Plyr

Plyr by itself does not require consent. The library is loaded client-side from cdn.plyr.io, sets no cookies, and performs no tracking. Consent is only required when Plyr is configured to wrap a third-party embed such as YouTube or Vimeo, because those providers set tracking cookies. Under Article 5(3) of the ePrivacy Directive and the CJEU Planet49 ruling, the publisher must obtain prior, freely given, specific, informed and unambiguous consent before the embedded iframe is loaded.

Plyr itself sets no cookies. The reference player stores user preferences such as volume and captions only in localStorage, not as HTTP cookies. The cookies attributed to Plyr in a typical deployment actually come from the wrapped provider: YouTube sets VISITOR_INFO1_LIVE, YSC and PREF; Vimeo sets vuid and player cookies. To eliminate even those, do not wrap third-party providers, or use facade patterns that defer iframe loading until consent.

Plyr itself does not transfer personal data anywhere. The library is fetched from cdn.plyr.io (served by Cloudflare), which means CDN edge nodes may temporarily process the visitor IP. Personal-data transfers to the US occur when Plyr is configured to embed YouTube or Vimeo: those iframes share IP, User-Agent and viewing behaviour with Google or Vimeo in the United States. A lawful transfer mechanism (SCCs plus the EU-US Data Privacy Framework) is then required.

Plyr is a UI library that runs entirely in the visitors browser; it is not a data processor and does not need a DPA. YouTube and Vimeo, when wrapped by Plyr, are independent controllers (or joint controllers, depending on configuration) that determine the purposes and means of processing for their tracking. The publisher remains responsible for obtaining consent for those third-party cookies and for informing visitors about the transfer to the United States.

First, switch the embed URL from youtube.com to youtube-nocookie.com, which Plyr supports natively; this delays YouTube cookie placement. Second, implement a facade or click-to-load pattern: render a thumbnail and play button, and only call Plyr.setup() after the visitor accepts marketing cookies. Third, list YouTube in your cookie banner with a granular toggle, document the legal basis (Article 6(1)(a) GDPR), and reference the EU-US Data Privacy Framework as the transfer mechanism.

No. The privacy-enhanced mode delays cookie placement until playback starts, but cookies and tracking still occur once the user clicks play, and the IP address is still shared with Google before that. EU data protection authorities (CNIL, Garante, datenschutzkonferenz.de) consider that youtube-nocookie.com reduces but does not eliminate the consent obligation. Consent must still be requested before the YouTube iframe is loaded if it would set cookies.

dnt stands for Do Not Track. Adding dnt=1 to a Vimeo embed URL instructs Vimeo to disable its analytics cookies and tracking pixels for that session. Plyr passes through query parameters, so you can configure Vimeo embeds as https://player.vimeo.com/video/123?dnt=1. The visitor IP is still transmitted to Vimeo for video delivery, and consent may still be required in strict jurisdictions, but the cookie footprint is significantly reduced.

Yes. Plyr is open source under the MIT licence and the JavaScript and CSS bundles can be downloaded from npm or GitHub and served from your own origin. Self-hosting removes the only third-party network call that the library otherwise makes (to cdn.plyr.io) and is recommended for organisations that want to demonstrate full data minimisation. Self-hosting does not change anything about wrapped YouTube or Vimeo embeds, which still load from their respective providers.