OnePress Social Locker

What OnePress Social Locker is

OnePress Social Locker is a WordPress plugin that hides a piece of content until the visitor performs a social action such as a like, a share or a tweet. To offer those actions it embeds widgets and software development kits from social networks like Facebook, Twitter and LinkedIn. The plugin itself runs on the website server, but the social widgets it loads are operated by large platforms based mainly in the United States. This makes it far more than a layout tool from a privacy perspective.

What data and cookies it collects

When the social widgets load, the networks receive the visitor IP address, the page URL and device information, and they set their own cookies in the browser. These cookies are typically used for advertising and cross site tracking, not just for the share button. The plugin also stores a local marker, through a cookie or local storage, to remember that a visitor has already unlocked the content. The combination means several third party tracking cookies can be placed as soon as the locker appears.

GDPR and ePrivacy implications

Loading the third party widgets writes and reads cookies that are not strictly necessary, so Art. 5(3) of the ePrivacy Directive requires prior consent. The data sent to the social networks is personal data, and because the platforms often act as independent or joint controllers, the website operator must clarify the roles. The lawful basis for the processing is consent under Art. 6(1)(a) of the GDPR. A particular concern is whether consent is freely given when access to content is conditioned on a social action.

Consent requirements

No social widget should load and no cookie should be set before the visitor gives explicit consent. The widgets must therefore be blocked by your consent management platform until opt in, and the banner should name the networks involved and the United States transfer. Because the GDPR requires consent to be freely given, you should make sure visitors are not unfairly coerced, for example by offering an alternative path to the content. Visitors must be able to refuse and to withdraw consent without detriment.

International data transfers

The embedded networks are operated from the United States, so loading them transfers personal data to a third country. Meta, X, Microsoft and Google each receive data when their widget runs, and you must rely on a valid mechanism such as the EU US Data Privacy Framework or Standard Contractual Clauses with a transfer impact assessment. You should verify the current certification status of each provider and document supplementary measures where needed. Until consent is given and a safeguard is in place, the widgets should stay blocked.

Practical compliance steps

Block the Social Locker widgets behind a consent management platform so they load only after explicit opt in, and provide an alternative way to access valuable content so consent stays freely given. List every social network, its cookies and the United States transfer in your cookie policy and privacy notice. Keep records of consent and of the transfer safeguards, and review them regularly. If the risk remains high, consider replacing the locker with simple share buttons that load only on click.