Smash Balloon Instagram Feed

The Smash Balloon plugin itself sets no tracking cookies. However, when images are loaded directly from Meta CDNs, the visitor browser may receive Meta cookies including datr (a browser identifier used for security and advertising lasting 2 years) and ig_did (an Instagram device identifier lasting 1 year). Enabling local image caching in the plugin settings prevents these Meta cookies from being set.

Consent is required if Instagram images are loaded directly from Meta CDNs, because Meta cookies may be set on page load. If you enable full local image caching so that all media is served from your own server, the direct browser to Meta connection is eliminated and prior consent may not be required, though you should still disclose the server side Instagram API connection.

Where Meta media is loaded directly in the visitor browser, the required legal basis is consent under Article 6(1)(a) GDPR and Article 5(3) ePrivacy. If images are fully self hosted via the plugin cache and no Meta cookies are set, legitimate interest under Article 6(1)(f) GDPR may be a viable basis for the server side Instagram API connection, provided you conduct a balancing test.

Yes, when images are loaded from Meta CDNs in the visitor browser. Meta Platforms Inc. is headquartered in the United States and visitor IP addresses and device data are transferred when the browser requests images from scontent.cdninstagram.com or fbcdn.net. Meta relies on the EU US Data Privacy Framework and standard contractual clauses. Enabling local image caching eliminates this direct browser to US transfer.

A DPIA should be considered for high traffic sites where Instagram images are loaded directly from Meta CDNs, as each page view exposes visitor data to Meta in the United States without prior consent. Key risks include the involuntary nature of the data transfer and the difficulty of obtaining informed consent for background CDN requests. Enabling local image caching substantially reduces this risk.

Enable local image caching in the plugin settings to prevent direct browser to Meta connections. If caching is not used, gate the Instagram feed behind a consent check using your consent management platform. Add Meta and Instagram to your cookie policy. Disclose the server side Instagram Graph API connection in your privacy notice. Document any remaining US data transfer and the applicable transfer mechanism.

Self hosting all Instagram images via the plugin cache is the most privacy friendly configuration and may eliminate the need for prior consent. Alternatively, display static screenshots of your Instagram posts hosted on your own server with a link to your Instagram profile. This eliminates all Meta CDN connections and Meta cookie risk entirely.

If Instagram images are loaded from Meta CDNs, add Meta and Instagram to your cookie policy listing datr (2 years, security and advertising identifier) and ig_did (1 year, Instagram device identifier). State that visitor IP and device data may be transferred to Meta in the United States under the EU US Data Privacy Framework. If you use full local image caching, note that no Meta cookies are set and describe the server side Instagram API connection.