transfers** Outbrain Inc. is a US company that processes data both in the European Union and in the United States and shares it with affiliates and advertising partners. Transfers from the EEA require certification under the EU US Data Privacy Framework or Standard Contractual Clauses with a transfer impact assessment. ## **Practical compliance steps** Sign the Outbrain joint controller addendum, list Outbrain Inc. and its sub processors in your privacy policy, run a DPIA, deploy a CMP that reliably blocks the widget before consent and offer a non personalised contextual mode for visitors who refuse. Compliance ## Outbrain Widgets and the GDPR Outbrain Widgets is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Article 6(1)(a) GDPR (consent) and Article 5(3) ePrivacy Directive for cookie storage and reading - Risk level high - Applicable regulations GDPR, ePrivacy Directive, PECR, IAB TCF v2.2 ### Impact assessment (DPIA) A DPIA is recommended because Outbrain combines cross site tracking, content based profiling and onward sharing with a wide network of advertisers and US sub processors. ### Sample text for your banner > I agree that Outbrain reads and writes cookies on my device, builds a content profile from my browsing across the Outbrain network and uses this profile to personalise sponsored recommendations, including transfers outside the European Economic Area. Cookies and trackers ## What Outbrain Widgets sets and contacts - Tracking method JavaScript widget that loads native content recommendations through cookies, pixels and a unique browser identifier across the Outbrain publisher network - Server location United States - Data transferred outside the EU Outbrain Inc. is headquartered in the United States with EU regional infrastructure. Cross border transfers occur within the Outbrain corporate group and to onward partners. ### Cookies set (4) | Name | Type | Duration | Purpose | | ------------- | ------------ | --------- | ------------------------------------------------------------------------------------------------------------------------------ | | obuid | http\_cookie | 1 year | Persistent Outbrain user identifier used to recognise the visitor across the publisher network and personalise recommendations | | criteo | http\_cookie | 13 months | Criteo sync cookie used by Outbrain for cross network frequency capping and audience matching | | OB-USER-TOKEN | http\_cookie | 1 year | Outbrain authentication and session token used by user level features such as opt out preferences | | apnxs | http\_cookie | 90 days | AppNexus sync cookie used by Outbrain when partner exchanges are involved in the recommendation auction | ### Third-party domains contacted (5) - `outbrain.com` - `widgets.outbrain.com` - `amplify.outbrain.com` - `tr.outbrain.com` - `log.outbrainimg.com` Questions ## Frequently asked questions about Outbrain Widgets Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Outbrain Widgets set? Outbrain sets advertising cookies, including the obuid persistent identifier on outbrain.com, criteo and other partner sync cookies, plus first party cookies on the publisher domain that link the visitor to the Outbrain network identifier. ### Is consent required to embed Outbrain Widgets? Yes. The widget loads a third party script that stores cookies and reads identifiers, so Article 5(3) of the ePrivacy Directive requires prior, freely given consent. Several EU regulators have published findings against publishers loading Outbrain before consent. ### What legal basis applies? Article 6(1)(a) GDPR (consent) is the only valid basis. The processing is profiling for content personalisation and advertising and is excluded from legitimate interest under EDPB guidance. ### Are user data transferred to the United States? Yes. Outbrain Inc. is a US company. Transfers from the EEA require certification under the EU US Data Privacy Framework or Standard Contractual Clauses with a transfer impact assessment. ### Do I need a DPIA for Outbrain Widgets? A DPIA is recommended. The widget combines profiling, cross site tracking and onward sharing with a wide network of advertisers, factors that meet the EDPB criteria for high risk processing. ### How do I implement Outbrain Widgets in a compliant way? Block the widget script behind your CMP. Use the Outbrain non personalised mode for visitors who refuse. Sign the joint controller addendum. Document the integration in your record of processing activities. ### Are there alternatives to Outbrain Widgets? Editorial only related articles modules, contextual recommendation engines hosted in the EU and first party recirculation widgets are alternatives that avoid third party tracking and reduce transfer risk. ### How should I update my cookie or privacy policy? List Outbrain Inc. as a joint controller and processor with the categories of data (cookies, IP, browsing events, hashed identifiers), purposes (recommendations, advertising, measurement), retention, US transfer mechanism and a direct opt out link. Same category ## More services: Advertising [See the whole category](https://www.flowconsent.com/en/services/advertising) ### [Assertive Yield](https://www.flowconsent.com/en/services/advertising/assertive-yield) [Assertive Yield is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Assertive Yield provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Assertive Yield helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/assertive-yield) [Marketing](https://www.flowconsent.com/en/services/advertising/assertive-yield) · ### [Adform](https://www.flowconsent.com/en/services/advertising/adform) [Adform is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Adform enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Adform empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/adform) [Marketing](https://www.flowconsent.com/en/services/advertising/adform) · ### [Bothive](https://www.flowconsent.com/en/services/advertising/bothive) [Bothive is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Bothive provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Bothive helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/bothive) [Marketing](https://www.flowconsent.com/en/services/advertising/bothive) · ### [Forsant](https://www.flowconsent.com/en/services/advertising/forsant) [Forsant is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Forsant provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Forsant helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/advertising/forsant) [Marketing](https://www.flowconsent.com/en/services/advertising/forsant) · ### [ToneDen](https://www.flowconsent.com/en/services/advertising/toneden) [ToneDen is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. ToneDen enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, ToneDen empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/advertising/toneden) [Marketing](https://www.flowconsent.com/en/services/advertising/toneden) · ### [Upstack Data](https://www.flowconsent.com/en/services/advertising/upstack-data) [Upstack Data is a data management and processing platform that helps businesses collect, organize, and activate their data assets. It provides data integration, transformation, and governance tools for reliable pipelines. Upstack Data supports real-time and batch processing, quality monitoring, and compliance management. With connectors to major data sources and destinations, Upstack Data enables organizations to unify their data infrastructure and drive informed decision making.](https://www.flowconsent.com/en/services/advertising/upstack-data) [Marketing](https://www.flowconsent.com/en/services/advertising/upstack-data) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)