Works with your stack
Cookie consent for Smash Balloon Custom Facebook Feed
placeholders or meta
Smash Balloon Custom Facebook Feed shows pictures from Meta’s servers and can add Facebook’s Like Box. Its GDPR mode turns on by itself only next to a short list of consent plugins. With any other one, you choose between Meta before consent and placeholders for good.
By Smash Balloon · smashballoon.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Smash Balloon Facebook Feed
WordPress plugin
- Tested version
- 4.15.1
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 4.15.1 tested
- Active installs
- 100,000+
What Smash Balloon Custom Facebook Feed adds to your visitors’ browser
No trackers In our test of Smash Balloon Facebook Feed 4.15.1 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What matters for consent with Smash Balloon Custom Facebook Feed
Meta before the choice
With GDPR on Automatic and a consent plugin it does not know, the page avatar, author pictures and cover come from Meta’s servers. The Like Box frame from Facebook is set when the page loads.
GDPR mode set to Yes
Pictures become local placeholders and the Like Box stays empty. Nothing from Meta loads before consent.
No way to release it
In GDPR mode the feed reads only the consent plugins it knows. The free version has no JavaScript call and no event to show the feed after consent. With another consent plugin, the feed stays on placeholders and without the Like Box even after the visitor agrees.
Facebook links in your content
A Facebook link pasted in a post becomes Meta’s own embed, which loads Facebook’s script.
What our tests found on Smash Balloon Custom Facebook Feed
Set before the choice · Smash Balloon Instagram Feed and Custom Facebook FeedWith Cookie Rocks, Smash Balloon feeds wait for consent, then show
Local placeholders and nothing to Meta before the choice; on Accept all, the real images load without a reload.
Seen in our tests, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
With Cookie Rocks Pro 2.9.13, Smash Balloon Instagram Feed 6.15.1 and Custom Facebook Feed 4.15.1 (free) behaved as in GDPR mode, on Automatic as on Yes: before the choice the feeds showed local placeholders and nothing went to cdninstagram.com, fbcdn.net or facebook.com. After Accept all, the Meta images and the Page plugin loaded at once, without a reload.
Set before the choice · Smash Balloon Instagram Feed and Custom Facebook FeedSmash Balloon feeds load Meta images before the choice by default
On Automatic, without a consent plugin from their list, the images and the Page plugin come from Meta before the choice.
Seen in our tests, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
With their GDPR setting on Automatic (the default) and no consent plugin from their own list, Smash Balloon Instagram Feed 6.15.1 and Custom Facebook Feed 4.15.1 (free) loaded the feed images from cdninstagram.com and fbcdn.net before any choice. Custom Facebook Feed also loaded Meta's Page plugin (facebook.com/plugins/page.php).
Good to know · Smash Balloon Instagram Feed and Custom Facebook FeedSmash Balloon free feeds: two different ways to show a feed after consent
Instagram Feed: sbicheckconsent event. Facebook Feed free: a global afterConsentToggled(). Neither reads the WP Consent API.
Read in its code, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
Instagram Feed 6.15.1 fires the jQuery event sbicheckconsent and shows each feed again through its afterConsentToggled() method. Custom Facebook Feed 4.15.1 (free) has no such event and no list of feeds: window.cff is only true, and a global function afterConsentToggled(isConsent, wrapper) shows a feed again. Neither reads the WP Consent API; both detect only the consent plugins on their own list.
Depends on a settingWhere Smash Balloon stores its GDPR setting
It is the gdpr key of sb_instagram_settings and cff_style_settings, auto by default. Auto turns on only with a consent plugin from a fixed list that cannot be extended.
Read in its code, 4 November 2026, 6.15.1, 4.15.1. Source
Full detail
The GDPR setting of Smash Balloon is read from the gdpr key of the options sb_instagram_settings (Instagram Feed) and cff_style_settings (Custom Facebook Feed), auto by default. Auto turns it on only when a consent plugin of their fixed list is active, detected by its functions or constants, with no filter to extend that list.
Depends on a settingWith an empty site profile, the Cookie Rocks dashboard assumes the EU
It then warns about each Smash Balloon feed on GDPR auto, with a fix button in Pro, and about Gravatar comment avatars.
Seen in our tests, 18 October 2026.
Full detail
On a fresh install with an empty site profile (no country, no target countries), the Cookie Rocks dashboard treats the site as targeting the EU: it shows one warning for each Smash Balloon feed on GDPR "auto", each with the button "Set its GDPR option to Yes" when Cookie Rocks Pro is active, and a warning about Gravatar comment avatars with a link to the Discussion settings.
Good to knowWith the Audit alone, Smash Balloon on auto still reaches Meta before the choice
With the Cookie Rocks audit alone (no Pro), Smash Balloon on GDPR "auto" still loads its images from cdninstagram.com and fbcdn.net and the Facebook Like Box before any choice, and the dashboard lists both feeds under To fix.
Seen in our tests, 18 October 2026.
See the 6 other findings
Depends on a settingSmash Balloon admin still shows Automatic with Cookie Rocks Pro
With Cookie Rocks Pro active, the Smash Balloon settings pages in the WordPress admin still show the GDPR option as "Automatic", and saving them without change keeps "auto" in the database. Only front-end requests read the option as "yes".
Seen in our tests, 18 October 2026.
Depends on a settingCookie Rocks dashboard warns about Smash Balloon feeds on GDPR auto
The warning shows only when the site profile targets the EU or the UK. With Cookie Rocks Pro, one button sets the feed to yes; then nothing went to Meta before the choice.
Seen in our tests, 18 October 2026.
Full detail
When Smash Balloon Instagram Feed or Custom Facebook Feed is on GDPR "auto" without a consent plugin from its own list, the Cookie Rocks dashboard shows one warning per feed, but only when the site profile targets the EU or the UK (country or target countries in the profile). With Cookie Rocks Pro, the button "Set its GDPR option to Yes" sets that feed to "yes"; after the two fixes, the next page view sent no request to Meta before the choice.
Good to knowSmash Balloon on auto moves to Good to know with Cookie Rocks Pro
Instead of a To fix item, one note per feed says Cookie Rocks treats Automatic as Yes while the banner is on, and the images wait until the visitor accepts.
Seen in our tests, 18 October 2026.
Full detail
With Cookie Rocks Pro active and Smash Balloon on GDPR "auto", the Cookie Rocks dashboard no longer lists Smash Balloon under To fix. It shows one note per feed under Good to know, saying that while the banner is on, Cookie Rocks treats the option "Automatic" as "Yes" and the images wait until the visitor accepts.
Good to knowStatistics-only consent keeps Smash Balloon feeds away from Meta
With Cookie Rocks and both Smash Balloon feeds on GDPR "yes", a visitor who allows statistics only gets Google Analytics (gtag.js) and no request to Meta: the feeds keep their local placeholder images and the Like Box stays empty.
Seen in our tests, 18 October 2026.
Good to knowWithdrawing consent puts Smash Balloon feeds back to placeholders
With Cookie Rocks and both Smash Balloon feeds on GDPR "yes", withdrawing consent after "Accept all" reloads the page once. The feeds then show their local placeholder images again, the Like Box is empty, and no request goes to Meta.
Seen in our tests, 18 October 2026.
Good to know · Smash Balloon Instagram FeedSmash Balloon Instagram Feed blocks the admin with a data sharing popup
Smash Balloon Instagram Feed shows a full-page popup in the WordPress admin (We're updating how data sharing works), over every admin page, including other plugins' pages, until the administrator answers it. While it is open, nothing under it can be clicked.
Seen in our tests, 18 October 2026, Smash Balloon Instagram Feed 6.14.0.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Smash Balloon Facebook Feed 4.15.1, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Smash Balloon Facebook Feed 4.15.1 on 7 November 2026, with WordPress 7.1.4.
Galleries, feeds and maps
Other plugins of the same kind.
Questions
Which setting should I pick?
GDPR set to Yes keeps Meta out until consent, but with a consent plugin it does not know, the feed keeps placeholders. Automatic shows the full feed but loads Meta before the choice. Cookie Rocks holds known trackers until the visitor agrees.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with a Facebook feed
Decide what Meta sees first.
placeholders or consent
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.