Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Instafeed is a Shopify app that displays an Instagram feed on a store, including shoppable galleries that link posts to products. Rendering the feed loads content from Instagram and Meta, which can set cookies and receive visitor data, and the app sets its own cookies to cache and configure the widget. Under the GDPR and the ePrivacy Directive, these non essential cookies and the Meta connection require prior consent.
Instafeed is an application, primarily for Shopify, that embeds an Instagram feed on a storefront. It can show a brand latest posts, user generated content and shoppable galleries that connect Instagram images to products. Merchants use it to add social proof and drive sales from their Instagram presence.
To display the feed, Instafeed loads images and scripts from Instagram and Meta, which can set their own cookies and receive the visitor IP address, browser data and the page being viewed. Instafeed also sets cookies to cache the feed and remember widget settings. When content is loaded from Meta, the visitor browser communicates with Meta servers.
The Instafeed cache cookies and any cookies set by the embedded Meta content are not strictly necessary, so they fall under Article 5(3) of the ePrivacy Directive and require consent. The connection to Meta can transmit visitor data to a third party, so prior consent is needed before the feed loads, not only for the cookies but for the data sharing.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Block the Instafeed widget and the embedded Instagram content until the visitor has accepted the relevant cookie categories in a Consent Management Platform. The feed should load only after consent, so that no Meta resources are contacted and no cookies are set beforehand. Log consent and allow refusal as easily as acceptance.
Because the feed loads content from Instagram and Meta, rendering it can transfer visitor data to Meta in the United States. These transfers must rely on Standard Contractual Clauses or the EU US Data Privacy Framework, supported by a Transfer Impact Assessment. Where possible, prefer a configuration that proxies or caches images to limit direct contact with Meta.
List the Instafeed and Meta cookies and domains in your cookie policy and gate the feed behind consent. Use a CMP that defers the widget until opt in, document the Meta data sharing and transfer safeguards, and inform visitors that the feed connects to Instagram. Review the integration when Instafeed or Meta change how the feed loads.
Websites using Instafeed must obtain user consent under GDPR regulations.
DPIA considerations
Instafeed loads content from Instagram and Meta, which can set cookies and receive the visitor IP address, browser data and the page being viewed. Key DPIA considerations: (1) the Instafeed cache cookies and embedded Meta cookies are not strictly necessary and require consent; (2) the connection to Meta transmits visitor data to a third party; (3) data may be transferred to the United States, requiring safeguards; (4) a cached configuration reduces direct contact with Meta. A DPIA is advisable.
Sample consent text
We use Instafeed to display our Instagram feed. Instafeed sets cookies and loads content from Instagram and Meta, which can transmit data to Meta in the United States. You can withdraw your consent to non essential cookies at any time through our cookie settings.
Third-party domains contacted
instafeedapp.comwww.instagram.comscontent.cdninstagram.comgraph.facebook.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| instafeed_cache | Functional | 7 days | Caches the Instagram feed so it loads faster on repeat visits. |
| instafeed_widget | Functional | 1 year | Remembers the widget configuration and display state. |
| _fbp | Advertising | 3 months | Set by Meta when Instagram content is loaded, used for cross site tracking and advertising. |
Instafeed uses cookies for user preferences — inform visitors with a consent banner.
Instafeed sets cookies to cache the feed and remember widget settings, and the embedded Instagram and Meta content can set its own cookies. These are not strictly necessary, so they require consent. The Meta cookies in particular are associated with cross site tracking.
Yes. The feed loads content from Instagram and Meta, which can set cookies and receive visitor data, so under the GDPR and the ePrivacy Directive prior consent is required. The widget should not load and no Meta resources should be contacted until the visitor accepts.
The lawful basis is consent under Article 6(1)(a) GDPR, combined with Article 5(3) of the ePrivacy Directive for the cookies. Because loading the feed shares visitor data with Meta, legitimate interest is not sufficient and explicit opt in is required before the content loads.
Yes. Rendering the feed loads content from Meta in the United States, so visitor data can be transferred there. The transfer must rely on Standard Contractual Clauses or the EU US Data Privacy Framework with a Transfer Impact Assessment, and you should consider a cached or proxied configuration.
A DPIA may not be mandatory for a simple feed, but it is advisable because the integration shares visitor data with Meta and can support cross site tracking. Documenting the data sharing, the cookies and the US transfer helps demonstrate accountability.
Load Instafeed through a CMP that blocks the widget and the embedded Instagram content until consent, so no Meta resources load beforehand. Disclose the Instafeed and Meta cookies and domains, document the US transfer safeguards, and prefer a cached configuration that limits direct contact with Meta.
Other Instagram feed and user generated content apps include EmbedSocial, Elfsight, Tagembed and Foursixty, all of which face the same Meta connection considerations. A configuration that caches images on your own infrastructure rather than loading them live from Meta reduces the third party footprint.
Add the Instafeed and Meta cookies to your cookie policy with their purpose and duration, list the Instagram and Meta domains, and state that visitor data may be transferred to the United States. Explain that the feed connects to Instagram and keep the policy aligned with the configuration.