Postano

What is Postano?

Postano was a social media aggregation and visualisation platform. Brands and event organisers used it to collect posts by hashtag, account or keyword from networks such as Instagram, X (formerly Twitter), Facebook, YouTube and Tumblr, moderate them, and publish the result as a "social wall" or hub on a website, in a mobile app, on stadium and event screens or on in store digital signage. Its clients included sports teams, media groups and retail brands. Postano started in Chicago, was owned by TigerLogic, and was acquired by Sprinklr in March 2016; Sprinklr relaunched the technology in 2017 as Sprinklr Display, part of its customer experience platform.

Today postano.com no longer serves a product site: the domain redirects to an Amazon S3 bucket that returns an access denied error. Websites that still carry a Postano embed code are therefore running a legacy integration that may be broken or unmaintained, while organisations that need a social wall now use Sprinklr Display or another aggregator.

Data and cookies involved

A Postano wall was embedded with a JavaScript snippet or an iframe served from Postano's infrastructure. When a visitor opens the page, the browser requests the wall from Postano and the images, videos and avatars from the social networks' own servers, for example Instagram's CDN or pbs.twimg.com for X. Each request reveals the visitor's IP address, user agent and the page URL. Postano did not publish a cookie list, so any first or third party identifiers it used for engagement analytics are undocumented. Embedded video posts can add cookies from the network concerned, such as YouTube's VISITOR_INFO1_LIVE and YSC.

GDPR and ePrivacy implications

Two sets of rules apply. Under ePrivacy Directive art. 5(3), as applied by the French CNIL guidelines, German TDDDG § 25 and Spanish LSSI CE art. 22.2, any cookie or identifier stored by the wall or the embedded media needs prior consent unless strictly necessary, which social content is not. Under the GDPR, the website operator who chooses to embed third party content is a joint controller for the transmission of visitors' data to that third party, as the CJEU held in Fashion ID. The posts themselves also contain personal data of their authors, so republishing them requires a legal basis, transparency and a way to remove content on request.

Consent requirements

Because the wall pulls content and potentially cookies from Postano and social networks, the safest approach is to block it until the visitor consents, using a placeholder with a "load social content" button managed by your CMP. Do not rely on legitimate interest to load social media embeds automatically; several German courts and supervisory authorities have taken the view that transmitting IP addresses to third party servers without need or consent is unlawful. For event screens in a physical venue, inform attendees through signage that their public posts with the event hashtag may be displayed.

Data transfers outside the EEA

Postano and its successor Sprinklr are US companies, the postano.com domain is hosted in the AWS us-east-1 region, and the social networks whose content is displayed are mostly US based. Transfers can rely on the EU US Data Privacy Framework for certified recipients and on Standard Contractual Clauses (SCC 2021/914) otherwise, with a transfer impact assessment as required since Schrems II. Check the current Sprinklr DPA and hosting options if you use Sprinklr Display.

Practical compliance steps

Audit your pages for any remaining Postano embed code or requests to postano.com and remove them, since the service is discontinued. If you replace it, choose a solution that supports consent gating and document it in your cookie policy, privacy notice and record of processing. Configure your CMP to block the wall and embedded videos until consent, explain which networks receive data, and set up a process to remove posts at the author's request. Consider an EU based social wall tool such as Walls.io, operated by an Austrian company, and review the vendor DPA and hosting location before signing.