Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
lite-youtube-embed is an open source facade web component that shows a static YouTube thumbnail and only loads the real YouTube iframe when the visitor clicks play, ideally via youtube-nocookie.com. This defers all YouTube cookies and most data sharing until the user actively chooses to watch.
lite-youtube-embed is an open source facade web component that replaces a standard YouTube embed with a lightweight thumbnail placeholder. The real YouTube iframe only loads when the visitor actively clicks the play button, ideally using the youtube-nocookie.com domain. This privacy by design approach means YouTube cookies and most data sharing are deferred until the visitor makes an active choice to watch.
No YouTube cookies are set until the visitor clicks play. After clicking, the YouTube player loads and may set VISITOR_INFO1_LIVE (estimates bandwidth and personalisation, lasting 6 months), YSC (tracks video views for the session), VISITOR_PRIVACY_METADATA (6 months) and, on youtube.com, PREF (8 months for preferences). Before the click, if the thumbnail is loaded from i.ytimg.com rather than being self hosted, the visitor IP is exposed to Google on page load.
lite-youtube-embed is an excellent privacy by design solution. Because cookies and the YouTube connection are deferred until the visitor actively clicks play, the ePrivacy obligation to obtain prior consent before setting cookies is satisfied by the act of clicking. If the thumbnail is self hosted, there is no prior data transfer to Google and the pre-click state requires no consent. This makes it one of the most compliant ways to embed YouTube content.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
When the thumbnail is self hosted, no prior consent is required before the page loads. Clicking play constitutes informed, active consent to load the YouTube player. You should still inform visitors via your cookie policy and privacy notice. If thumbnails are loaded from i.ytimg.com, prior consent should be obtained before page load because the IP is already exposed. Use youtube-nocookie.com as the player source to minimise cookie scope after click.
Once the visitor clicks play, the YouTube player connects to Google LLC servers in the United States. Google relies on the EU US Data Privacy Framework and standard contractual clauses as transfer mechanisms. Self hosting the thumbnail eliminates any pre-click transfer. Document the post-click Google transfer in your records of processing activities and reference the applicable transfer mechanism.
To use lite-youtube-embed compliantly: self host thumbnails to achieve a fully cookieless pre-click state; set the videoid attribute and use youtube-nocookie.com as the player source; add a visible label on the thumbnail explaining that clicking loads YouTube; include YouTube in your cookie policy under the on demand media category; document the post-click Google data transfer; and review Google data processing terms and transfer mechanism annually.
Websites using lite-youtube-embed must obtain user consent under GDPR regulations.
DPIA considerations
A DPIA is unlikely to be required for lite-youtube-embed when the thumbnail is self hosted and the visitor clicks to load the player, as personal data processing is deferred until active consent. If the thumbnail is loaded from i.ytimg.com, the visitor IP is exposed on page load and a DPIA should assess this alongside the subsequent Google data transfer on play. Document the use of youtube-nocookie.com as the player source, the self hosting approach for thumbnails and the consent mechanism.
Sample consent text
This video is hosted on YouTube. Clicking play will load the YouTube player, which may set cookies and send your IP address and viewing data to Google in the United States. Do you consent to loading this YouTube video?
Third-party domains contacted
www.youtube-nocookie.comwww.youtube.comi.ytimg.coms.ytimg.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| VISITOR_INFO1_LIVE | Analytics | 6 months | Set by YouTube after the visitor clicks play to estimate bandwidth and personalise the player experience |
| YSC | Analytics | Session | Set by YouTube after click to track video views during the browser session |
| VISITOR_PRIVACY_METADATA | Functional | 6 months | Set by YouTube after click to store consent and privacy metadata for the visitor |
| PREF | Preferences | 8 months | Set on youtube.com after click to store viewer preferences such as language and autoplay settings |
lite-youtube-embed uses cookies for user preferences — inform visitors with a consent banner.
lite-youtube-embed sets no cookies in its initial state. Cookies are only set after the visitor actively clicks the play button and the YouTube iframe loads. At that point YouTube may set VISITOR_INFO1_LIVE (6 months, estimates bandwidth and personalisation), YSC (session, tracks video views), VISITOR_PRIVACY_METADATA (6 months) and on youtube.com PREF (8 months for preferences). Using youtube-nocookie.com as the player source reduces the cookie footprint.
When the thumbnail is self hosted, no prior consent is required before the page loads because no cookies are set and no data is sent to Google. Clicking play constitutes informed, active consent. If the thumbnail is loaded from i.ytimg.com, the visitor IP is exposed to Google on page load, which requires prior consent. Always use youtube-nocookie.com as the player source after click.
The legal basis is consent under Article 6(1)(a) GDPR for the YouTube player that loads on click. When the thumbnail is self hosted and the player is loaded via youtube-nocookie.com, the act of clicking play serves as the consent event. For the pre-click state with a self hosted thumbnail, no separate consent is required as no personal data is processed.
Data is transferred to the United States only after the visitor clicks play, at which point the YouTube player connects to Google LLC servers in the United States. Google relies on the EU US Data Privacy Framework and standard contractual clauses. If the thumbnail is self hosted there is no pre-click transfer to Google at all.
A DPIA is unlikely to be required when thumbnails are self hosted and the youtube-nocookie.com player source is used, because personal data processing is deferred until the visitor actively consents by clicking. If thumbnails are loaded from i.ytimg.com, a DPIA should assess the pre-click IP transfer to Google in the United States.
Self host the thumbnail images to achieve a fully cookieless and data transfer free pre-click state. Set the player source to youtube-nocookie.com. Add a visible label to the thumbnail placeholder stating that clicking loads YouTube. Include YouTube in your cookie policy under on demand media. Document the post-click Google data transfer and the applicable transfer mechanism in your records of processing activities.
lite-youtube-embed is already one of the most privacy friendly ways to embed YouTube content. The next step would be self hosting the video entirely, which eliminates any connection to Google. For a middle ground, consider a server side video proxy that strips visitor data before contacting YouTube. Alternatively link to the YouTube video rather than embedding it.
Add a YouTube entry to your cookie policy under the on demand media category. State that no cookies are set before the visitor clicks play. After clicking, list VISITOR_INFO1_LIVE, YSC, VISITOR_PRIVACY_METADATA and PREF with their durations. Note that data is transferred to Google in the United States under the EU US Data Privacy Framework. State that the player uses youtube-nocookie.com to minimise the cookie scope.