Works with your stack
Cookie consent for social feeds, videos, maps and reviews
content from someone else
Feeds, videos, maps and review widgets show content from another company. That content usually loads from that company’s servers before the visitor chooses. Several of these plugins have a consent option of their own, and most only work well next to the consent plugins they know.
Feeds and embeds, one by one
What each plugin puts on your pages
- Smash Balloon Instagram Feed
- Feed images from Meta, set by script, unless GDPR mode is on. With GDPR set to Yes, the feed can be shown after consent through its JavaScript.
- Smash Balloon Custom Facebook Feed
- Meta pictures and the Facebook Like Box unless GDPR mode is on. The free version has no way to show the feed after consent with another consent plugin.
- Embed Plus for YouTube
- A YouTube frame plus its own script that loads YouTube’s player code. Cookie Rocks holds that script with YouTube.
- WP Go Maps
- Map code from public code servers and tiles requested by script, before the choice. Its own consent option works on the server.
- Widgets for Google Reviews
- Reviews wait for the Trustindex loader, while stars, logos and photos load anyway. It removes consent markers added through WordPress’s script filter.
What matters for consent with Feeds and embeds
Built by script
Feed images, map tiles and video players are often added by JavaScript. A consent plugin that reads the page HTML does not see them.
Their own consent options
Several of these plugins have a consent switch of their own. Most decide on the server and reload the page, which a page cache can freeze, or only turn on next to the consent plugins on their own list.
Privacy modes are not consent
A no-cookie video domain still loads YouTube’s player. Thumbnails, map code and review images still come from other servers.
What Cookie Rocks does
Cookie Rocks holds known trackers until the visitor agrees, including the Embed Plus script with YouTube.
What our tests found on Feeds and embeds
Good to know · Cookie RocksEmbed Plus setup stops when released after load
When Cookie Rocks 2.11.0 releases Embed Plus for YouTube after the page has loaded, the video plays, but its setup does not finish: ytprefs.js waits for the window load event, which has already passed, so apiInit never runs and its player events do not start. Sending the load event again finishes the setup.
Seen in our tests, 6 November 2026, Cookie Rocks.
Set before the choice · Cookie RocksAtlas Major stops calling Google Fonts once the copy is done
With Cookie Rocks Pro 2.11.0 and WP Go Maps' Atlas Major interface, local fonts on and the copy done, nothing goes to Google Fonts before the choice: the stylesheet is served from the site. Without local fonts, or before the scheduled copy has run, Atlas Major's @import still calls fonts.googleapis.com before the choice.
Seen in our tests, 6 November 2026, Cookie Rocks.
Set before the choice · WP Go MapsWith Cookie Rocks, WP Go Maps' Google map starts without a reload
Google engine, consent option on or off: nothing to Google before the choice; a placeholder, then the map after Accept all, without a reload.
Seen in our tests, 6 November 2026, WP Go Maps 10.1.10.
Full detail
With the Google engine of WP Go Maps 10.1.10, its consent option on or off, Cookie Rocks 2.10.1 sends nothing to Google before the choice, and after Accept all the map appears without a reload. After Reject all or a withdrawal, nothing loads. Until then a placeholder of the same size holds the place of the map, with a Load the map button that starts it. Cookie Rocks tells WP Go Maps on the server that consent is handled, so no cookie is set in the visitor's browser for this.
Set before the choice · Cookie RocksCookie Rocks holds the Leaflet map of WP Go Maps until the visitor accepts
Nothing reaches unpkg.com or OpenStreetMap before Accept, and the map draws without a reload.
Seen in our tests, 6 November 2026, Cookie Rocks.
Full detail
Cookie Rocks 2.11.0 holds the Leaflet engine of WP Go Maps 10.1.10. Before the choice and after Refuse, nothing goes to unpkg.com or the OpenStreetMap tile servers. After Accept, the libraries and tiles load and the map draws without a page reload.
Good to know · WP Go MapsWP Go Maps picks its interface at random on a new install
On a new install, WP Go Maps 10.1.10 picks its interface at random, one chance in two: Atlas Novus or Atlas Major. Two fresh sites with the same settings can therefore behave differently. Atlas Major's stylesheet loads Plus Jakarta Sans and IBM Plex Mono from Google Fonts through an @import, which does not show in the page's HTML.
Seen in our tests, 6 November 2026, WP Go Maps.
Set before the choice · WP Go MapsWP Go Maps' consent option only stops the Google Maps engine
Google engine: notice, nothing from Google until the cookie. Leaflet engine: no notice, libraries still load from unpkg.com.
Seen in our tests, 6 November 2026, WP Go Maps 10.1.10.
Full detail
With its option Require consent before loading Maps API on and the Google engine, WP Go Maps 10.1.10 shows a notice and a button and loads nothing from Google Maps until the cookie wpgmza-api-consent-given exists; removing the cookie brings the notice back at the next page view. With the Leaflet engine, the same option shows no notice and the Leaflet and MapLibre libraries still load from unpkg.com; only the map tiles wait for the cookie.
See the 22 other findings
Set before the choice · Smash Balloon Instagram Feed and Custom Facebook FeedWith Cookie Rocks, Smash Balloon feeds wait for consent, then show
Local placeholders and nothing to Meta before the choice; on Accept all, the real images load without a reload.
Seen in our tests, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
With Cookie Rocks Pro 2.9.13, Smash Balloon Instagram Feed 6.15.1 and Custom Facebook Feed 4.15.1 (free) behaved as in GDPR mode, on Automatic as on Yes: before the choice the feeds showed local placeholders and nothing went to cdninstagram.com, fbcdn.net or facebook.com. After Accept all, the Meta images and the Page plugin loaded at once, without a reload.
Set before the choice · Smash Balloon Instagram FeedSmash Balloon Instagram Feed turns Instagram embeds into Meta's embed
The server fetches the embed from Meta, and the page then loads Instagram's embed.js script.
Read in its code, 4 November 2026, Smash Balloon Instagram Feed 6.15.1.
Full detail
Smash Balloon Instagram Feed replaces WordPress's native Instagram embeds with Meta's oEmbed (graph.facebook.com, called by the server with a token). The returned HTML is Meta's blockquote instagram-media plus the www.instagram.com/embed.js script, wrapped in div.sbi-embed-wrap.
Set before the choice · Smash Balloon Instagram Feed and Custom Facebook FeedSmash Balloon feeds load Meta images before the choice by default
On Automatic, without a consent plugin from their list, the images and the Page plugin come from Meta before the choice.
Seen in our tests, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
With their GDPR setting on Automatic (the default) and no consent plugin from their own list, Smash Balloon Instagram Feed 6.15.1 and Custom Facebook Feed 4.15.1 (free) loaded the feed images from cdninstagram.com and fbcdn.net before any choice. Custom Facebook Feed also loaded Meta's Page plugin (facebook.com/plugins/page.php).
Good to know · Smash Balloon Instagram Feed and Custom Facebook FeedSmash Balloon free feeds: two different ways to show a feed after consent
Instagram Feed: sbicheckconsent event. Facebook Feed free: a global afterConsentToggled(). Neither reads the WP Consent API.
Read in its code, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
Instagram Feed 6.15.1 fires the jQuery event sbicheckconsent and shows each feed again through its afterConsentToggled() method. Custom Facebook Feed 4.15.1 (free) has no such event and no list of feeds: window.cff is only true, and a global function afterConsentToggled(isConsent, wrapper) shows a feed again. Neither reads the WP Consent API; both detect only the consent plugins on their own list.
Depends on a settingWhere Smash Balloon stores its GDPR setting
It is the gdpr key of sb_instagram_settings and cff_style_settings, auto by default. Auto turns on only with a consent plugin from a fixed list that cannot be extended.
Read in its code, 4 November 2026, 6.15.1, 4.15.1. Source
Full detail
The GDPR setting of Smash Balloon is read from the gdpr key of the options sb_instagram_settings (Instagram Feed) and cff_style_settings (Custom Facebook Feed), auto by default. Auto turns it on only when a consent plugin of their fixed list is active, detected by its functions or constants, with no filter to extend that list.
Good to know · Widgets for Google Reviews (Trustindex)The ti-success cookie of Trustindex review widgets
Trustindex: ti-success (60 seconds, admin settings only).
Name Kept in Category What it is for ti-successcookie Necessary Shows the result of connecting the review source in the admin, 60 seconds (editors only) Read in its code, 4 November 2026, Widgets for Google Reviews (Trustindex).
Full detail
Widgets for Google Reviews (Trustindex) sets ti-success = connected or disconnected for 60 seconds in its Advanced settings tab, after the editor connects or disconnects the review source, reads it once on the next admin page and deletes it. Editors only, never for visitors. The Audit 2.9.11 lists it as unknown.
Depends on a settingWith an empty site profile, the Cookie Rocks dashboard assumes the EU
It then warns about each Smash Balloon feed on GDPR auto, with a fix button in Pro, and about Gravatar comment avatars.
Seen in our tests, 18 October 2026.
Full detail
On a fresh install with an empty site profile (no country, no target countries), the Cookie Rocks dashboard treats the site as targeting the EU: it shows one warning for each Smash Balloon feed on GDPR "auto", each with the button "Set its GDPR option to Yes" when Cookie Rocks Pro is active, and a warning about Gravatar comment avatars with a link to the Discussion settings.
Good to knowWith the Audit alone, Smash Balloon on auto still reaches Meta before the choice
With the Cookie Rocks audit alone (no Pro), Smash Balloon on GDPR "auto" still loads its images from cdninstagram.com and fbcdn.net and the Facebook Like Box before any choice, and the dashboard lists both feeds under To fix.
Seen in our tests, 18 October 2026.
Depends on a settingSmash Balloon admin still shows Automatic with Cookie Rocks Pro
With Cookie Rocks Pro active, the Smash Balloon settings pages in the WordPress admin still show the GDPR option as "Automatic", and saving them without change keeps "auto" in the database. Only front-end requests read the option as "yes".
Seen in our tests, 18 October 2026.
Depends on a settingCookie Rocks dashboard warns about Smash Balloon feeds on GDPR auto
The warning shows only when the site profile targets the EU or the UK. With Cookie Rocks Pro, one button sets the feed to yes; then nothing went to Meta before the choice.
Seen in our tests, 18 October 2026.
Full detail
When Smash Balloon Instagram Feed or Custom Facebook Feed is on GDPR "auto" without a consent plugin from its own list, the Cookie Rocks dashboard shows one warning per feed, but only when the site profile targets the EU or the UK (country or target countries in the profile). With Cookie Rocks Pro, the button "Set its GDPR option to Yes" sets that feed to "yes"; after the two fixes, the next page view sent no request to Meta before the choice.
Good to knowSmash Balloon on auto moves to Good to know with Cookie Rocks Pro
Instead of a To fix item, one note per feed says Cookie Rocks treats Automatic as Yes while the banner is on, and the images wait until the visitor accepts.
Seen in our tests, 18 October 2026.
Full detail
With Cookie Rocks Pro active and Smash Balloon on GDPR "auto", the Cookie Rocks dashboard no longer lists Smash Balloon under To fix. It shows one note per feed under Good to know, saying that while the banner is on, Cookie Rocks treats the option "Automatic" as "Yes" and the images wait until the visitor accepts.
Good to knowStatistics-only consent keeps Smash Balloon feeds away from Meta
With Cookie Rocks and both Smash Balloon feeds on GDPR "yes", a visitor who allows statistics only gets Google Analytics (gtag.js) and no request to Meta: the feeds keep their local placeholder images and the Like Box stays empty.
Seen in our tests, 18 October 2026.
Good to knowWithdrawing consent puts Smash Balloon feeds back to placeholders
With Cookie Rocks and both Smash Balloon feeds on GDPR "yes", withdrawing consent after "Accept all" reloads the page once. The feeds then show their local placeholder images again, the Like Box is empty, and no request goes to Meta.
Seen in our tests, 18 October 2026.
Good to know · Smash Balloon Instagram FeedSmash Balloon Instagram Feed blocks the admin with a data sharing popup
Smash Balloon Instagram Feed shows a full-page popup in the WordPress admin (We're updating how data sharing works), over every admin page, including other plugins' pages, until the administrator answers it. While it is open, nothing under it can be clicked.
Seen in our tests, 18 October 2026, Smash Balloon Instagram Feed 6.14.0.
Good to know · TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, MatomoTranslatePress, Weglot, MailPoet and others set nothing by default
by default: Default settings
With default settings and nothing set up, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, use no storage and load no known third-party tool.
Seen in our tests, 17 October 2026, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, Matomo 3.3.8, 6.4.3, 6.14.0, 10.1.10, 5.42.0, 5.13.1. Source
Full detail
On a fresh WordPress home page with default settings (no account, key or content set up), TranslatePress, Weglot, Smash Balloon Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, keep nothing in the browser's storage and load no known third-party tool, after Accept all.
Set before the choice · Embed Plus for YouTubeEmbed Plus for YouTube loads YouTube before the choice, even with the video held
Embed Plus for YouTube loads its own script, which injects YouTube's iframe API before the choice even when the video frame is held; YouTube then sets its cookies. Cookie Rocks 2.5.1 holds that script with YouTube.
Seen in our tests, 17 October 2026, Embed Plus for YouTube.
Set before the choice · Embed Plus for YouTubeEmbed Plus for YouTube loads YouTube thumbnails before the choice
setting “Facade mode” · by default: off
- Default mode: a normal YouTube iframe that lazy-load plugins leave in place.
- Facade mode: an i.ytimg.com thumbnail loads first; a click builds the YouTube player.
- A playlist facade fetches youtube.com/oembed from the browser.
- Gallery thumbnails load from i.ytimg.com before any choice.
Read in its code, 16 October 2026, Embed Plus for YouTube 14.2.6.1.
Full detail
By default Embed Plus for YouTube writes a normal youtube.com/embed iframe carrying no-lazyload and data-no-lazy=1, so lazy-load plugins leave its src in place. In facade mode there is no iframe in the HTML: a div with data-facadesrc and an i.ytimg.com thumbnail load before any choice, a playlist facade fetches youtube.com/oembed from the browser, and a click builds the YouTube iframe in JavaScript. Gallery thumbnails load from i.ytimg.com as CSS backgrounds, before any choice.
Depends on a setting · Embed Plus for YouTubeEmbed Plus for YouTube consent message reloads the page and can be cached
setting “Privacy/GDPR - Show Consent Message” · by default: off
Its own message (off by default) sets ytprefs_gdpr_consent for 30 days and reloads. A cached page can keep the wrong state. No Cookies only switches to youtube-nocookie.com.
Read in its code, 16 October 2026, Embed Plus for YouTube 14.2.6.1.
Full detail
Embed Plus for YouTube's own Show Consent Message (off by default) is decided on the server from the cookie ytprefs_gdpr_consent: without the value 1, a message replaces each video and gallery thumbnails. The button sets that cookie for 30 days (path /) and reloads the page, so a cached page keeps showing the message (or the video) whatever the choice unless the cache varies on it. It does not use WP Consent API. The No Cookies option only switches the player host to youtube-nocookie.com.
Set before the choice · WP Go MapsWP Go Maps loads map libraries from other sites with no consent condition
- Leaflet engines load from unpkg.com, the newer OpenLayers engine from cdn.jsdelivr.net.
- They load even when its own consent notice is on.
- Map tiles are requested by script, so a consent plugin reading the HTML misses them.
- The Google engine adds a maps.googleapis.com script.
Read in its code, 16 October 2026, WP Go Maps 10.1.10.
Full detail
WP Go Maps loads its map libraries without any consent condition: the Leaflet engines, including the zero-cost engine of new installs, from unpkg.com (leaflet, maplibre-gl); the newer OpenLayers engine from cdn.jsdelivr.net; the classic OpenLayers engine from the site (lib/ol.js). These load even when its own consent notice is on. With OpenStreetMap-type engines the map and its tiles (tile.openstreetmap.org, tiles.openfreemap.org and others) are requested by JavaScript, so a consent plugin reading the page HTML does not see them. The Google engine adds a maps.googleapis.com script tag with a callback.
Sent from your server · WP Go MapsWP Go Maps address search sends the search text to OpenStreetMap
With an OpenStreetMap engine, WP Go Maps' address search goes through the site's REST route query-nominatim: the browser contacts only the site, and the server sends the visitor's search text to nominatim.openstreetmap.org.
Read in its code, 16 October 2026, WP Go Maps 10.1.10.
Set before the choice · Widgets for Google Reviews (Trustindex)Google Reviews widget images load from Trustindex before any choice
If loader.js is held, visitors see no reviews until they accept. Star icons, logos and reviewer photos are plain images that load before the choice even then.
Read in its code, 16 October 2026, Widgets for Google Reviews (Trustindex) 14.2.
Full detail
The review widget of Widgets for Google Reviews is written into the page by the server but hidden (opacity 0, height 0) until cdn.trustindex.io/loader.js formats it; if that script is held, visitors see no reviews until they accept. Its star icons and platform logos (cdn.trustindex.io) and reviewer photos are plain <img> tags with the skip-lazy class, so they load before any choice even when loader.js waits. Widgets with an ID also add a stylesheet from cdn.trustindex.io.
Good to know · Widgets for Google Reviews (Trustindex)Widgets for Google Reviews removes consent markers other tools add
It undoes markers added through WordPress and keeps trustindex.io out of three performance plugins' delay. A tag held as text/plain with its address is not bypassed. No consent setting.
Read in its code, 16 October 2026, Widgets for Google Reviews (Trustindex) 14.2.
Full detail
Widgets for Google Reviews removes consent markers that consent tools add through WordPress' script_loader_tag filter (attributes consent-required, consent-by, consent-id, and consent-original-src or type put back), at priority 9999999, and adds one consent plugin's ignore attribute to loader.js. It also excludes trustindex.io from the delay, minify and combine features of three performance plugins. An inline fallback recreates loader.js on DOMContentLoaded only if no script tag with its address is in the page, so a tag kept with its src as type="text/plain" is not bypassed. It has no consent setting and does not use WP Consent API.
Galleries, feeds and maps
Other plugins of the same kind.
Questions
Should I turn on each plugin’s own consent option?
Look at how it decides. An option that reads a cookie on the server and reloads the page can show the wrong thing on a cached page, and does not follow the choice made in your consent plugin.
Does a page without a feed or map load anything?
No for Instagram Feed and WP Go Maps: with default settings and nothing set up, they set no cookie and load no outside tool.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with feeds, videos and maps
Outside content, after the choice.
content from elsewhere
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.