Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Video.js is an open source HTML5 video player library that sets no cookies of its own, though its CDN delivery and external video providers can introduce cookies and data flows.
Video.js is a popular open source JavaScript library that provides a customisable HTML5 video player. It can be hosted directly on the operator own server or loaded from the public CDN at vjs.zencdn.net, which is delivered by Fastly. Through plugins it can also play media from external providers such as YouTube and Vimeo.
On its own the Video.js library sets no cookies and contains no tracking. The privacy profile of a given setup therefore depends entirely on how the player is delivered and which video sources it plays.
When Video.js is self hosted and plays a local video file, no cookies are set and no personal data leaves the operator infrastructure beyond ordinary access logs. When the player is loaded from the vjs.zencdn.net CDN, the visitor browser contacts Fastly, which may set a load balancing cookie and processes the visitor IP address to deliver the file.
The most significant data flows appear when Video.js plays content from YouTube or Vimeo. These providers set their own cookies, such as YouTube YSC and VISITOR_INFO1_LIVE, and receive the visitor IP and viewing data, often for analytics and advertising purposes.
Because the self hosted player sets no cookies, it raises no obligations under Article 5(3) of the ePrivacy Directive by itself. As soon as a CDN cookie or a provider cookie that is not strictly necessary is stored, prior consent is required, and the associated processing of the visitor IP and viewing behaviour needs a legal basis under Article 6 of the GDPR.
Where YouTube or Vimeo are involved, the website operator and the provider may be joint controllers for the data collected on embedding, which should be reflected in the privacy notice.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
No consent is needed to run a self hosted Video.js player with local media. Consent is required before loading external provider content that sets cookies, before using the CDN if it sets non essential cookies, and before any analytics plugin runs. A common compliant pattern is a click to load placeholder that triggers the embed only after the visitor accepts.
Self hosting within the EEA keeps all data local. Using the Fastly CDN or YouTube and Vimeo may route the visitor IP and request data to servers in the United States. For such transfers the operator should rely on the EU US Data Privacy Framework or standard contractual clauses, and verify that the provider participates in a valid transfer mechanism.
Prefer self hosting Video.js and the media files within the EEA. If you use YouTube, enable privacy enhanced mode by loading from youtube nocookie.com, and gate every external embed behind consent with a click to load placeholder. Document all third party providers in your privacy notice and cookie policy and review the setup whenever you add a plugin.
Websites using Video.js must obtain user consent under GDPR regulations.
DPIA considerations
Self hosted Video.js sets no cookies and processes no personal data beyond standard server logs, so a data protection impact assessment is usually unnecessary. A DPIA becomes relevant when the player is combined with external providers such as YouTube or Vimeo, or when behavioural analytics plugins are added, since these may involve profiling and third country transfers.
Sample consent text
This page can embed video content delivered through external providers that may set cookies and process your data outside the EU. Video is loaded only after you give your consent. You can change or withdraw your choice at any time in the cookie settings.
Third-party domains contacted
vjs.zencdn.netyoutube-nocookie.comyoutube.complayer.vimeo.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| fastly_balancer | Strictly necessary | Session | Load balancing cookie that may be set by the Fastly CDN when Video.js is loaded from vjs.zencdn.net, used to route the request to a server. No own cookie is set by Video.js itself. |
| YSC | Marketing | Session | Set by YouTube when an embedded video is played, used to remember user interactions with the player and to measure views. Requires prior consent. |
| VISITOR_INFO1_LIVE | Marketing | 6 months | Set by YouTube to estimate bandwidth and to personalise the player experience and advertising. Appears only when YouTube content is embedded. Requires prior consent. |
| vuid | Analytics | 2 years | Set by Vimeo when an embedded Vimeo video is used, to collect analytics data on how the visitor uses videos. Requires prior consent. |
Video.js uses cookies for user preferences — inform visitors with a consent banner.
Video.js sets no cookies of its own. Cookies only appear from the surrounding setup: the Fastly CDN at vjs.zencdn.net may set a load balancing cookie, and external providers such as YouTube and Vimeo set tracking cookies like YSC and VISITOR_INFO1_LIVE when their content is played.
A self hosted Video.js player with local media needs no consent. Consent is required before loading external provider content that sets cookies, before using a CDN that sets non essential cookies, or before any behavioural analytics plugin runs.
For a self hosted player the operator can rely on legitimate interest under Article 6(1)(f) of the GDPR, since no cookies are set. Where external providers or non essential CDN cookies are used, consent under Article 6(1)(a) of the GDPR and Article 5(3) of the ePrivacy Directive is the appropriate basis.
Self hosted Video.js within the EEA transfers nothing abroad. Using the Fastly CDN or YouTube and Vimeo can send the visitor IP and request data to servers in the United States, which requires a valid transfer mechanism such as the EU US Data Privacy Framework or standard contractual clauses.
A DPIA is usually unnecessary for a self hosted player because it processes no personal data beyond server logs. It becomes relevant when the player is combined with external providers or analytics plugins that involve profiling or systematic third country transfers.
Self host the player and media within the EEA, and gate external embeds behind consent using a click to load placeholder. For YouTube use the youtube nocookie.com domain, document every provider in your privacy notice, and avoid loading the CDN build if a self hosted copy is feasible.
Privacy friendly alternatives include the native HTML5 video element with self hosted files, Plyr, and self hosted players that avoid external providers. Hosting media within the EEA and avoiding YouTube or Vimeo embeds is the strongest way to reduce cookies and transfers.
List only the cookies actually present in your setup. For self hosted local media there are none. If you use the CDN add the Fastly cookie, and if you embed YouTube or Vimeo list their cookies with purpose and duration, updating the policy whenever the configuration changes.