FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Social media

YouTube embed

Marketing

Embedding YouTube videos on websites causes Google's tracking code to load in visitors' browsers, setting advertising and analytics cookies that track viewing behaviour and build advertising profiles. This requires consent under the ePrivacy Directive. YouTube provides a privacy-enhanced embed domain (youtube-nocookie.com) that significantly reduces cookie placement. Alternatively, using a facade/thumbnail approach delays YouTube loading until users click play, reducing privacy impact.

Block YouTube embed until consentScan my site
Overview

What does YouTube embed do?

What a YouTube embed actually does

YouTube is the video platform operated by Google Ireland Limited (controller of record for EU embedders) and Google LLC (sub processor in the United States). When a publisher embeds a YouTube video on its pages, the standard iframe is served from youtube.com and immediately loads JavaScript, fonts and player resources from ytimg.com, googlevideo.com and doubleclick.net. The player exchanges advertising signals with Google Marketing Platform, even when no advertising is displayed on the video.

Cookies and storage set by YouTube embeds

The standard youtube.com embed sets the cookies VISITOR_INFO1_LIVE (visitor identifier, 6 months), YSC (session identifier, browser session), PREF (preferences, 8 months) and IDE on doubleclick.net (advertising id, 13 months) as soon as the iframe loads. The privacy enhanced mode youtube-nocookie.com sets the same cookies only after the user clicks play, instead of on iframe load. Both modes also write localStorage entries to remember playback position and quality settings.

Lawful basis and consent

Consent under GDPR art. 6(1)(a) and ePrivacy art. 5(3) is required before loading any YouTube embed because the iframe drops advertising cookies on third party domains (doubleclick.net, google.com). The CJEU Fashion ID case (C 40/17, July 2019) confirms that the embedding website is joint controller for the data exchanged with the YouTube iframe. The CNIL has fined French organisations for loading YouTube content without consent (e.g. Carrefour 2020, Le Mans Université 2023). Even youtube-nocookie.com is not consent free because the lookup still discloses the visitor IP to Google.

International data transfers and Schrems II

Loading a YouTube embed transmits the visitor IP, user agent, referrer and cookies to Google LLC in the United States. Google LLC is certified under the EU US Data Privacy Framework since 10 July 2023 and the YouTube Terms incorporate the EU Standard Contractual Clauses (module 3). However, the EDPB binding decision against Google Analytics (1/2022) and several DPA fines confirm that the publisher must also implement supplementary measures, document a transfer impact assessment and inform users.

Practical compliance checklist

Replace the standard iframe with a click to load placeholder (poster image plus play button) that only loads the YouTube embed after consent. Use the youtube-nocookie.com domain instead of youtube.com to minimise cookie writes before play. Document Google Ireland Limited and Google LLC in your records of processing (GDPR art. 30) and in the privacy notice. List the cookies VISITOR_INFO1_LIVE, YSC, PREF and IDE in your cookie policy. Consider self hosting the most important videos with Plyr, Mux Video, Vimeo Pro or a Bunny.net stream for sensitive content. Refresh the consent every six months in line with CNIL deliberation 2020 091.

Alternatives

GDPR friendly alternatives include Vimeo Privacy Friendly Embed (US with EU residency), Cloudflare Stream, Mux Video (EU and US), Bunny Stream (Slovenia and global edge), PeerTube (open source self hostable), Dailymotion (France) and the self hosted Plyr or Video.js stack with HLS manifests on your own CDN.

Compliance

YouTube embed and the GDPR

YouTube embed is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (GDPR art. 6(1)(a) and ePrivacy art. 5(3)) for the standard youtube.com embed because it sets advertising cookies (VISITOR_INFO1_LIVE, YSC, PREF, IDE) and DoubleClick identifiers before any interaction. Even the youtube-nocookie.com privacy enhanced mode reads cookies and writes localStorage on play, so a documented user action equivalent to consent is needed.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive 2002/58/EC, EU US Data Privacy Framework, CJEU C 40/17 Fashion ID, EDPB binding decision 1/2022 against Google Analytics, CNIL deliberation 2020 091, TTDSG, LOPDGDD, LIL

Impact assessment (DPIA)

A DPIA is generally not required for standard YouTube video embedding with proper consent management. It may become relevant for large media platforms embedding many videos where Google's audience tracking creates systematic profiling of visitors.

Sample text for your banner

This page embeds YouTube videos provided by Google Ireland Limited (operator) and Google LLC (sub processor in the United States). When you click play, YouTube sets advertising cookies (VISITOR_INFO1_LIVE, YSC, PREF, IDE) and transmits your IP address, user agent and the video viewed to Google in the United States under the EU US Data Privacy Framework and the EU Standard Contractual Clauses. We load each YouTube embed only after you accept the marketing or video category in our cookie preferences, and we use the youtube-nocookie.com privacy enhanced mode whenever possible.
Cookies and trackers

What YouTube embed sets and contacts

Tracking method
embedded_iframe_video_player_with_advertising_cookies
Server location
YouTube embeds are served from the Google global network (youtube.com, youtube-nocookie.com, ytimg.com, googlevideo.com). EU visitors typically connect to a European Google Cloud edge (Frankfurt, Ireland, Belgium, the Netherlands), but the back end resolution and advertising auction are global, with significant US infrastructure involvement.
Cookieless mode available
Yes
Data transferred outside the EU
Google Ireland Limited is the contracting entity for EU embedders; Google LLC in the United States is the principal sub processor. Embedding YouTube content transmits the visitor IP, user agent, referrer and a set of advertising cookies to Google. Transfers rely on the EU US Data Privacy Framework certification of Google LLC and the EU Standard Contractual Clauses bundled with the YouTube Terms.

Cookies set (2)

NameTypeDurationPurpose
YSCsessionSessionYouTube session identifier loaded on standard YouTube embed, tracks viewing session data
VISITOR_INFO1_LIVEpersistent6 monthsYouTube visitor identifier for tracking viewing history and personalising recommendations

Third-party domains contacted (3)

  • youtube.com
  • www.youtube-nocookie.com
  • i.ytimg.com
Questions

Frequently asked questions about YouTube embed

Can't find your question? Write to us, we answer fast.

Does embedding YouTube require GDPR consent?

Standard YouTube embeds require consent as they set advertising cookies immediately on page load. Using youtube-nocookie.com reduces but may not fully eliminate consent requirements. The facade approach (thumbnail loading) is the most privacy-friendly and may not require a consent banner.

What is the youtube-nocookie.com embed?

youtube-nocookie.com is YouTube's privacy-enhanced embed domain. According to Google, it does not set cookies until the user plays the video. Enable it by replacing "youtube.com/embed/" with "www.youtube-nocookie.com/embed/" in your iframe src URL. WordPress' built-in YouTube block uses this by default.

What cookies does a standard YouTube embed set?

Standard YouTube embeds set VISITOR_INFO1_LIVE (YouTube visitor ID, 6 months), YSC (session, no expiry), and may set advertising cookies if the user is logged into Google. These require consent. The youtube-nocookie.com mode avoids setting these cookies until play.

Does YouTube transfer data outside the EU?

Yes. All YouTube (Google) processing occurs on US infrastructure. SCCs are required as part of Google's standard terms. Accept Google's data processing terms and disclose the US transfer in your privacy policy when embedding YouTube videos.

How do I implement the YouTube facade pattern?

Use the lite-youtube-embed library (available on npm and GitHub) which renders a thumbnail and loads the actual YouTube iframe only when clicked. This is semantic, accessible, dramatically faster, and privacy-respecting. Alternatively, use a custom implementation with a thumbnail image and onclick handler that replaces the image with the actual iframe.

Is the youtube-nocookie.com embed GDPR compliant without consent?

Legal opinions differ. Google says no cookies are set until play. Some DPAs consider even IP address transmission on iframe load to be personal data transfer requiring consent. The safest approach: use youtube-nocookie.com AND the facade pattern, so the YouTube domain only receives a request when the user actively clicks play.

What are EU-based alternatives to YouTube embedding?

Vimeo (US-hosted but with dnt=1 privacy mode), Wistia (US-hosted), and Dailymotion (French company) are alternatives. For self-hosted video, PeerTube (open-source, EU-hostable) provides a YouTube-compatible embed without Google's data practices.

Do I need to mention YouTube embeds in my privacy policy?

Yes. Disclose that the website embeds YouTube videos, that YouTube (Google) sets cookies when videos are loaded or played, that data is transferred to Google in the US, and provide a link to YouTube's Privacy Policy. If using youtube-nocookie.com, note that this reduces but may not eliminate data processing.

Same category

More services: Social media

See the whole category

Facebook Login

Facebook Login is an identity and authentication platform providing secure login, single sign-on (SSO), and multi-factor authentication for websites and applications. It supports social login, passwordless authentication, and user management with enterprise-grade security. Facebook Login simplifies identity implementation for developers while ensuring compliance. With adaptive authentication and anomaly detection, Facebook Login protects user accounts while maintaining a frictionless experience.

Marketing

Douban

Douban is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Douban is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Douban offers reliable solutions that scale with organizational needs and evolving web standards.

Marketing

Twitter Widgets

Twitter Widgets is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Twitter Widgets provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Twitter Widgets helps deliver the right message to the right audience at the right time.

Marketing

OnePress Social Locker

OnePress Social Locker is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. OnePress Social Locker supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, OnePress Social Locker remains a leading web.

Marketing

RiteKit

RiteKit is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. RiteKit provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, RiteKit helps deliver the right message to the right audience at the right time.

Marketing

Instafeed

Instafeed is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Instafeed supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Instafeed remains a leading web development choice.

Preferences

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site