What to write in your privacy policy about Instagram embeds

If your website shows Instagram content, your privacy policy should say so in words your visitors can understand. This article explains what a good description covers, lists the facts about Social Feed by grip space you can rely on, and gives sample wording for three common setups. The samples are a starting point to adapt with your own details and, where needed, your adviser. They are not legal advice and not a finished policy.

Updated October 12, 2026

Not legal advice. Privacy notice requirements depend on your organization, your audience and the law that applies to you. The wording in this article is a starting point, not a ready-made clause. Check it against your actual setup and, if you are unsure, have a qualified adviser review it.

Why your privacy policy should mention the feed

An Instagram feed or embedded post makes your visitors’ browsers contact servers outside your own site. With Social Feed by grip space, that means our server (for the widget script and a daily view count) and Instagram’s image servers, operated by Meta (for the photos and videos). Each of those requests carries the visitor’s IP address, which the European Commission lists as an example of personal data. We trace every request in Instagram feeds and GDPR.

Data protection law expects you to tell people about this. The EDPB’s guide for small businesses says you must “communicate with data subjects in a clear and understandable language”, and the UK ICO’s guidance on the right to be informed sets out what a privacy notice must contain. A feed is only one item in your policy, but it is one that many policies forget.

What a privacy notice generally covers

The ICO’s list of what to provide when you collect personal data directly from people is a useful skeleton. Not every item needs a feed-specific sentence, but each one should be answered somewhere in your policy:

Item	Always or if applicable	Relevance to an Instagram feed
Your name and contact details	Always	Already in your policy
Purposes of the processing	Always	Why you show the feed
Lawful basis	Always	Your decision; state it for the feed
Legitimate interests (if relied on)	If applicable	Say what the interest is
Recipients or categories of recipients	If applicable	The feed provider and Meta
Transfers outside the UK/EU	If applicable	Where the providers are based
Retention periods	Always	What is kept, and for how long
Individual rights, including the right to object	Always	Usually covered in your general section
Right to withdraw consent	If you rely on consent	How to change cookie choices
Right to complain to a supervisory authority	Always	Usually covered in your general section

The EDPB recommends a layered approach: a short first layer with the essentials, linking to the details. For a feed, that can be a single line in your cookie dialog (“Instagram feed: loads photos from Instagram”) that links to the full paragraph in your policy.

Step 1: find out what your pages actually load

Before writing anything, check what is really on your site. Policies often describe tools that were removed long ago, or miss ones added by a theme or plugin. Ten minutes with your browser’s developer tools gives you a reliable list:

Open a page with the feed in a private window, open the developer tools (F12, or Cmd+Option+I on a Mac) and choose the Network tab.
Reload the page and look at the domains in the list. With Social Feed, expect our script host, Instagram CDN hosts for the images and one view-count request to our server.
Check the Application tab (Storage in Firefox) for cookies and local storage. Note what belongs to which tool.
Repeat on the other pages where Instagram content appears, including any pages with Instagram’s native embed.
Write down each tool, what it loads and from where. That list is the raw material for your policy.

Step 2: the facts about Social Feed you can rely on

These statements come from the widget’s code and our privacy policy. You may quote or paraphrase them:

Topic	What is true for the Social Feed widget
Provider	Social Feed by grip space, a service of ibis studio K.K., based in Osaka, Japan
Cookies and storage	The widget sets no cookies and does not use localStorage or sessionStorage
Script	One script from our server, containing your posts and settings. No other scripts, no iframe
Images and videos	Loaded by the visitor’s browser directly from Instagram’s servers (Meta). Videos load only if the visitor opens one
What those requests send	The visitor’s IP address, user agent and, by default, your site’s origin as the Referer
View counting	One request per display to our server. Only a daily count per widget is stored; it does not include IP addresses, cookies or page URLs
Links	Follow button, “View on Instagram” and the credit open a new tab only when clicked
Data about you as the account owner	Covered by our privacy policy (connected account details, access token, posts)

What we can’t tell you is what Meta does with the image requests it receives. That is described in Meta’s own privacy policy, and your notice should link to it rather than guess.

Step 3: decide the parts only you can decide

Some parts of the paragraph depend on choices only your organization can make:

Purpose. Say it plainly: showing your latest work, menu, events or products; giving visitors a sense of your business. Avoid vague phrases like “to improve your experience”.
Lawful basis. Under the GDPR, you need one for the transmission your page triggers. Legitimate interests and consent are the two usually discussed. If you choose legitimate interests, the ICO expects you to say what the interests are.
Consent setup. Whether the feed loads directly or only after consent affects the wording. Our article on cookie consent for Instagram embeds walks through that decision.
Role. In the Fashion ID case, the Court of Justice of the EU found that a site embedding Facebook’s Like button can be jointly responsible with Facebook for collecting and transmitting visitor data, though not for Facebook’s later processing. How you describe your role relative to Meta and to us is part of your own assessment.

A plain-language checklist

Whatever wording you end up with, the feed paragraph should let a visitor answer these questions:

What is this? (An Instagram feed or embedded posts, on which pages.)
Who provides it? (The feed provider and Instagram/Meta, by name.)
What happens when the page loads? (Which servers the browser contacts.)
What data does that involve? (IP address and basic browser information; any cookies, if the embed type uses them.)
Why do you use it? (Your purpose, and your lawful basis.)
Is anything stored on my device? (For the Social Feed widget: no cookies or storage from the widget.)
What happens if I click? (Taken to Instagram, under Instagram’s policy.)
Can I avoid it? (Consent settings, a click-to-load button, or browser controls.)
Where can I read more? (Links to Meta’s policy and the feed provider’s policy.)

Explaining the technical terms

Privacy notices often fail because they use terms the reader doesn’t know. If your paragraph needs one of these, a short explanation in brackets or a glossary entry helps:

Term	Plain-language explanation you can use
IP address	A number that identifies the internet connection your device is using. Any website or server your browser contacts can see it.
Server	A computer that provides content, such as a web page or an image, when your browser asks for it.
Content delivery network (CDN)	A network of servers that delivers images and videos quickly. Instagram’s photos come from Instagram’s CDN.
Browser information (user agent)	A short description of your browser and device type that browsers send with each request.
Referer	Information about which website the request came from. By default, browsers only send the website’s address, not the exact page.
Cookie	A small file a website stores in your browser to recognize it later. The Instagram feed widget doesn’t set any.
Local storage	Another way for a website to store information in your browser. The feed widget doesn’t use it.

Keep sentences short, use “we” and “you”, and say what happens rather than what “may” happen wherever you know the facts. Save “may” for the parts you genuinely can’t verify, such as what a third party does after receiving data.

Sample wording: feed that loads directly

Use this if the Social Feed widget loads without a consent step. Starting point only: replace the bracketed parts, remove anything that doesn’t apply to your site, and make sure every statement matches what you saw in Step 1.

Instagram feed

Some pages of our website show recent posts from our Instagram account.
This feed is provided by Social Feed by grip space, a service of
ibis studio K.K. (Japan).

When you open a page with the feed:
- Your browser loads a script from the Social Feed by grip space server.
  The script contains our posts and display settings.
- Your browser loads the photos and videos directly from Instagram's
  servers, which are operated by Meta. Like any web request, this sends
  Meta your IP address and basic information about your browser.
- Your browser sends one request to the Social Feed by grip space server
  so that it can count how many times the feed is displayed each day.
  The count does not identify you.

The feed itself does not set cookies or use other storage on your device.
If you click a post or the "Follow" button, you are taken to Instagram,
where Instagram's own privacy policy applies.

[Our purpose and lawful basis: DESCRIBE, e.g. showing our latest work to
visitors / legitimate interests / consent, as decided for your site.]

More information:
- Meta (Instagram) Privacy Policy: https://privacycenter.instagram.com/policy/
- Social Feed by grip space Privacy Policy: https://marketing-labo.com/widget/privacy/

Sample wording: feed loaded after consent

Use this if the widget is held back by your consent tool or a click-to-load button. Starting point only; adapt it to the way your consent tool works.

Instagram feed (loaded only with your consent)

We only load our Instagram feed if you allow it in our cookie settings
[or: if you click "Show Instagram feed"]. Until then, nothing is loaded
from Instagram or from the feed provider.

If you allow it, your browser loads the feed from Social Feed by grip
space (ibis studio K.K., Japan) and loads the photos and videos directly
from Instagram's servers, operated by Meta. This sends your IP address and
basic browser information to both. The feed itself does not set cookies.

You can withdraw your consent at any time via [LINK TO COOKIE SETTINGS].

Sample wording: Instagram’s native embed

If you also embed individual posts with Instagram’s own “Embed” option, describe that separately. The native embed runs a page from instagram.com in an iframe on your site, so its behavior is decided by Instagram. Meta’s embed documentation doesn’t describe cookies, which is why the sample below says “may” and points to Meta’s policy. Check in your browser what it actually does on your pages before you finalize it. Starting point only.

Embedded Instagram posts

Some pages contain individual Instagram posts embedded with Instagram's
own embed code. When such a page loads [or: when you allow it], your
browser loads a script from Instagram and a page from instagram.com that
displays the post. Instagram may receive information about your visit and
may store or read information on your device, as described in Meta's
Privacy Policy: https://privacycenter.instagram.com/policy/

For how the two methods differ technically, see Instagram embed vs. feed widget.

The short version for your cookie dialog

If you use a consent tool, the feed usually also needs a one- or two-line description there. This is the first layer the EDPB talks about, so it should be short and point to the full paragraph. Some examples you can adapt (again, starting points only):

Name: “Instagram feed (Social Feed by grip space)”.
Description: “Shows our latest Instagram posts. Photos are loaded from Instagram’s servers (Meta), which receive your IP address. The feed itself sets no cookies.”
Provider and policy links: Meta’s privacy policy and ours, plus a link to the paragraph in your own policy.

Many consent tools also have a field for cookies or storage used by the service. For the Social Feed widget there is nothing to list there. Don’t invent an entry to fill the field; an accurate “none set by the feed” is better.

Worked example: a small café website

To show how the steps fit together, here is a hypothetical example. A café shows a Social Feed grid of 12 posts on its home page and a slider in the footer of every page. It has no consent tool and serves customers in the EU.

Step 1 result: the Network tab shows the widget script, images from Instagram’s CDN and one view-count request on every page (because of the footer slider). The home page grid loads its first row immediately and the rest as the visitor scrolls. No cookies or storage come from the widget. One blog post also contains a native Instagram embed, which loads embed.js and an instagram.com iframe.
Step 2 facts used: provider name and location, no cookies, direct image loading from Meta, daily view count without visitor data.
Step 3 decisions: after advice, the café decides to load the feed directly on the home page, describe it in the policy, and remove the footer slider so that most pages contact no third party. It replaces the native embed in the blog post with a link to the post on Instagram.
Result: the policy gets one short paragraph based on the “loads directly” sample, with the café’s own purpose (“to show our current dishes and events”) and lawful basis filled in. The native embed sample isn’t needed any more because the native embed is gone.

The point of the example isn’t the café’s particular decisions, which may not suit you. It’s that the policy wording follows from what the pages actually do, and that changing the setup is sometimes simpler than describing it.

When a visitor asks what you hold about them

If a visitor makes a data access request and asks about the Instagram feed, these facts help you answer accurately:

Your own site doesn’t receive anything from the widget. The widget doesn’t send visitor data to you, and it doesn’t create records in your website or CMS. Whatever your own server logs record about page visits is a separate matter for your hosting setup.
Social Feed by grip space keeps view counts as a number per widget per day, without IP addresses, cookies or page addresses, so there is no visitor-level record to retrieve. Questions about our handling can go to the contact in our privacy policy.
Meta handles its side under its own policy. Point the visitor to Meta’s privacy policy and its tools for people who want to exercise their rights with Meta.

Things to avoid

Avoid	Why	Instead
“We use Instagram plugins that may collect your data” for everything	Too vague to be useful, and it may be inaccurate for a widget that sets no cookies	Describe the tool you actually use
Claiming the feed is “anonymous” or “sends no data”	Every request sends an IP address to the server that answers it	Say what is sent and to whom
Copying another site’s Instagram paragraph	Their setup (native embed, plugin, consent tool) may differ from yours	Start from your own Step 1 list
Describing what Meta does with the data in your own words	You can’t verify it, and it can change	Link to Meta’s privacy policy
Forgetting to update after changes	A removed or added embed makes the policy wrong	Re-check whenever you add, remove or change an embed
Burying the feed in a long cookie table only	The feed isn’t a cookie, so it can get lost	Give it its own short paragraph and, if you use a CMP, a short entry in the consent dialog

Where to place the text

Most sites put the paragraph in one of three places, and there is no single right answer:

A section on third-party content or embeds in the main privacy policy, alongside maps, videos and fonts. This is the most common and usually the clearest.
The cookie policy, if your site keeps a separate one. If you put it there, say explicitly that the feed itself doesn’t set cookies, so readers aren’t confused.
Your consent tool’s service description, as the short first layer, linking to the full paragraph.

Keep the feed paragraph short. Three to six sentences are usually enough, because the general sections of your policy (rights, contact details, complaints) already cover the rest.

Keeping it accurate over time

A privacy policy is only as good as its last review. These changes should trigger a re-check of the Instagram paragraph:

Adding the feed to new kinds of pages, or removing it.
Switching between the grid and slider layouts, turning videos on or off, or changing the click action (these change which requests happen and when).
Adding Instagram’s native embed to blog posts or other pages.
Installing or changing a consent tool.
Updates to Meta’s policy or ours. Both show a date at the top.

Frequently asked questions

Do I need to name Social Feed by grip space, or is “a third-party provider” enough? Naming the provider is clearer, and the ICO advises being as specific as possible about recipients. A link to our privacy policy lets visitors read the details themselves.

Do I need to describe the data you hold about my Instagram account? Not in your website’s privacy policy. Your connected account, access token and posts are data you share with us as a customer, and our privacy policy covers that relationship. Your visitors’ policy only needs to cover what happens to their data when they visit your pages.

Do I have to mention the view counter? It is a request your page triggers, so it is good practice to say so, even though the count doesn’t identify anyone. One sentence is enough, as in the sample.

Should I mention data transfers to Japan? If your policy describes international transfers, list the providers involved. The European Commission lists Japan among the countries with an adequacy decision. Meta describes its own transfers in its policy.

What about the “Powered by Social Feed” credit? It is a normal link to our site with campaign parameters in the address, shown on the Free plan and optional on paid plans. Nothing is sent unless it is clicked. A short mention under links to other sites is sufficient if you want to be thorough.

Can I show posts from a partner’s account and describe them the same way? The widget only shows the connected account, with the owner signing in. See Can you show someone else’s Instagram feed?

My site is not in Europe. Does any of this apply? The guidance cited here is European and British. Other countries have their own laws, but describing third-party content clearly is good practice anywhere.

Sources

ICO, “What privacy information should we provide?”: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-privacy-information-should-we-provide/
EDPB, “Respect individuals’ rights”, Data protection guide for small business: https://www.edpb.europa.eu/sme-data-protection-guide/respect-individuals-rights_en
European Commission, “Data protection explained”: https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en
European Commission, “Adequacy decisions”: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
Court of Justice of the EU, Press Release No 99/19, Case C-40/17 Fashion ID: https://curia.europa.eu/site/upload/docs/application/pdf/2019-07/cp190099en.pdf
Meta, Instagram Privacy Policy: https://privacycenter.instagram.com/policy/
Meta for Developers, “Embed an Instagram Post”: https://developers.facebook.com/docs/instagram-platform/oembed

Get your embed code in a few minutes. The Free plan needs no credit card.