Embeds, Cookies & GDPR Consent

Embedded SoundToggle players are consent-safe by default wherever consent is legally required. When a player runs inside an iframe on your site and the listener is in the EU, EEA, UK, or Switzerland, it sets no cookies and no tracking identifiers at all unless your site tells it consent has been given. Analytics run in Google's cookieless Consent Mode, and session recording and attribution cookies are switched off in embeds everywhere. Listeners elsewhere in the world get ordinary analytics cookies, as they would on any site.

This is decided by where the listener is, not where you are — so a studio in Sydney or Nashville is still covered for its European visitors, with nothing to configure.

Either way, playback never requires consent: visitors can play, toggle, and finish a track before making any cookie choice.

If your site has its own cookie banner and you want the player to follow it, there are two ways to pass a visitor's decision through:

1. URL parameter (simplest). Load the embed with &consent=granted — or &consent=denied — appended to the iframe URL. A pinned value applies to every listener regardless of location:

https://app.soundtoggle.io/Player?id=YOUR_ID&consent=granted

Most consent management platforms (Cookiebot, Usercentrics, CookieYes, etc.) can hold an iframe until consent and then load it with a modified URL — check their "iframe blocking" or "prior consent" feature.

2. postMessage (live updates). To grant or revoke consent without reloading the page, send the player a message from your consent banner's callback:

document.querySelector('iframe#soundtoggle').contentWindow.postMessage(
  { type: 'soundtoggle:consent', analytics: 'granted' }, // or 'denied'
  'https://app.soundtoggle.io'
);

If you do nothing, the defaults above simply stand, which satisfies most cookie policies — no consent-requiring storage is ever used for the visitors who are entitled to that protection. Strict interpretations in some EU countries treat *loading* any third-party content (which transmits the visitor's IP address) as itself requiring consent; if that standard applies to you, keep the player behind your banner's iframe-blocking / click-to-load feature so it only loads after consent.