Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Microblogging social platform owned by Automattic. Embedded posts and share buttons set advertising and profiling cookies and send visitor data to the United States.
Tumblr is a microblogging and social networking platform owned by Automattic Inc. Website owners commonly embed Tumblr posts using iframes served from embed.tumblr.com and assets.tumblr.com, or add share buttons that let visitors reblog content. Because Tumblr shows advertising, these integrations bring the platform advertising and profiling technologies onto your website.
When a Tumblr embed or share button loads, the visitor browser connects to Tumblr domains, which receive the IP address, user agent and referring page. Tumblr sets cookies such as anon_id on the srvcs.tumblr.com domain along with identifiers used for advertising and audience measurement. These cookies can recognise the same browser across different sites, which is why they are treated as profiling technologies rather than strictly necessary cookies.
Under the ePrivacy Directive, storing or reading non essential cookies on a visitor device requires prior consent. Because Tumblr embeds set advertising and profiling cookies, the lawful basis under the GDPR is consent under Article 6(1)(a). Loading the embed before consent is given, or treating these cookies as necessary, would breach both the ePrivacy rules and the GDPR.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
You must obtain explicit consent through a cookie banner before the Tumblr embed loads, and block the iframe until the visitor agrees. The same action transfers personal data to Automattic in the United States, a third country, so the transfer relies on the EU Standard Contractual Clauses. Your privacy notice should disclose the United States transfer and the safeguards in place.
Use a consent management platform to keep Tumblr embeds blocked until consent, list Tumblr and its cookies in your cookie policy, and document the United States transfer in your records. For a fully cookieless approach, replace live embeds with a static screenshot or a plain hyperlink to the original post, which loads nothing from Tumblr and sets no cookies.
Websites using Tumblr must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is recommended because Tumblr embeds set advertising and profiling cookies and enable cross site tracking. Assess the volume of visitors exposed, the transfer of IP addresses to the United States under SCCs, and the lack of control over Automattic's downstream processing. Consider replacing live embeds with static links or screenshots to remove the processing entirely.
Sample consent text
We use Tumblr to display embedded posts and share buttons. When you allow this content, Tumblr (Automattic Inc.) may set advertising and profiling cookies and transfer your data to the United States. Do you consent to loading Tumblr content?
Third-party domains contacted
tumblr.comembed.tumblr.comassets.tumblr.compx.srvcs.tumblr.comvt.tumblr.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| anon_id | Third-party | 1 year | Anonymous advertising identifier set on srvcs.tumblr.com to recognise the browser for ad delivery and frequency capping. |
| pfg | Third-party | Session to persistent | Tumblr advertising and personalisation cookie used to tailor and measure ads on embedded content. |
| pfs | Third-party | Persistent | Tumblr advertising state cookie that supports ad delivery and measurement across page views. |
| pfu | Third-party | Persistent | Tumblr user level advertising cookie used to associate ad interactions with a profile. |
| palette | Third-party | 1 year | Stores interface and display preferences for embedded Tumblr content. |
This service may collect user data. Ensure GDPR compliance with FlowConsent.
An embedded Tumblr post or share button connects to Tumblr domains and sets identifiers such as anon_id on srvcs.tumblr.com, along with advertising and audience measurement cookies. These recognise the browser across sites and are not strictly necessary.
Yes. Because Tumblr sets advertising and profiling cookies, you must obtain prior consent under the ePrivacy Directive and block the embed until the visitor agrees.
The legal basis is consent under Article 6(1)(a) GDPR, since the cookies serve advertising and profiling rather than a strictly necessary function.
Yes. Tumblr is operated by Automattic in the United States, so loading an embed transfers the visitor IP and cookie data to a third country. Automattic relies on the EU Standard Contractual Clauses for these transfers.
A DPIA is recommended because Tumblr embeds enable advertising and cross site profiling and transfer data to the United States. Assess visitor volume, the nature of the tracking and the transfer safeguards.
Use a consent management platform that blocks the Tumblr iframe and share buttons until the visitor consents, list Tumblr in your cookie policy, and document the United States transfer in your records of processing.
You can link to the original Tumblr post or show a static screenshot. Both load nothing from Tumblr and set no cookies, removing the consent and transfer obligations entirely.
Add an entry naming Tumblr (Automattic Inc.), the cookies it sets, their advertising and profiling purpose, the United States transfer under the SCCs, and a link to Tumblr's privacy policy.