Instagram embed

What an Instagram embed actually loads

An Instagram embed is the official way to display a public post, reel, story highlight or profile inside another website. The integration consists of an iframe pointed at the instagram.com domain plus a small JavaScript file (embeds.js) hosted on Meta infrastructure. As soon as the iframe loads, the visitor browser contacts instagram.com, which reads and writes the same identifiers that Instagram uses on its own platform (datr, fr, ig_did, mid, and the c_user variant when the visitor is logged in). Even an apparently passive embed is a first party contact with Meta that triggers the same data flows as visiting instagram.com directly.

What data the embed shares with Meta

Meta receives the visitor IP address, the User Agent, the language, the referring URL (your page) and any cookies previously set on instagram.com. If the visitor is logged into Instagram or Facebook, Meta also receives the account identifier (c_user) and can re identify the visitor across the open web. The embed then becomes a piece of Meta tracking infrastructure on your domain. Without any Meta Pixel, the basic embed is enough for Meta to associate a visit to your page with a Meta Account and to feed its advertising graph.

GDPR, ePrivacy and Schrems II

The Instagram embed cannot rely on the strictly necessary exemption in Article 5(3) of the ePrivacy Directive because it is not essential to the requested service. It requires prior, informed and granular consent. On top of that, the transfer to Meta Platforms Inc in the United States is a Chapter V GDPR transfer. The CJEU in Schrems II (C 311/18) invalidated the Privacy Shield and EU regulators (CNIL, German DPAs, Italian Garante, EDPB) have repeatedly held that data sharing with Meta carries significant residual risk even under the EU US Data Privacy Framework due to US surveillance laws (FISA 702, Executive Order 12333).

Consent requirements and the two click pattern

The recommended pattern is the two click or click to load embed. The embed is replaced by a static placeholder until the visitor explicitly accepts. The placeholder must clearly state that the content comes from Instagram, that loading it transfers personal data to Meta in the US, and that the visitor can refuse. Acceptance must be opt in (no pre ticked boxes), as easy to refuse as to accept, and revocable through a persistent consent panel. CNIL has fined several French operators for loading Meta embeds before consent.

DPIA and risk assessment

Because the Instagram embed combines large scale processing by Meta, profiles that can reveal special category data (sexual orientation, political opinions, religion through the accounts visited) and a high risk international transfer, a DPIA is required in many EU member states. The DPIA must document the necessity of the embed, the proportionality of the data shared, the safeguards in place (consent, EU US DPF, SCCs, click to load) and the alternatives considered. Operators in regulated sectors (health, education, public administration) should generally avoid the embed.

Practical compliance and safer alternatives

Implement a click to load placeholder, expose Instagram in your consent banner as a social media or advertising vendor, and only fire the embed after granular consent. Document the processing in your Record of Processing Activities and update the privacy policy with the link to Meta privacy terms and the list of cookies set by instagram.com. Safer alternatives include hosting a screenshot of the post on your own CDN, using a static image with a link to the Instagram URL, or relying on official press use APIs that proxy the content without contacting Meta from the visitor browser.