Substack

Overview

Substack is a newsletter publishing platform that provides embeddable subscription widgets for external websites. Publishers and content creators embed Substack signup forms on their personal sites, blogs, and landing pages to grow their subscriber lists. The widget allows visitors to enter their email address and subscribe to a Substack publication without leaving the host website.

What This Script Does

Substack embeds load as iframes or JavaScript widgets from substackapi.com and substack.com.

• Scripts loaded: Substack embed scripts load from substackapi.com, rendering a subscribe form or publication preview widget within the host page. The widget displays the publication name, description, and an email input field.
• Form submission: When a visitor enters their email address and submits the form, the data is transmitted to Substack's servers to create or update a subscriber record for the publication.
• Cookies: The embed may set cookies on the substack.com domain for session management and to track whether the visitor is already a Substack user. Specific cookie behavior depends on the embed type (iframe vs. JavaScript).
• Data collected: Email addresses submitted through the form, referrer URL (which site the subscription originated from), and basic interaction events (form displayed, form submitted). If the visitor is a logged-in Substack user, the embed may recognize their existing account.
• No behavioral tracking: The embed does not track page views, scroll depth, or browsing behavior on the host site beyond the form interaction itself.

Consent & Compliance

Substack embeds fall under the functional consent category.

Under GDPR and ePrivacy, the subscription widget serves a functional purpose — enabling visitors to sign up for content they want to receive. If the embed sets cookies through the substack.com domain before user interaction, those cookies may require consent under the ePrivacy Directive as they are not strictly necessary for the host site's functionality. Email collection through the form requires a GDPR-compliant legal basis (typically Article 6(1)(a) consent through the explicit subscribe action).

Under CCPA/CPRA, email addresses collected through the widget constitute personal information. The host site's privacy policy should disclose this data collection and Substack's role as a third-party processor.

Should You Block This Without Consent?

No. Substack embeds serve a functional purpose with minimal tracking impact. The subscription action is explicitly initiated by the visitor entering their email address. If the embed is implemented as a simple iframe, it has negligible cookie footprint on the host domain. For sites prioritizing minimal third-party exposure, consider using a custom form that submits to Substack's API server-side rather than embedding the client-side widget.