Instagram Feed

Overview

Instagram Feed embeds allow websites to display Instagram posts, reels, and media galleries sourced from Instagram accounts. As a Meta product, Instagram embeds carry Meta's cross-platform tracking infrastructure — loading the Facebook SDK, setting Meta tracking cookies, and transmitting visitor data to Meta's advertising systems on page load, regardless of whether the visitor has an Instagram account or interacts with the embedded content.

What This Script Does

Instagram embeds load Meta's platform scripts and render media content within an iframe or JavaScript widget.

• Scripts loaded: Instagram embeds load platform.instagram.com/en_US/embeds.js (or via the Facebook SDK connect.facebook.net/en_US/sdk.js), which renders the Instagram post or gallery within the host page
• Cookies set on page load:
  • datr — Third-party cookie on facebook.com (2-year expiry). Browser identifier set on every visitor, even those without a Meta account.
  • _fbp — First-party cookie (90-day expiry). Meta's browser identifier for ad targeting and conversion tracking on the host domain.
  • Additional Meta cookies may be set depending on the visitor's login state with Instagram/Facebook.
• Data transmitted: On page load, the embed sends the visitor's IP address, browser user agent, page URL, referrer, and Meta cookie identifiers to Meta's servers. This data is collected regardless of whether the visitor interacts with the embedded content.
• Cross-platform tracking: Meta uses the data from Instagram embeds to enrich user profiles across its advertising network, linking website visits to Instagram/Facebook accounts and ad targeting segments.
• Content rendering: The embed displays the Instagram post's image/video, caption, like count, and a link to view the post on Instagram.

Consent & Compliance

Instagram Feed embeds fall under both functional and marketing consent categories.

Under GDPR and ePrivacy, Instagram embeds require explicit opt-in consent. The datr and _fbp cookies are set on page load for advertising purposes, constituting storage of non-essential information under the ePrivacy Directive. Meta's cross-platform tracking through the embed constitutes personal data processing for advertising under GDPR. EU DPAs have repeatedly addressed Meta's tracking through social plugins, with the CJEU ruling in Fashion ID (C-40/17) establishing that website operators using Meta's social plugins are joint controllers with Meta for the data collection that occurs through the embed.

Under CCPA/CPRA, Meta's collection of visitor data through the embed for cross-platform ad targeting constitutes "sharing" of personal information for cross-context behavioral advertising.

Should You Block This Without Consent?

Conditional. The Instagram content display is functional, but Meta's tracking on page load is marketing. Block the live Instagram embed until consent is obtained. Display static screenshots or cached images of the Instagram content as a placeholder, loading the actual Meta-powered embed only after the visitor grants marketing consent. This facade approach preserves the visual content while preventing Meta's tracking cookies from being set.