Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
SoundCloud is a UK based music and audio streaming platform that publishers commonly embed on websites and blogs via the SoundCloud player iframe. The embed loads third party cookies and the SoundCloud advertising stack on the publisher page, even when the visitor does not press play.
SoundCloud is a music and audio streaming platform operated by SoundCloud Limited from London. The product is best known for the iframe player that publishers, journalists and podcasters embed on their websites. The embed loads w.soundcloud.com plus a JavaScript widget, and triggers the SoundCloud advertising and personalisation stack as soon as the iframe is included on the page.
The SoundCloud embed sets third party cookies on the soundcloud.com domain: sc_anonymous_id (anonymous visitor identifier), datadome (anti bot challenge), moe_uuid (Moengage messaging) and various ad personalisation cookies when the SoundCloud user is logged in. The embed also pings the SoundCloud APIs even when playback has not started.
SoundCloud Limited is the controller for the data collected through the embed. The CNIL, the DSK and the AEPD treat audio video embeds the same way as YouTube classic embeds: prior, freely given, specific, informed and unambiguous consent is required under Article 5(3) ePrivacy. Joint controllership with the publisher may apply for analytics events triggered on the publisher page.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Replace the auto loaded iframe with a click to load placeholder when no consent is granted. After consent, inject the iframe dynamically. A consent management platform should block the SoundCloud widget script on the social media or marketing category, similar to YouTube and Spotify embeds. The standard SoundCloud embed does not offer a privacy enhanced mode comparable to youtube-nocookie.com.
SoundCloud Limited is established in the United Kingdom (UK GDPR adequacy applies for EU EEA transfers). Application infrastructure runs on AWS in Ireland and the United States. AWS US regions are covered by the EU US Data Privacy Framework adequacy decision. The SoundCloud DPA includes Standard Contractual Clauses as a fallback for any non DPF subprocessor.
Use a click to load placeholder for every SoundCloud embed, gate the script behind a consent management platform on the marketing category, document the embedding in the cookie policy with the SoundCloud cookies list, and offer a fallback contact link to soundcloud.com so visitors who refuse consent can still listen externally.
Websites using SoundCloud must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is not generally required for the SoundCloud embed at moderate publisher scale. It becomes recommended when SoundCloud is paired with first party visitor profiling, when embedded across an authenticated section of the site, or when the publisher targets minors (audio content for kids).
Sample consent text
This page contains a SoundCloud audio player. SoundCloud (operated by SoundCloud Limited in the UK) drops cookies on your browser to identify you, deliver targeted ads on its platform and measure listening behaviour. The player is loaded only with your consent. Without consent, you can open the audio on soundcloud.com directly.
Third-party domains contacted
soundcloud.comw.soundcloud.comsndcdn.comapi.soundcloud.comapi-v2.soundcloud.comevents-mobile.soundcloud.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| sc_anonymous_id | http | 12 months | Anonymous visitor identifier set by SoundCloud to remember device level analytics when the embed loads. |
| sc_session_id | http | Session | Player session identifier used by SoundCloud to maintain playback state during the page visit. |
| datadome | http | 1 year | Anti bot cookie set by DataDome on behalf of SoundCloud to filter automated traffic on the player. |
| sc_token | http | 1 year | Authentication token set when the visitor is logged into SoundCloud, linking the embed view to a SoundCloud account. |
| moe_uuid | http | 13 months | MoEngage user identifier used in the SoundCloud advertising and engagement stack on monetised tracks. |
| sc_csrf_token | http | Session | CSRF protection token for interactions with the SoundCloud API from the widget. |
SoundCloud uses cookies for user preferences — inform visitors with a consent banner.
The embed sets third party cookies under soundcloud.com: sc_anonymous_id (anonymous visitor identifier), datadome (anti bot challenge), moe_uuid (Moengage messaging) and several advertising personalisation cookies when the visitor is logged in to SoundCloud.
Yes. The iframe drops third party advertising and analytics cookies before any visitor interaction. Prior, freely given, specific, informed and unambiguous consent under Article 5(3) ePrivacy is required. Use a click to load placeholder before consent.
Consent under Article 6(1)(a) GDPR is the lawful basis. SoundCloud Limited is the controller for data collected through the embed. Joint controllership with the publisher may apply for analytics events triggered on the publisher page.
Partially. SoundCloud Limited is established in the UK and runs application infrastructure on AWS in Ireland and the United States. AWS US regions are covered by the EU US Data Privacy Framework. Standard Contractual Clauses are included in the SoundCloud DPA as a fallback.
A DPIA is not generally required for SoundCloud embeds at moderate scale. It becomes recommended when paired with first party visitor profiling, when used in authenticated sections, or when the audience includes minors (kids audio content).
Replace auto loaded iframes with a click to load placeholder, gate the script behind a consent management platform on the marketing or social media category, list SoundCloud cookies in your cookie policy and offer a fallback link to soundcloud.com for visitors who refuse consent.
Alternatives include self hosted HTML5 audio players (Plyr, Mediaelement.js), the Spotify embed (similar consent issues), Mixcloud (also consent required) and uploading the audio file directly to your CDN if licensing allows. Server side podcast hosts like Acast and Ausha offer EU based players.
Add a SoundCloud entry in the social media or marketing category listing sc_anonymous_id, datadome, moe_uuid and other cookies dropped by the embed. Disclose the controller (SoundCloud Limited), the UK and AWS US transfer and link to the SoundCloud privacy notice.