Configuration Guide

Bluesky is a US-based microblogging social network built on the AT Protocol, an open, federated communication protocol. It is owned and operated by Bluesky Social, PBC, a benefit corporation incorporated in Delaware and headquartered in Seattle, Washington, United States. Operators of websites may embed public Bluesky posts using Bluesky's official oEmbed mechanism, which delivers a <blockquote> placeholder alongside a JavaScript <script> tag served from embed.bsky.app — a centralised service operated by Bluesky Social, PBC. The script rewrites the blockquote into an <iframe> that loads the post via the Bluesky API. Unlike commercial social media embeds, Bluesky does not operate an advertising platform and does not build advertising profiles. However, as a US enterprise, Bluesky Social, PBC is subject to US law, including the CLOUD Act, which enables potential access by US government authorities to data held by US-based companies regardless of where that data is processed.

---

Step 1 — Bluesky Embed Configuration

Configuration A — Standard Embed

Use this configuration whenever a public Bluesky post is embedded on a website using Bluesky's official oEmbed method.

The embed is implemented by copying the HTML snippet provided via the Bluesky in-app menu (Post → ⋯ → Embed Post) or by pasting the post URL at embed.bsky.app. The resulting snippet consists of a <blockquote> element containing a plain-text version of the post and a <script> tag loading embed.js from embed.bsky.app. When the script executes in the visitor's browser, it replaces the blockquote with an <iframe> that retrieves and renders the full post — including any media, quote-posts, and interactive elements — via the Bluesky API.

All Bluesky embeds load exclusively from embed.bsky.app, a centralised service operated by Bluesky Social, PBC in the United States. Every visitor's browser makes HTTP requests to this US-operated service on each page load, regardless of the geographic location of the embedding website or its visitors.

Per Bluesky's privacy policy, Bluesky automatically collects usage information including the visitor's IP address (which can be used to derive approximate location), unique identifiers, browser and device information, and internet service provider. Bluesky also uses cookies and other tracking technologies. Bluesky does not operate an advertising platform and does not build advertising profiles; data collection is stated to be for service provision, security, analytics, and product improvement purposes.

Bluesky Social, PBC is incorporated in the United States and therefore subject to the CLOUD Act. This means US government authorities may compel access to data held by Bluesky, including data relating to EU/EEA visitors, regardless of where that data is stored. International transfers of personal data from the EU/EEA are covered by Standard Contractual Clauses (SCCs) as stated in Bluesky's privacy policy; however, the CLOUD Act risk applies in addition to and independently of any SCC arrangement.

Because the embedded content and script are loaded directly from Bluesky's US-operated servers, the embedding website operator cannot prevent data transmission to Bluesky through technical means once the embed is present on the page. If consent is required before loading the embed (e.g. under GDPR and ePrivacy obligations), the embed code must be blocked by the consent management solution until the visitor has given consent, for instance by using a consent-based lazy-loading or click-to-activate wrapper.

Bluesky Social, PBC acts as an Independent Controller under its own privacy policy for all data it collects via the embed service.

---

Step 2 — Mapping in the Consenter Manager

Using the Bluesky embed configuration defined in Step 1, apply the following mapping in the Consenter Manager to ensure the consent banner correctly reflects the data processing activity.

2.1 Configuration A — Standard Embed

Note on processing location: All Bluesky embeds are served exclusively from embed.bsky.app, operated by Bluesky Social, PBC (United States). There is no EU hosting option for the embed service. The US processing location and CLOUD Act risk must therefore always be disclosed in the consent banner, irrespective of the embedding website's own hosting location.