Sprout Social

Overview

Sprout Social is an enterprise social media management and analytics platform founded in 2010 and headquartered in Chicago. It provides social media scheduling, publishing, monitoring, and analytics tools for brands managing presence across Facebook, Instagram, X (Twitter), LinkedIn, TikTok, Pinterest, and YouTube. On third-party websites, Sprout Social appears through embedded social feed widgets, review management displays, and listening dashboards that pull live social content into brand websites, partner portals, and campaign landing pages.

What This Script Does

Sprout Social's embeddable components load scripts from sproutsocial.com and CDN endpoints on cdn.sproutsocial.com. The widgets render social content feeds, review aggregations, or engagement dashboards by fetching data from Sprout's API on behalf of the connected brand accounts.

Cookies and identifiers set:

• sprout_session — Session-scoped cookie set when a visitor interacts with an embedded widget; manages widget state during the session; expires at session end.
• sprout_ref — Attribution cookie tracking engagement with embedded social content, linking interactions to traffic source data; expiry 30 days.
• sprout_vid — Visitor identifier set on the host domain for engagement analytics; used to measure unique widget impressions and interaction rates; expiry 7 days.

Script filenames and CDN: widget.js and social-feed-embed.js served from cdn.sproutsocial.com. API calls route to api.sproutsocial.com/v1/streams for social content retrieval and events.sproutsocial.com for engagement event reporting.

Per-interaction data collected:

• Widget impression count and unique visitor metrics
• Content interaction events: click, share, expand, link click-through
• Time spent viewing embedded social content
• Page URL and referrer of the embedding page
• UTM parameters and traffic source attribution
• Device and browser metadata for analytics segmentation

Additional third-party requests: Sprout Social feed widgets often render content originating from Facebook, Instagram, X, and LinkedIn — meaning those platforms' CDN domains and tracking pixels may be loaded within the widget, introducing additional third-party data processing from the respective social networks. This secondary layer of tracking is particularly significant under GDPR.

Consent & Compliance

Sprout Social scripts are classified under marketing and analytics categories. The embedded social content serves a marketing purpose — promoting the brand's social media activity and driving engagement — while the widget analytics measure the effectiveness of that content placement. Under GDPR Articles 6 and 7 and the ePrivacy Directive, both the engagement tracking cookies and the secondary social network requests require prior opt-in consent. IAB TCF Purpose 1 (Store/access device) and Purpose 7 (Measure ad performance) are applicable. Under CCPA/CPRA, the engagement tracking data, visitor identifiers, and any referral attribution constitute personal information processing that must be disclosed. If social platform data (Facebook, Instagram) is loaded through the widget, the host site may be a joint controller under GDPR — a risk highlighted in the Facebook Fan Pages ruling (CJEU C-210/16). Sprout Social participates in the EU-US Data Privacy Framework for compliant US transfers.

Should You Block This Without Consent?

Yes. Sprout Social embedded widgets serve marketing and analytics purposes, set tracking cookies, and may trigger secondary requests from major social platforms. Block until the visitor provides consent for marketing and analytics tracking.