SoundCloud

Overview

SoundCloud is an audio streaming platform and music community founded in Berlin in 2007. It hosts over 300 million tracks spanning music, podcasts, and spoken word content. SoundCloud provides an embeddable web player that publishers and blogs can use to display audio content directly on their pages without redirecting visitors to SoundCloud's own site. The player is especially popular on music blogs, artist promotional pages, independent radio stations, and creator portfolios. SoundCloud offers both a free tier (ad-supported) and paid SoundCloud Go/Go+ subscriptions (ad-free). Importantly, the standard SoundCloud embedded player on third-party sites does not serve targeted behavioral advertising to site visitors — distinguishing it from ad-heavy embeds like certain YouTube configurations.

What This Script Does

Script Files and Domains

The SoundCloud embed primarily uses an <iframe> pointing to https://w.soundcloud.com/player/. Player assets (JavaScript, CSS, images) are loaded from w.soundcloud.com. Audio streams are delivered from cf-media.sndcdn.com (Cloudflare-backed SoundCloud CDN) or a-v2.sndcdn.com. When using the Widget API for JavaScript control, https://w.soundcloud.com/player/api.js is loaded additionally. Analytics beacons fire to api.soundcloud.com and eventlogger.soundcloud.com.

Cookies Set

• sc_anonymous_id — A randomly generated visitor identifier. Persistent, 1-year expiry. Set on soundcloud.com. Tracks anonymous playback events for SoundCloud's internal analytics (play counts, embed impressions). Not used for advertising on third-party sites.
• _soundcloud_session — Session authentication cookie for logged-in SoundCloud users. Scoped to soundcloud.com.
• __utma, __utmz — Legacy Google Analytics cookies set on soundcloud.com domain for SoundCloud's own traffic analytics.

All cookies are set on soundcloud.com's domain, not on the embedding site's domain, because the player loads inside an iframe.

Playback Event Tracking

The player fires internal analytics events to eventlogger.soundcloud.com: embed impression (on load), play start, pause, seek, 25%/50%/75%/100% completion milestones, and share button clicks. These events are used by SoundCloud to report play counts to artists and measure embed performance. No third-party advertising data is derived from these events.

Widget API Events

When the Widget API (api.js) is loaded, developers can subscribe to: SC.Widget.Events.PLAY, PAUSE, FINISH, SEEK, PLAY_PROGRESS, READY, ERROR, OPEN_SHARE_PANEL. Communication occurs via postMessage.

Logged-In User Activity

If a visitor is logged into SoundCloud and plays a track in an embedded player, the playback will be associated with their SoundCloud account. This is expected behavior and does not constitute third-party advertising profiling.

Consent & Compliance

Category: Functional

SoundCloud embedded players serve a functional purpose — delivering audio content to the site visitor — without serving targeted advertising to that visitor on the embedding site. The cookies set by the embed are scoped to soundcloud.com's domain and relate to player functionality and SoundCloud's own internal analytics.

Under GDPR and the ePrivacy Directive, the functional character of SoundCloud embeds means they generally do not require consent for non-advertising configurations. However, Germany's DSK (Datenschutzkonferenz) has taken the position that any third-party embed that sets cookies or transmits data cross-origin requires consent, regardless of purpose. Under this strict reading, a consent gate would be required.

Under CCPA, SoundCloud's use of sc_anonymous_id for internal analytics does not constitute a sale of personal information to third parties.

SoundCloud GmbH is based in Berlin (EU) and processes data under GDPR natively as an EU-based processor.

Should You Block This Without Consent?

No. SoundCloud embeds serve functional audio content without advertising tracking on third-party sites. Cookies are scoped to SoundCloud's domain. Under most practical GDPR interpretations, a consent gate is not required for standard embeds. For sites operating under strict German DSK guidance or those implementing a conservative consent posture, a click-to-load facade (showing a placeholder until the visitor clicks to load the full player) is the recommended privacy-preserving pattern.