> Disqus and GDPR: which cookies Disqus sets, why prior consent is required, how to block the comments until consent is given and what to add to your policy. > > Canonical: https://www.flowconsent.com/en/services/social-media/disqus Social media # Disqus Marketing · [Official website](https://disqus.com) Disqus is a third-party comment hosting platform that enables website owners to embed a discussion section directly into their pages. It loads a JavaScript widget that sets persistent tracking cookies and builds cross-site user profiles for advertising purposes. Under GDPR and the ePrivacy Directive, loading Disqus requires prior user consent because it deploys third-party tracking cookies and transfers personal data to Disqus Inc. in the United States before any comment is posted. [Block Disqus until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=social) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Social media](https://www.flowconsent.com/en/services/social-media) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 4 - Servers United States Overview ## What does Disqus do? ## **What is Disqus?** Disqus is a cloud-based comment hosting platform founded in 2007, now owned by Zeta Global and headquartered in the United States. It is embedded on millions of websites as a third-party JavaScript widget that replaces or supplements native comment systems. When a visitor loads a page where Disqus is embedded, the script contacts Disqus servers, loads the comment thread, and simultaneously sets tracking cookies, regardless of whether the visitor interacts with the comment section. Disqus is widely used for its ease of integration, spam filtering, and social login options, but its tracking behaviour raises significant GDPR and ePrivacy compliance concerns for any website targeting European visitors. ## **What data and cookies does Disqus collect?** When Disqus loads, it sets several persistent cookies including disqus\_unique (a unique visitor identifier), \_\_jid (session tracking), and G\_AUTHUSER\_H (authentication state for social login). Disqus collects the visitor IP address, browser fingerprint, referring URL, pages visited, and interaction data. If the visitor is logged into a Disqus or social account, this browsing data is linked to a personal profile. The collected data is used to serve targeted advertising across the Disqus ad network and is shared with advertising partners. The cross-site nature of the Disqus cookie means data is collected even on websites the visitor has never directly engaged with. ## **GDPR and ePrivacy implications** Disqus falls squarely within the scope of the ePrivacy Directive because it stores and reads third-party tracking cookies on the user device. Under Article 5(3) of the ePrivacy Directive, prior informed consent is required. Under GDPR Article 6(1)(a), processing personal data for advertising profiling also requires consent. Legitimate interest cannot serve as the legal basis for cross-site tracking used for advertising, as confirmed by multiple EU data protection authority decisions. Loading Disqus without prior consent constitutes a violation of both the ePrivacy Directive and GDPR. ## **Data transfers to the United States** Disqus is a US company and processes all data on US-based servers. Data transfers from the EU to the US are subject to GDPR Chapter V requirements. Disqus relies on the EU-US Data Privacy Framework (DPF) for transatlantic transfers. Website owners must verify that Disqus maintains a valid DPF certification and must disclose these transfers in their privacy policy. If DPF certification lapses or is invalidated by a future court ruling, Standard Contractual Clauses (SCCs) are required as a fallback transfer mechanism. ## **Consent requirements and implementation** The only valid legal basis for embedding Disqus on a website targeting EU visitors is freely given, specific, informed, and unambiguous consent. Disqus must not be loaded until the visitor actively accepts the relevant cookie category. The script tag must be blocked by default and only activated after consent is recorded. A consent management platform (CMP) that supports third-party script blocking for comment embeds is required. Visitors must be able to withdraw consent as easily as they gave it, which means the comment section must unload when consent is revoked. ## **Practical compliance steps** To use Disqus in compliance with GDPR and ePrivacy: (1) Block the Disqus embed script by default using a CMP with script-blocking capabilities. (2) Show a placeholder with a clear consent notice in place of the comment section before consent is given. (3) List Disqus in your cookie policy under the advertising or social media category with accurate cookie names and durations. (4) Disclose the US data transfer and the applicable transfer mechanism (DPF or SCCs) in your privacy policy. (5) Include Disqus in your record of processing activities and assess whether a DPIA is required. (6) Consider privacy-friendly self-hosted alternatives such as Commento or Remark42 if consent acceptance rates are low. Compliance ## Disqus and the GDPR Disqus is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for advertising profiling and cross-site tracking. No other legal basis applies to the advertising and third-party tracking components of Disqus. - Risk level high - Applicable regulations GDPR (EU) 2016/679, ePrivacy Directive 2002/58/EC, CCPA (California) ### Impact assessment (DPIA) A DPIA should be considered for websites with significant EU traffic that embed Disqus, given that Disqus builds cross-site advertising profiles and transfers data to the US. The combination of persistent tracking cookies, cross-site audience profiling, and third-country data transfers constitutes high-risk processing under Art. 35 GDPR. ### Sample text for your banner > We use Disqus to provide a comments section on this website. Disqus uses cookies and collects data about your browsing activity to build audience profiles for advertising. Data is transferred to and processed by Disqus Inc. in the United States. Please accept to load the comments section. Cookies and trackers ## What Disqus sets and contacts - Tracking method Third-party JavaScript embed (embed.js) loaded from disqus.com, persistent cross-site tracking cookies, audience profiling for advertising, social login integration with Google and Facebook - Server location United States - Data transferred outside the EU Personal data including browsing history and advertising identifiers is transferred to Disqus Inc. (Zeta Global) in the United States. Transfers rely on the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs). ### Cookies set (4) | Name | Type | Duration | Purpose | | -------------- | ---------- | -------- | --------------------------------------------------------------------------------------- | | disqus\_unique | persistent | 2 years | Assigns a unique identifier to the visitor for comment tracking and moderation purposes | | \_\_jid | session | session | Stores Disqus session data to maintain user login state in the comment widget | | G\_AUTHUSER\_H | persistent | 1 year | Stores the authenticated Google user index for single sign-on in Disqus | | disqusauth | persistent | 1 year | Authentication token used to keep the user logged in to Disqus across sessions | ### Third-party domains contacted (4) - `disqus.com` - `c.disquscdn.com` - `disqusads.com` - `referrer.disqus.com` Questions ## Frequently asked questions about Disqus Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Disqus require GDPR consent to load? Yes. Disqus sets persistent cross-site tracking cookies as soon as the page loads, before any visitor interaction. Under the ePrivacy Directive, prior consent is required for any non-essential cookie stored on a user device. Under GDPR, the advertising profiling carried out by Disqus also requires consent under Art. 6(1)(a). You must block the Disqus script until the visitor actively accepts the relevant cookie category. ### What cookies does Disqus set? Disqus sets several persistent cookies: disqus\_unique (a cross-site visitor identifier, 2 years), \_\_jid (session tracking, session duration), G\_AUTHUSER\_H (social login authentication state, 2 years), and disqusauth (Disqus login token, 1 year). These cookies enable visitor identification, session management, social authentication, and cross-site audience profiling for advertising purposes. ### What is the legal basis for using Disqus under GDPR? The only valid legal basis for loading Disqus on a website targeting EU visitors is consent under Article 6(1)(a) GDPR. Legitimate interest cannot be relied upon for cross-site tracking used for advertising profiling, as confirmed by multiple EU data protection authority decisions. No other legal basis applies to the advertising and tracking components of Disqus. ### Does Disqus transfer data to the United States? Yes. Disqus is owned by Zeta Global and processes all data on US-based servers. Data transfers from the EU to the US are subject to GDPR Chapter V. Disqus relies on the EU-US Data Privacy Framework (DPF) for these transfers. You must disclose this transfer in your privacy policy and verify that Disqus maintains a valid DPF certification. If the DPF is invalidated, Standard Contractual Clauses (SCCs) must be in place as a fallback. ### Do I need a DPIA to embed Disqus? A Data Protection Impact Assessment (DPIA) should be considered if your website has significant EU traffic and embeds Disqus, particularly because Disqus combines persistent cross-site tracking, advertising audience profiling, and US data transfers. These three factors together constitute high-risk processing under Article 35 GDPR, which may trigger the DPIA requirement. Consult with your DPO to determine whether a formal DPIA is necessary. ### How do I implement GDPR-compliant consent for Disqus? Use a consent management platform (CMP) that supports third-party script blocking. Configure the CMP to block the Disqus embed script by default and inject it only after the visitor actively accepts the advertising or social media cookie category. Display a consent-gated placeholder in place of the comment section before consent is given. Ensure that consent withdrawal removes the Disqus widget from the page and stops all associated data processing. ### Are there privacy-friendly alternatives to Disqus? Yes. Several self-hosted comment systems avoid third-party data transfers entirely. Commento and Remark42 are open-source alternatives that run on your own infrastructure with no cross-site tracking or advertising profiling. For websites that prioritise privacy compliance, a native WordPress comment system or a fully self-hosted solution is the most GDPR-compliant option for user-generated comments. ### How do I document Disqus in my cookie policy and privacy notice? In your cookie policy, list each Disqus cookie (disqus\_unique, \_\_jid, G\_AUTHUSER\_H, disqusauth) with its name, category (advertising or social media), duration, and purpose. In your privacy notice, include Disqus as a third-party processor, describe its advertising profiling activities, state the legal basis (consent), and disclose the US data transfer with the applicable mechanism (DPF or SCCs). Update both documents whenever Disqus changes its cookie behaviour. Same category ## More services: Social media [See the whole category](https://www.flowconsent.com/en/services/social-media) ### [BuddyPress](https://www.flowconsent.com/en/services/social-media/buddypress) [BuddyPress is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. BuddyPress offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, BuddyPress empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/social-media/buddypress) [Preferences](https://www.flowconsent.com/en/services/social-media/buddypress) · ### [Commento](https://www.flowconsent.com/en/services/social-media/commento) [Commento is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Commento integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Commento helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/social-media/commento) [Preferences](https://www.flowconsent.com/en/services/social-media/commento) · ### [RiteKit](https://www.flowconsent.com/en/services/social-media/ritekit) [RiteKit is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. RiteKit provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, RiteKit helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/social-media/ritekit) [Marketing](https://www.flowconsent.com/en/services/social-media/ritekit) · ### [Vicomi](https://www.flowconsent.com/en/services/social-media/vicomi) [Vicomi is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Vicomi supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Vicomi enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/social-media/vicomi) [Analytics](https://www.flowconsent.com/en/services/social-media/vicomi) · ### [Vuukle](https://www.flowconsent.com/en/services/social-media/vuukle) [Vuukle is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Vuukle supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Vuukle ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/social-media/vuukle) [Marketing](https://www.flowconsent.com/en/services/social-media/vuukle) · ### [Twikoo](https://www.flowconsent.com/en/services/social-media/twikoo) [Twikoo is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Twikoo integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Twikoo helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/social-media/twikoo) [Preferences](https://www.flowconsent.com/en/services/social-media/twikoo) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)