Works with your stack
Cookie consent for Smash Balloon Instagram Feed
images from meta
Smash Balloon Instagram Feed shows your posts with images from Meta’s servers. Its GDPR mode only switches on by itself next to a short list of consent plugins. With any other one, the images load before the visitor chooses.
By Smash Balloon · smashballoon.com · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
Smash Balloon Instagram Feed
WordPress plugin
- Tested version
- 6.15.1
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 6.15.1 tested
- Active installs
- 1,000,000+
What Smash Balloon Instagram Feed adds to your visitors’ browser
No trackers In our test of Smash Balloon Instagram Feed 6.15.1 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What matters for consent with Smash Balloon Instagram Feed
Automatic is not always on
The GDPR setting defaults to Automatic. It turns on only when one of the consent plugins on its own list is active. Otherwise the feed script loads images from Meta’s servers in the visitor’s browser before any choice.
Images set by script
The feed script is served by your site and adds the image addresses with JavaScript. A tool that blocks addresses in the page HTML does not see them.
GDPR mode set to Yes
With GDPR set to Yes, the feed shows only local copies and placeholders until consent. The plugin offers a JavaScript call and an event to show the full feed after consent, without a reload.
Instagram embeds become Meta’s
The plugin replaces WordPress’s own Instagram embeds with Meta’s embed, which loads Instagram’s script from instagram.com.
What our tests found on Smash Balloon Instagram Feed
Set before the choice · Smash Balloon Instagram Feed and Custom Facebook FeedWith Cookie Rocks, Smash Balloon feeds wait for consent, then show
Local placeholders and nothing to Meta before the choice; on Accept all, the real images load without a reload.
Seen in our tests, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
With Cookie Rocks Pro 2.9.13, Smash Balloon Instagram Feed 6.15.1 and Custom Facebook Feed 4.15.1 (free) behaved as in GDPR mode, on Automatic as on Yes: before the choice the feeds showed local placeholders and nothing went to cdninstagram.com, fbcdn.net or facebook.com. After Accept all, the Meta images and the Page plugin loaded at once, without a reload.
Set before the choice · Smash Balloon Instagram FeedSmash Balloon Instagram Feed turns Instagram embeds into Meta's embed
The server fetches the embed from Meta, and the page then loads Instagram's embed.js script.
Read in its code, 4 November 2026, Smash Balloon Instagram Feed 6.15.1.
Full detail
Smash Balloon Instagram Feed replaces WordPress's native Instagram embeds with Meta's oEmbed (graph.facebook.com, called by the server with a token). The returned HTML is Meta's blockquote instagram-media plus the www.instagram.com/embed.js script, wrapped in div.sbi-embed-wrap.
Set before the choice · Smash Balloon Instagram Feed and Custom Facebook FeedSmash Balloon feeds load Meta images before the choice by default
On Automatic, without a consent plugin from their list, the images and the Page plugin come from Meta before the choice.
Seen in our tests, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
With their GDPR setting on Automatic (the default) and no consent plugin from their own list, Smash Balloon Instagram Feed 6.15.1 and Custom Facebook Feed 4.15.1 (free) loaded the feed images from cdninstagram.com and fbcdn.net before any choice. Custom Facebook Feed also loaded Meta's Page plugin (facebook.com/plugins/page.php).
Good to know · Smash Balloon Instagram Feed and Custom Facebook FeedSmash Balloon free feeds: two different ways to show a feed after consent
Instagram Feed: sbicheckconsent event. Facebook Feed free: a global afterConsentToggled(). Neither reads the WP Consent API.
Read in its code, 4 November 2026, Smash Balloon Instagram Feed and Custom Facebook Feed 6.15.1, 4.15.1.
Full detail
Instagram Feed 6.15.1 fires the jQuery event sbicheckconsent and shows each feed again through its afterConsentToggled() method. Custom Facebook Feed 4.15.1 (free) has no such event and no list of feeds: window.cff is only true, and a global function afterConsentToggled(isConsent, wrapper) shows a feed again. Neither reads the WP Consent API; both detect only the consent plugins on their own list.
Depends on a settingWhere Smash Balloon stores its GDPR setting
It is the gdpr key of sb_instagram_settings and cff_style_settings, auto by default. Auto turns on only with a consent plugin from a fixed list that cannot be extended.
Read in its code, 4 November 2026, 6.15.1, 4.15.1. Source
Full detail
The GDPR setting of Smash Balloon is read from the gdpr key of the options sb_instagram_settings (Instagram Feed) and cff_style_settings (Custom Facebook Feed), auto by default. Auto turns it on only when a consent plugin of their fixed list is active, detected by its functions or constants, with no filter to extend that list.
Depends on a settingWith an empty site profile, the Cookie Rocks dashboard assumes the EU
It then warns about each Smash Balloon feed on GDPR auto, with a fix button in Pro, and about Gravatar comment avatars.
Seen in our tests, 18 October 2026.
Full detail
On a fresh install with an empty site profile (no country, no target countries), the Cookie Rocks dashboard treats the site as targeting the EU: it shows one warning for each Smash Balloon feed on GDPR "auto", each with the button "Set its GDPR option to Yes" when Cookie Rocks Pro is active, and a warning about Gravatar comment avatars with a link to the Discussion settings.
See the 8 other findings
Good to knowWith the Audit alone, Smash Balloon on auto still reaches Meta before the choice
With the Cookie Rocks audit alone (no Pro), Smash Balloon on GDPR "auto" still loads its images from cdninstagram.com and fbcdn.net and the Facebook Like Box before any choice, and the dashboard lists both feeds under To fix.
Seen in our tests, 18 October 2026.
Depends on a settingSmash Balloon admin still shows Automatic with Cookie Rocks Pro
With Cookie Rocks Pro active, the Smash Balloon settings pages in the WordPress admin still show the GDPR option as "Automatic", and saving them without change keeps "auto" in the database. Only front-end requests read the option as "yes".
Seen in our tests, 18 October 2026.
Depends on a settingCookie Rocks dashboard warns about Smash Balloon feeds on GDPR auto
The warning shows only when the site profile targets the EU or the UK. With Cookie Rocks Pro, one button sets the feed to yes; then nothing went to Meta before the choice.
Seen in our tests, 18 October 2026.
Full detail
When Smash Balloon Instagram Feed or Custom Facebook Feed is on GDPR "auto" without a consent plugin from its own list, the Cookie Rocks dashboard shows one warning per feed, but only when the site profile targets the EU or the UK (country or target countries in the profile). With Cookie Rocks Pro, the button "Set its GDPR option to Yes" sets that feed to "yes"; after the two fixes, the next page view sent no request to Meta before the choice.
Good to knowSmash Balloon on auto moves to Good to know with Cookie Rocks Pro
Instead of a To fix item, one note per feed says Cookie Rocks treats Automatic as Yes while the banner is on, and the images wait until the visitor accepts.
Seen in our tests, 18 October 2026.
Full detail
With Cookie Rocks Pro active and Smash Balloon on GDPR "auto", the Cookie Rocks dashboard no longer lists Smash Balloon under To fix. It shows one note per feed under Good to know, saying that while the banner is on, Cookie Rocks treats the option "Automatic" as "Yes" and the images wait until the visitor accepts.
Good to knowStatistics-only consent keeps Smash Balloon feeds away from Meta
With Cookie Rocks and both Smash Balloon feeds on GDPR "yes", a visitor who allows statistics only gets Google Analytics (gtag.js) and no request to Meta: the feeds keep their local placeholder images and the Like Box stays empty.
Seen in our tests, 18 October 2026.
Good to knowWithdrawing consent puts Smash Balloon feeds back to placeholders
With Cookie Rocks and both Smash Balloon feeds on GDPR "yes", withdrawing consent after "Accept all" reloads the page once. The feeds then show their local placeholder images again, the Like Box is empty, and no request goes to Meta.
Seen in our tests, 18 October 2026.
Good to know · Smash Balloon Instagram FeedSmash Balloon Instagram Feed blocks the admin with a data sharing popup
Smash Balloon Instagram Feed shows a full-page popup in the WordPress admin (We're updating how data sharing works), over every admin page, including other plugins' pages, until the administrator answers it. While it is open, nothing under it can be clicked.
Seen in our tests, 18 October 2026, Smash Balloon Instagram Feed 6.14.0.
Good to know · TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, MatomoTranslatePress, Weglot, MailPoet and others set nothing by default
by default: Default settings
With default settings and nothing set up, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, use no storage and load no known third-party tool.
Seen in our tests, 17 October 2026, TranslatePress, Weglot, Instagram Feed, WP Go Maps, MailPoet, Matomo 3.3.8, 6.4.3, 6.14.0, 10.1.10, 5.42.0, 5.13.1. Source
Full detail
On a fresh WordPress home page with default settings (no account, key or content set up), TranslatePress, Weglot, Smash Balloon Instagram Feed, WP Go Maps, MailPoet and Matomo for WordPress set no cookie, keep nothing in the browser's storage and load no known third-party tool, after Accept all.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- Smash Balloon Instagram Feed 6.15.1, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: Smash Balloon Instagram Feed 6.15.1 on 7 November 2026, with WordPress 7.1.4.
Galleries, feeds and maps
Other plugins of the same kind.
Questions
Which setting should I change?
Set GDPR to Yes. Then the feed waits for consent whatever consent plugin you use. Cookie Rocks holds known trackers until the visitor agrees.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with an Instagram feed
Show your feed, after the choice.
gdpr mode on
Every feature of the complete plugin for 30 days, no card.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.