FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Social media

Twitter Widgets

Marketing

Twitter Widgets (now also branded X Widgets) is the JavaScript library that lets a website embed live tweets, timelines, follow and share buttons, and conversation threads from X (formerly Twitter). The widgets load scripts from platform.twitter.com and platform.x.com, set X session and tracking cookies on the visitor's browser, and transmit IP, User-Agent and referrer back to X Corp. servers in the United States. For European publishers, this falls squarely under the ePrivacy consent requirement and the GDPR cross-border transfer regime.

Block Twitter Widgets until consentScan my site
Overview

What does Twitter Widgets do?

What are Twitter Widgets

Twitter Widgets (rebranded as X Widgets since 2023) are a family of embeddable components offered by X Corp. to render live X content on third-party websites. They include single embedded tweets, timelines, follow buttons, share buttons, and conversation threads. The widgets load JavaScript from platform.twitter.com or platform.x.com which then renders the content in iframes hosted on syndication.twitter.com or syndication.x.com.

Cookies and data collected

Twitter Widgets set or read cookies including guest_id, personalization_id, ct0, auth_token (if the user is logged into X), kdt and twid. They transmit the visitor's IP address, User-Agent, the URL of the embedding page, the referrer, screen resolution, language preferences, and (for logged-in users) the X account identifier. Data is sent to X Corp. in the United States.

GDPR, ePrivacy and DSA implications

Twitter Widgets fall squarely under Art. 5(3) ePrivacy: they set non-essential third-party cookies and require prior consent. X may also use embedded widget impressions to enrich advertising profiles, which the EDPB has repeatedly flagged in social plugin guidance. The widget operator (your website) may be a joint controller with X for the collection of personal data on page load, following the Fashion ID CJEU ruling. Since X is a Very Large Online Platform under the EU Digital Services Act, additional transparency obligations apply.

Data transfer to the United States

All data collected by the widget is processed by X Corp. in the United States. The transfer relies on the 2021 Standard Contractual Clauses and, where applicable, on X's certification under the EU-US Data Privacy Framework. Note that X has been subject to scrutiny by EU regulators about its data handling and has had its DPF certification status questioned in some periods; verify the current status before relying on it.

Consent management and lazy loading

The Twitter Widgets script must not be loaded before the visitor has consented to marketing or social media cookies. Implement a click-to-load pattern: show a placeholder with a Load tweet button and only inject the platform.twitter.com script once the user clicks or accepts the relevant CMP category. Cookieless alternatives include rendering a static screenshot of the tweet with a link to X.

Compliance checklist

1. Block the Twitter / X script behind your CMP. 2. Use click-to-load placeholders for individual tweets. 3. Document X Corp. in your privacy notice as a joint or independent controller, with US transfer disclosure. 4. Run a DPIA. 5. Consider EU-friendly alternatives such as Mastodon embeds or static screenshots. 6. Verify X's current DPF certification status. 7. Ensure the widget is removed from AMP pages where consent management is harder.

Compliance

Twitter Widgets and the GDPR

Twitter Widgets is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) required because Twitter widgets set non-essential third-party cookies and enable cross-site behavioural advertising profiling
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, EU Digital Services Act, AI Act (for AI-driven feeds), CCPA/CPRA

Impact assessment (DPIA)

Twitter Widgets transmit personal data to X Corp. every time the widget loads, even without user interaction. Key DPIA considerations: (1) third-party cookies (auth_token, guest_id, personalization_id) enable cross-site behavioural profiling; (2) X may correlate the visit with the user's logged-in X account, building a behavioural profile usable for ad targeting; (3) all data transferred to the United States; (4) X has been the subject of multiple national DPA decisions (Italian Garante, Irish DPC) raising concerns about lawful basis; (5) the DSA classifies X as a Very Large Online Platform (VLOP) with additional transparency obligations; (6) AI feed personalisation may trigger Art. 22 GDPR. A DPIA is required for any production embed on a European site.

Sample text for your banner

This page can embed live tweets and X (formerly Twitter) buttons. When loaded, the widget shares data with X Corp. in the United States, including your IP address, browser information, the URL of this page, and X cookies if you are logged in. We do not load the widget until you click below to accept. Read more in our cookie policy.
Cookies and trackers

What Twitter Widgets sets and contacts

Tracking method
Embedded JavaScript loaded from platform.twitter.com / x.com that renders tweets, timelines, follow buttons and share widgets. Loads iframes, third-party cookies and trackers from twitter.com and x.com
Server location
X Corp. (formerly Twitter, Inc.), San Francisco, United States. Global CDN edges.
Data transferred outside the EU
Personal data (IP, User-Agent, referrer, X account identifier if logged-in, browsing behaviour) is transferred to X Corp. servers in the United States. Transfers covered by 2021 Standard Contractual Clauses and, where applicable, by the EU-US Data Privacy Framework.

Cookies set (6)

NameTypeDurationPurpose
guest_idMarketing / Tracking2 yearsPersistent visitor identifier used by X to recognise the browser across visits and embedded widget impressions.
personalization_idMarketing / Advertising2 yearsUsed by X to personalise ads and content recommendations, including across sites that embed X widgets.
ct0Strictly necessary (X)SessionCSRF protection token for X interactions; required for logged-in widget actions like Like or Follow.
auth_tokenFunctionalPersistentAuthentication token set if the visitor is logged into X. Lets the widget recognise the X account and personalise.
twidFunctional6 yearsStores the X user identifier when logged in, allowing rapid recognition across widget loads.
kdtSecurity10 yearsTrusted-device identifier used by X for security checks on login.

Third-party domains contacted (8)

  • platform.twitter.com
  • platform.x.com
  • syndication.twitter.com
  • syndication.x.com
  • twitter.com
  • x.com
  • pbs.twimg.com
  • video.twimg.com
Questions

Frequently asked questions about Twitter Widgets

Can't find your question? Write to us, we answer fast.

Which cookies do Twitter / X Widgets set?

Common cookies include guest_id (visitor identifier, 2 years), personalization_id (cross-site ad personalisation, 2 years), ct0 (CSRF token), auth_token (logged-in session), kdt and twid. All are non-essential and require prior consent.

Do I need consent to embed a tweet?

Yes. Twitter / X Widgets set non-essential third-party cookies and transmit personal data (IP, browsing context) to X Corp. on page load, so prior consent under Art. 5(3) ePrivacy is required. Implement click-to-load so the widget only fetches after the visitor explicitly accepts.

What is the legal basis for embedding X content?

Consent (Art. 6(1)(a) GDPR) for the cookie placement and data transmission triggered by the widget. The embedding website may be a joint controller with X for this data collection, following the CJEU Fashion ID ruling, which means a Joint Controller Agreement (Art. 26 GDPR) is technically required, although in practice no agreement is offered by X.

Is data transferred to the United States?

Yes. X Corp. processes data in the US. The transfer relies on the 2021 Standard Contractual Clauses and, where applicable, on X's EU-US Data Privacy Framework certification. Note that the DPF status can change; check X's current public certification before relying on it.

Do I need a DPIA?

Yes for any production deployment, especially if you embed many widgets or run a site with significant European traffic. The combination of behavioural profiling, US transfer and potential joint controllership with a VLOP under the DSA satisfies multiple Art. 35(3) GDPR criteria.

How do I embed tweets in compliance?

Implement click-to-load: render a static placeholder (tweet author, date, preview text) and only inject the platform.twitter.com script after explicit consent. Document X Corp. in your privacy notice and cookie policy. Add joint controllership disclosure if relevant. Consider alternatives like static screenshots or Mastodon embeds.

What alternatives exist?

For EU-friendly alternatives: render a static screenshot of the tweet with a link to X, use server-side rendering of public tweet content (subject to X TOS), embed Mastodon or Bluesky instead, or use third-party privacy-friendly embed services like Iframely or Embedly with no-cookie mode.

How do I update my cookie policy?

List guest_id, personalization_id, ct0, auth_token and any other X cookies you observe in production with their purpose, duration and third-party source. In your privacy notice, identify X Corp. as a (joint) controller, disclose the US transfer with SCCs and DPF status, and link to X's privacy policy.

Same category

More services: Social media

See the whole category

Flowbox

Flowbox is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Flowbox enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Flowbox empowers marketing teams to achieve measurable growth.

Marketing

Bazaarvoice Curation

Bazaarvoice Curation is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Bazaarvoice Curation enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Bazaarvoice Curation empowers marketing teams to achieve.

Marketing

AddToAny

AddToAny is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. AddToAny integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, AddToAny helps organizations maintain robust websites that meet user expectations and technical requirements.

Marketing

Iframely

Iframely is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Iframely supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Iframely ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

Pleroma

Pleroma is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Pleroma integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Pleroma helps organizations maintain robust websites that meet user expectations and technical requirements.

Social media

SnapWidget

SnapWidget is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SnapWidget supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SnapWidget ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Marketing

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site