Configuration Guide

X (formerly Twitter) is a US-based microblogging and social networking platform owned and operated by X Corp., a company headquartered in Bastrop, Texas, United States, and a subsidiary of xAI. Website operators may embed public X posts using X's official oEmbed mechanism, which delivers a <blockquote> placeholder alongside a JavaScript tag loading widgets.js from platform.twitter.com. This script transforms the blockquote into a fully rendered, interactive post embed. Unlike purely content-delivery embeds, the X widget script actively sets persistent third-party tracking cookies in the visitor's browser and collects behavioural data used to build advertising profiles — regardless of whether the visitor has an X account or interacts with the embedded post. For EU/EEA users, the data controller is Twitter International Unlimited Company (Dublin, Ireland); however, data is processed in the US and other countries, and X Corp. as a US enterprise is subject to the CLOUD Act, which enables potential access by US government authorities to data held by US-based companies regardless of where that data is processed.

---

Step 1 — X Embed Configuration

Configuration A — Standard Embed

Use this configuration whenever a public X post is embedded on a website using X's official oEmbed method.

The embed is implemented by copying the HTML snippet generated via the X web interface (Post → share icon → Embed Post) or by using the oEmbed API endpoint at https://publish.x.com/oembed. The resulting snippet consists of a <blockquote> element containing a plain-text version of the post and a <script> tag loading widgets.js from platform.twitter.com. When the script executes in the visitor's browser, it renders the full post including media, interactive engagement buttons (like, repost, reply), and live engagement counts.

Critically, widgets.js performs active tracking beyond mere content rendering. It sets two persistent third-party cookies — muc and personalization_id — with a lifetime of up to 2 years, in the visitor's browser as a side effect of loading on page render, prior to any visitor interaction with the embed. These cookies identify the visitor's browser cross-site and are used by X to match website visitors to X user profiles and to build behavioural advertising profiles for cross-site retargeting. This tracking occurs regardless of whether the visitor has an X account.

If the visitor is logged in to X, the widget script additionally associates their authenticated X identity with the website visit, linking their off-platform browsing behaviour to their known X user profile.

X operates a large-scale advertising platform and explicitly uses data collected via embedded widgets for personalised advertising, real-time bidding, and cross-device tracking. X is a registered vendor under the IAB Transparency and Consent Framework (TCF Vendor ID 21), and the processing carried out via embedded widgets falls under TCF Purposes 1, 3, 4, and 7.

For EU/EEA visitors, the data controller is Twitter International Unlimited Company (Dublin, Ireland), which is supervised by the Irish Data Protection Commission as lead supervisory authority. Despite the EU-based data controller, data is processed in the US and other countries. X Corp., as a US enterprise, is subject to the CLOUD Act, meaning US government authorities may compel access to data held by X regardless of where that data is stored. This US government access risk applies in addition to and independently of any other transfer safeguard.

Because widgets.js sets tracking cookies and transmits data to X's servers on page render — before any visitor interaction — the embed code must be blocked by the consent management solution until the visitor has given consent. A consent-based lazy-loading or click-to-activate wrapper should be used to ensure the script does not fire prior to consent.

X Corp. and Twitter International Unlimited Company act as Independent Controllers under their own privacy policy for all data collected via the embed.

---

Step 2 — Mapping in the Consenter Manager

Using the X embed configuration defined in Step 1, apply the following mapping in the Consenter Manager to ensure the consent banner correctly reflects the data processing activity.

2.1 Configuration A — Standard Embed

Note on tracking method: Unlike single-session embeds that only transmit data during the current page visit, X's widgets.js sets persistent cross-session cookies (muc, personalization_id) that enable X to track the visitor across multiple sessions and across all websites that embed X widgets. This constitutes cross-session, cross-website tracking and must be mapped accordingly.

Note on authenticated users: Where a visitor is logged in to X, their browsing activity on the embedding website is linked to their authenticated X account. This results in authentication-derived identifier processing and should be reflected in the identifier selection above.