Cookies and Tracking (GDPR)
Instagram itself may use cookies, however, Spotlight doesn't serve any Instagram cookies itself when used on your website.
In fact, the Spotlight feed is designed and generated purely by Spotlight without any Instagram or Facebook code or tracking being involved.
A breakdown
Instagram and Facebook will read their own cookies when you are connecting your account to Spotlight. This is how they can detect if you are already logged in to the relative Instagram or Facebook account.
However, these cookies are only used in the connection window (popup). They are not used on the admin side nor on the public-facing side of your website.
Spotlight's feed consists of only HTML, JavaScript, and CSS. Neither cookies nor local browser storage is used.