Configuration Guide

Pinterest offers several website add-ons — the Save button, Follow button, Pin widget, Board widget, and Profile widget — which let visitors save content to Pinterest, follow your account, and let you showcase your Pinterest activity directly on your website. Most add-ons are implemented via Pinterest's JavaScript library (pinit.js), which only needs to be included once per page regardless of how many buttons or widgets are used. Separately, advertisers may also deploy the Pinterest Tag, a conversion-tracking pixel used for ad measurement and audience building. Depending on configuration, embedding Pinterest can range from a simple outbound link with no data transmission to a fully tracked, advertising-linked integration. The configurations below cover the most privacy-relevant implementation choices and their corresponding mappings in the Consenter Manager (CM).

---

Step 1 — Pinterest Configuration

Configuration A — Low Risk

Use this configuration when you want to offer Pinterest sharing functionality with no data transmission unless the visitor actively engages. Instead of embedding the official Save button (which loads pinit.js for every visitor), implement a plain static HTML link to Pinterest's pin-creation page. If your website is static in nature and you don't want to rely on JavaScript, a simple Pin-it button link is sufficient — no script, no iframe, and no cookies are present on your page. Data is only transmitted to Pinterest, and Pinterest only becomes involved as a controller, once the visitor clicks the link and is redirected to pinterest.com. No consent gate is required for the link itself, though it should be clearly labelled as an outbound link to a third-party service.

Configuration B — Medium Risk

Use this configuration when you want to embed an interactive Save button or Follow button directly on your page. Consent must be obtained via the consent banner before pinit.js loads; until consent is given, the widget should be replaced with a placeholder. Once consent is given and the script loads, Pinterest receives information about every consenting visitor's visit — Pinterest can use this information about the visit to customise the visitor's experience back on Pinterest, for example by showing related Pins or promoted content based on the websites visited — regardless of whether the visitor actually clicks the button. Pinterest Europe Ltd. and Pinterest, Inc. are joint data controllers for residents of the EEA, Switzerland, and the UK, meaning a joint controller relationship applies for this collection. No advertising or conversion tracking is active in this configuration.

Configuration C — Higher Risk

Use this configuration when you embed the Board widget and/or Profile widget to showcase Pinterest content, and additionally deploy the Pinterest Tag for conversion tracking and ad measurement. Consent must be obtained before either pinit.js or the Pinterest Tag loads. The Pinterest Tag fires on every page load (once consented) and sets a series of first-party cookies on your domain; it does not just count conversions but also builds user profiles, enables cross-site tracking, and feeds Pinterest's ad targeting algorithms. Specific cookies set include _pin_unauth for visitors Pinterest cannot identify, _epik and _derived_epik for matching ad clicks to later site visits, and _pinterest_ct_rt, which requires an active Pinterest login session to be written. Pinterest and the website operator are joint controllers for this processing under Pinterest's Advertising Services Agreement and Joint Controller Addendum, which governs the respective responsibilities for collection and disclosure of activity data. All Pinterest Tag cookies persist for one year.

---

Step 2 — Mapping in the Consenter Manager

Using the Pinterest configurations defined in Step 1, apply the following mappings in the Consenter Manager to ensure the consent banner correctly reflects the data processing activities.

2.1 Configuration A — Low Risk

Note: Because no connection to Pinterest is established until the visitor actively clicks the link, this configuration does not require an entry in the consent banner for tracking purposes. It remains good practice to disclose in your privacy policy that clicking the link will take the visitor to a third-party website operated by Pinterest.

2.2 Configuration B — Medium Risk

2.3 Configuration C — Higher Risk

Note: Pinterest requires advertisers using the Pinterest Tag to incorporate the Joint Controller Addendum and to disclose the joint processing arrangement in their privacy policy. Pinterest relies on the EU-US Data Privacy Framework, the UK Extension, and the Swiss-US Data Privacy Framework, as well as Standard Contractual Clauses, to transfer personal data of EEA, Switzerland, and UK residents to the United States. Regardless of these safeguards, Pinterest, Inc. remains a US company subject to the CLOUD Act, meaning US government authorities may access data transferred under this configuration; this should be disclosed as a potential US data transfer in the consent banner.